JSI Tip 3391. The Windows 2000 Disk Defragmenter analysis shows more fragments than are possible for the file sizes?

The built in Disk Defragmenter analysis, on an NTFS volume, may show more fragments than could possibly exist for the indicated file sizes. Example:

The default NTFS cluster size can be as low as 512 bytes or as large as 4096 bytes, depending on the formatted volume size. The minimum file allocation is one cluster. When you open a file for write access, NTFS tries to preallocate additional space, in multiples of cluster size, to help prevent fragmentation as the file grows.

If you use Windows Explorer to look at the file properties of one of these files, it may look like:

This file, which is open for write access, has additional clusters preallocated. The 'joeuser' log won't be closed, freeing the additional allocation, until 'joeuser' logs off. The other log files won't be closed until you shutdown.

The Windows 2000 defragmentation API will not allow the extra space to be moved and consolidated while the file is open. When you restart the computer, NTFS allocated clusters that are near the current end-of-file.

NOTE: It may be better to have multiple fragments within the same cylinder than to have only one additional fragment that requires a long seek.

NOTE: Diskeeper has a Boot Time defragmentation option.