Metafiles and data streams defragmentation

Last updated on Jun 6, 2022

In addition to regular files and folders defragmentation UltraDefrag fully supports defragmentation of NTFS metafiles and data streams.

There are two things which make the metafiles and data streams peculiar.

The first thing is that Windows hides them very well. It never shows them in Windows Explorer and you have to use special tools, like FTK Imager, to be able to see them:

The files in the root directory with the dollar sign in the beginning of their names you normally don’t see on your system are the metafiles and the files marked as Alternate Data Stream are the data streams.

The second thing which makes the metafiles and data streams so special is that they are one of the most essential system files. Windows uses them to organize the file system, back up critical system data, manage free space allocation, track bad clusters and store security information among other things.

The most notable metafiles are:

File	Description
$MFT	The master file table (MFT). Contains general information about all files and folders on the disk, such as file names, sizes, access permissions, timestamps and lists of fragments.
$MFTMirr	A backup copy of the first 4 clusters of $MFT.
$LogFile	Contains transaction log of file system metadata changes.
$Volume	Contains general information about the disk, such as the volume label and the file system version.
$AttrDef	A table of file attributes that associates numeric identifiers of the attributes with their names.
$Bitmap	A map of clusters allocated on the disk.
$Boot	The volume boot record (VBR).
$BadClus	A file that keeps track of all the clusters having bad sectors, so that the file system driver can skip them in all operations.
$Secure	A database of file access permissions.
$UpCase	A table of unicode uppercase characters.
$Extend	A folder containing information about disk quotas and reparse points. Also this folder contains a USN journal.

UltraDefrag can fully defragment all the metafiles except the master file table (MFT) which cannot be processed in regular defragmentation because its first 16 clusters are immovable. However, using UltraDefrag you can easily optimize the master file table. UltraDefrag features a single click MFT optimization which places MFT fragments as close as possible to each other for the best performance possible.

The data streams are special system files which help Windows to manage the metafiles, reparse points and disk quotas among other things. A peculiar feature of the data streams is that they do no exist by themselves and are always attached to a file or a folder. Windows uses the following convention to denote which stream belongs to which file: file_name:stream_name. Below are a few notable examples of the data streams along with the files they are attached to:

Data stream	Description
$MFT::$BITMAP	A map of the MFT entries showing which ones are currently in use.
$Quota:$O, $Quota:$Q	Contain the disk quota information.
$Reparse:$R	Helps Windows handle the reparse points.
$Secure:$SDS, $Secure:$SDH, $Secure:$SII	A database of file access permissions and indices which help to manage it.
$UsnJrnl:$J	Contains the USN journal of the file system.

The metafiles and data streams are the most frequently accessed files. Whenever Windows performs a file operation, such as reading a file, writing to a file, creating or deleting a file, the metafiles and data streams get accessed first to get all the information required to perform the operation and then they get updated to keep track of the changes made to the file system.

As Windows performs thousands of file operations every second, the metafiles and data streams fragmentation drastically drops down system performance. That’s why it is very important to defragment them whenever they get fragmented and that’s exactly what UltraDefrag does! Whenever you defragment a disk or perform its optimization UltraDefrag defragments all the metafiles and data streams to keep your system running at peak performance.