File data in the MBR. 1

[Tom70]

Did you know Microsoft Win 2000 and up keeps an attribute record of every file that has ever been on your computer in the MBR? If the file is less than 1500 Bytes, then the entire file is stored there. I am not making a false claim. Microsoft Windows 2000 Professional book from the college I attend states that this is for security purposes. Does anyone know how to clear the MBR? Currently, I use FDISK(Win95) to change the single partition to multiple partitions, I format, repartition to a single partition, format again, then use Win XP disk to load my operating system. I figure that Win 95 doesn't support this, so the MBR is cleared this way. Does anyone know if this is true? Does anyone know a better way? Any input on the subject would be appreciated as I am certain this shortens the life of my hard drive.

Thanks to all.

 

[wolluf]

I don't know where you get your information from - but its incorrect. The MBR is only 512 bytes! So, you might have a bit of a problem storing anything there!

To write a new MBR, you can use fdisk /mbr from a dos prompt (after booting from win98 boot floppy for example) or you can use Fixmbr from 2k or XP recovery console. But you generally don't need to do this unless you have a problem.

As for partitioning - if you are using XP you'd be better off using its tools to partition your drive. During the installation process you can delete, create and format partitions (Fat & Ntfs). After installation you can use Disk Management (run diskmgmt.msc) to manage your partitions (this applies to 2k too).

Note: You cannot resize partitions natively in XP - need something like Partition Magic to do that.

 

[bcastner]

Could you provide the author and title of this book?

It is just absolutely, completely, without mitigation incorrect.

 

[Tom70]

Sorry, But it is not incorrect. in W2K the FAT is 2MB. That is why I use WIN95 to fdisk and partition(it doesn't support the new MBR). Also, if you go to disk management in W2K and XP, then you can right-click the drive and select convert to dynamic disk. That will allow you to resize and add partitions(without restarting the computer). A word of advice. You can do the conversion but you cannot revert back without losing all data on the drive. And lastly, the author... the Microsoft Press Corporation.

I thank you for your input though.

 

[linney]

Do you mean MFT (not MBR).

The NTFS file system contains a file called the master file table, or MFT. There is at least one entry in the MFT for every file on an NTFS volume, including the MFT itself. All information about a file, including its size, time and date stamps, permissions, and data content, is stored either in MFT entries, or in space outside the MFT that is described by MFT entries.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/base/master_file_table.asp

 

[wolluf]

Tom70

I don't know what dynamic disks do with track0 or where details of its file structure are stored or whether using dynamic disks means everything is recorded somehwere - BUT the master boot record is 512 bytes - so its not recorded there.

Dynamic disks obviously use different structures (compared to FAT, FAT32, NTFS or any other 'normal' filestore) as they are incompatible with everything else (which for my money is a very good reason to avoid them) - BUT you didn't even mention dynamic disks in your original post. It is helpful if you do explain what you are asking about.

 

[Comtech]

I think Tom70 is paranoid to think that EVERY program detail is stored in the MBR, and uses a Win95 fdisk to be rid of it. A direct link to the source proving it will, of course, shut me up right quick.
I also think that it could be a simple misunderstanding of terms (or too many Mikes), and that he actually means the MFT, as linney has pointed out.

Cheers,
Jim

http://members.cnx.net/reboot/

 

[bcastner]

It must be the MFT.

But wait until he looks what is in the directory table of a FAT32 volume!

 

[Tom70]

My apologies,

I do not have the Win 2000 Professional book anymore, so I have a feeling you all are right about the MFT being the reference I originally posted. I can confirm this at college so I will make sure and post my findings.

And to WOLLUF, I was referring to Dynamic disk conversion for your previous post about partitioning. Your quote was "Note: You cannot resize partitions natively in XP - need something like Partition Magic to do that." I thought when converted to Dynamic disk you could. Not true?


LINNEY, I am sure if what you say is correct(and I am), then I would add that if the file is less than 1500 Bytes then the file is entirely stored in the MFT.

COMTECH, I have always been at least somewhat of a conspiracy theorist, though my reasons are not just privacy. The performance always drops after a period of time using windows and I often load free programs like peer to peer and the hidden programs that are likened to spyware annoy me(though I haven't looked for them specifically) so I like to clean my system periodically.

BCASTNER, I am of course interested to learn what you mean. To quote you "But wait until he looks what is in the directory table of a FAT32 volume!"

And again, thanks to all for your replies.

P.S. My computer is under warranty so if the hard drive fails that is O.K. But, I am sure all that formatting is not good for it.

 

[Comtech]

A little caution is OK, especially when it comes to "phone home" programs. There are definitive ways to counteract them.
Performance drops, because of the way Windows operating systems use a registry, and shoddy software, that does NOT remove itself completely from the computer when uninstalled.
I like to clean my systems periodically as well.
Formatting a drive does not wear it out any faster than normal use. Actually, normal use will probably wear it out faster than a freshly formatted, and software-loaded drive.
Fragmentation causes the heads to move far more in a well used hard drive, than a newly loaded one.
I have drives here, dating to 1982, that have taken well beyone their normal share of abuse and formatting, and they're still running. I have a 200 meg in a 'Nix box that hasn't been touched, and is still running after 428 days, with not even a restart (Seagate BTW).
I have other drives that get formatted at least once a week, as I update my drivers/tools and pack it off to a customer's house. I find it invaluable to have a drive that I can plug directly into a "broken" system and have all my software at hand easily.
As for "clearing the MBR", DOS/Win9x's "fdisk /mbr" and 2k/XP's "fixmbr" will do the job with ease and reliability as they always have.

Cheers,
Jim

http://members.cnx.net/reboot/

 

[bcastner]

Tom70,

Not trying to be cryptic about FAT32 directory entries. It is just that they contain a fairly comprehensive list of file attribute information, and this does not disppear until the directory entry is re-used. In addition the two FATs are in their design linked lists, so that re-creating a file is relatively trivial until all the chained-blocks are re-assigned by new FAT entries.

This how unerase software works.

My point being that reverting an MFT volume to FAT32 offers no discernable advantages to the highly security concerned user. Any security problems from either disk format are going to occur because someone was able to get local console access.

 

[Tom70]

I have since reloaded the system. The entire process of formatting, loading operating system, loading programs, loading data, updating, and defragmenting has taken almost 2 full days. So I didn't verify what was causing the disk activity. I think it may have been the indexing service(even though I turned it off). Now, about the MBR/MFT issue, I verified that the MFT is what I meant. The strange thing I noticed in formatting and partitioning is I found that of my 38154K of total disk space only 38147K is available. 7Mb is needed for "system use"(I assume for FAT or MBR or both). Is that typical? Also in re-reading about the MFT I found it is:

1. Not user accessible.
2. Increases in size with the addition of more files to the system.
3. Cannot be defragmented(great, more performance problems).
4. Information regarding the fragments can be viewed in Disk Defragmenters report.

The posts have been most helpful.

I don't know why performance is so important. I guess because my last laptop was a:

Pentium1 75Mhz
16Mb RAM
500Mb hard drive
Still works though. Now, I have:

Pentium4 2Ghz
512Mb RAM(DDR)
40Gb hard drive

Thanks again.