The built in Disk Defragmenter analysis, on an NTFS volume, may show more fragments than could possibly exist for the
indicated file sizes. Example:
Fragments File Size Files that did not defragment
--------------------------------------------------------------------
14 1 KB \WINNT\system32\config\software.LOG
8 1 KB \WINNT\system32\config\default.LOG
11 1 KB \Documents and Settings\joeuser\ntuser.dat.LOG
The default
NTFS cluster size can be as low
as 512 bytes or as large as 4096 bytes, depending on the formatted volume size. The minimum file allocation is one cluster.
When you open a file for write access,
NTFS tries to preallocate additional space, in multiples of cluster size,
to help prevent fragmentation as the file grows.
If you use Windows Explorer to look at the file properties of one of these files, it may look
like:
Size: 1.00KB (1,024 bytes)
Size on Disk: 4.00KB (4,096 bytes)
This file, which is open for write access, has additional clusters preallocated. The 'joeuser'
log won't be closed, freeing the additional allocation, until 'joeuser' logs off. The other log files won't be closed until you
shutdown.
The Windows 2000 defragmentation API will not allow the extra space to be moved and consolidated while the file is open. When you
restart the computer, NTFS allocated clusters that are near the current end-of-file.
NOTE: It may be better to have multiple fragments within the same cylinder than to have only one additional fragment that
requires a long seek.
