[Advertisements]

Well sent yahoo a inquiry bout their transparent window just dont know when they will respond. Or how they will respond

[Retired Tech]

A week is usual

[Retired Tech]

Off the top of my head

chkntfs volume: [...]

chkntfs [/d]

chkntfs [/t[:time]]

chkntfs [/x volume: [...]]

chkntfs [/c volume: [...]]

Parameters
volume: [...] : Required. Specifies the drive letter (followed by a colon), mount point, or volume name. Displays a message that identifies the file system of the specified volume. If automatic file checking is scheduled to be run, this parameter displays a message indicating whether the volume has been corrupted, which requires you to run chkdsk.

/d : Restores all chkntfs default settings, except the countdown time for automatic file checking. Default behavior is to check all volumes when the computer is started.

/t[:time] : Changes the Autochk.exe initiation countdown time to the specified amount of time entered in seconds. If you do not specify :time, /t displays the current countdown time.

/x volume: [...] : Excludes the specified volume from being checked when the computer starts, even if the volume is marked as requiring chkdsk.

/c volume: [...] : Schedules the specified volume to be checked when the computer starts.

/? : Displays help at the command prompt.

To display the Autochk.exe initiation countdown time, type:

chkntfs /t

When changing the Autochk.exe initiation countdown time, type the time in seconds. For example, to change the countdown time to 30 seconds, type:

chkntfs /t:30

The /x command-line option is not accumulative. If you type it more than once, the most recent entry overrides the previous entry. To exclude multiple volumes, list them all in one command. For example, to exclude both the E: and F: volumes, type:

chkntfs /x e: f:

To exclude the F: volume only, type:

chkntfs /x e:

chkntfs /x f:

The /c command-line option is accumulative. If you want to check the specified volume only, reset the defaults to clear any previous commands, exclude all volumes from being checked, and then schedule automatic file checking on the desired volume.

For example, to schedule automatic file checking on the D: volume only, type:

chkntfs /d

chkntfs /x c: d: e:

chkntfs /c d:

The chkdsk command with the parameters listed below is only available when you are using the Recovery Console The chkdsk command with different parameters is available from the command prompt.

chkdsk [drive:] [/p] [/r]

Parameters

none

Used without parameters, chkdsk displays the status of the disk in the current drive.

drive:

Specifies the drive that you want chkdsk to check.

/p

Performs an exhaustive check even if the drive is not marked for chkdsk to run. This parameter does not make any changes to the drive.

/r

Locates bad sectors and recovers readable information. Implies /p.

Note

• The chkdsk command requires the file Autochk.exe. If it cannot find it in the startup directory (\%systemroot%\System32, by default), it will attempt to locate it on the Windows Installation CD. If you have a multiboot computer, be sure you are issuing this command from the drive containing Windows.

Syntax
chkdsk [volume:][[Path] FileName] [/f] [/v] [/r] [/x] [/i] [/c] [/l[:size]]

Parameters
volume: : Specifies the drive letter (followed by a colon), mount point, or volume name.

[Path] FileName : Specifies the location and name of a file or set of files that you want chkdsk to check for fragmentation. You can use wildcard characters (that is, * and ?) to specify multiple files.

/f : Fixes errors on the disk. The disk must be locked. If chkdsk cannot lock the drive, a message appears that asks you if you want to check the drive the next time you restart the computer.

/v : Displays the name of each file in every directory as the disk is checked.

/r : Locates bad sectors and recovers readable information. The disk must be locked.

/x : Use with NTFS only. Forces the volume to dismount first, if necessary. All open handles to the drive are invalidated. /x also includes the functionality of /f.

/i : Use with NTFS only. Performs a less vigorous check of index entries, reducing the amount of time needed to run chkdsk.

/c : Use with NTFS only. Skips the checking of cycles within the folder structure, reducing the amount of time needed to run chkdsk.

/l[:size] : Use with NTFS only. Changes the log file size to the size you type. If you omit the size parameter, /l displays the current size.

/?: Displays help at the command prompt.

Remarks
• Running chkdsk

To run chkdsk on a fixed disk, you must be a member of the Administrators group.

• Checking a locked drive at restart

If you want chkdsk to correct disk errors, you cannot have open files on the drive. If files are open, the following error message appears:

Chkdsk cannot run because the volume is in use by another process. Would you like to schedule this volume to be checked the next time the system restarts? (Y/N)

If you choose to check the drive the next time you restart the computer, chkdsk checks the drive and corrects errors automatically when you restart the computer. If the drive partition is a boot partition, chkdsk automatically restarts the computer after it checks the drive.

• Reporting disk errors

Chkdsk examines disk space and disk use for the file allocation table (FAT) and NTFS file systems. Chkdsk provides information specific to each file system in a status report. The status report shows errors found in the file system. If you run chkdsk without the /f command-line option on an active partition, it might report spurious errors because it cannot lock the drive. You should use chkdsk occasionally on each disk to check for errors.

• Fixing disk errors

Chkdsk corrects disk errors only if you specify the /f command-line option. Chkdsk must be able to lock the drive to correct errors. Because repairs usually change a disk's file allocation table and sometimes cause a loss of data, chkdsk sends a confirmation message similar to the following:

10 lost allocation units found in 3 chains.

Convert lost chains to files?

If you press Y, Windows saves each lost chain in the root directory as a file with a name in the format Filennnn.chk. When chkdsk finishes, you can check these files to see if they contain any data you need. If you press N, Windows fixes the disk, but it does not save the contents of the lost allocation units.

If you do not use the /f command-line option, chkdsk sends a message if a file needs to be fixed, but it does not fix any errors.

If you use chkdsk /f on a very large disk (for example, 70 gigabytes) or a disk with a very large number of files (for example, millions of files), chkdsk might take a long time (for example, over several days) to complete. The computer is not available during this time because chkdsk does not relinquish control until it is finished.

• Checking a FAT disk

Windows displays chkdsk status reports for a FAT disk in the following format:

Volume Serial Number is B1AF-AFBF

72214528 bytes total disk space

73728 bytes in 3 hidden files

30720 bytes in 12 directories

11493376 bytes in 386 user files

61440 bytes in bad sectors

60555264 bytes available on disk

2048 bytes in each allocation unit

35261 total allocation units on disk

29568 available allocation units on disk

• Checking an NTFS disk

Windows displays chkdsk status reports for an NTFS disk in the following format:

The type of the file system is NTFS.

CHKDSK is verifying files...

File verification completed.

CHKDSK is verifying indexes...

Index verification completed.

CHKDSK is verifying security descriptors...

Security descriptor verification completed.

12372 kilobytes total disk space.

3 kilobytes in 1 user files.

2 kilobytes in 1 indexes.

4217 kilobytes in use by the system.

8150 kilobytes available on disk.

512 bytes in each allocation unit.

24745 total allocation units on disk.

16301 allocation units available on disk.

• Using chkdsk with open files

If you specify the /f command-line option, chkdsk sends an error message if there are open files on the disk. If you do not specify the /f command-line option and open files exist, chkdsk might report lost allocation units on the disk. This could happen if open files have not yet been recorded in the file allocation table. If chkdsk reports the loss of a large number of allocation units, consider repairing the disk.

• Finding physical disk errors

Use the /r command-line option to find physical disk errors in the file system. For information about recovering physically damaged files with recover, see Related Topics.

• Reporting bad disk sectors

Bad sectors reported by chkdsk were marked as bad when your disk was first prepared for operation. They pose no danger.

• Understanding exit codes

The following table lists the exit codes that chkdsk reports after it has finished.

Exit code Description
0
No errors were found.

1
Errors were found and fixed.

2
Disk cleanup, such as garbage collection, was performed, or cleanup was not performed because /f was not specified.

3
Could not check the disk, errors could not be fixed, or errors were not fixed because /f was not specified.


• The chkdsk command, with different parameters, is available from the Recovery Console.

Examples
If you want to check the disk in drive D and have Windows fix errors, type:

chkdsk d: /f

If it encounters errors, chkdsk pauses and displays messages. Chkdsk finishes by displaying a report that lists the status of the disk. You cannot open any files on the specified drive until chkdsk finishes.

To check all of files on a FAT disk in the current directory for noncontiguous blocks, type:

chkdsk *.*

Chkdsk displays a status report, and then lists the files matching the file specification that have noncontiguous blocks.

Formatting legend
Format Meaning
Italic
Information that the user must supply

Bold
Elements that the user must type exactly as shown

Ellipsis (...)
Parameter that can be repeated several times in a command line

Between brackets ([])
Optional items

Between braces ({}); choices separated by pipe (|). Example: {even|odd}
Set of choices from which the user must choose only one

Courier font
Code or program output

Fsutil is a command-line utility that you can use to perform many FAT and NTFS file system related tasks, such as managing reparse points, managing sparse files, dismounting a volume, or extending a volume. Because fsutil is quite powerful, it should only be used by advanced users who have a thorough knowledge of Windows XP. In addition, you must be logged on as an administrator or a member of the Administrators group in order to use fsutil.

The following table lists the fsutil subcommands.

Command Description
behavior
Queries, changes, enables, or disables the settings for generating 8.3 character-length file names, accepting extended characters in 8.3 character-length file names on NTFS volumes, updating the last access timestamp on NTFS volumes, how often quota events are written to the system log, and the amount of disk space reserved of the MFT Zone.

dirty
Queries whether volume's dirty bit is set. Sets a volume's dirty bit. When a volume's dirty bit is set, autochk automatically checks the volume for errors the next time the computer is restarted.

file
Typically used by support professionals. Finds a file by its security identifier, queries allocated ranges for a file, sets a file's short name, sets a file's valid data length, or sets zero data for a file.

fsinfo
Typically used by support professionals. Lists all drives, queries the drive type, queries volume information, queries NTFS-specific volume information, or queries file system statistics.

hardlink
Creates a hard link. A hard link is a directory entry for a file. Every file can be considered to have at least one hard link. On NTFS volumes, each file can have multiple hard links, and thus a single file can appear in many directories (or even in the same directory with different names). Because all of the links reference the same file, programs can open any of the links and modify the file. A file is deleted from the file system only after all links to it have been deleted. After you create a hard link, programs can use it like any other file name.

objectid
Typically used by support professionals. Manages object identifiers, which are used by Windows XP to track objects such as files and directories.

quota
Manages disk quotas on NTFS volumes in order to provide more precise control of network-based storage. Disk quotas are implemented on a per-volume basis and enable both hard- and soft-storage limits to be implemented on a per-user basis.

reparsepoint
Typically used by support professionals. Queries or deletes reparse points, which are NTFS file system objects that have a definable attribute containing user-controlled data, and are used to extend functionality in the input/output (I/O) subsystem. Reparse points are used for directory junction points and volume mount points. They are also used by file system filter drivers to mark certain files as special to that driver.

sparse
Manages sparse files A sparse file is a file with one or more regions of unallocated data in it. A program will see these unallocated regions as containing bytes with the value zero, but there is actually no disk space used to represent these zeros. In other words, all meaningful or nonzero data is allocated, whereas all non-meaningful data (large strings of data composed of zeros) is not allocated. When a sparse file is read, allocated data is returned as stored and unallocated data is returned, by default, as zeros, in accordance with the C2 security requirement specification. Sparse file support allows data to be deallocated from anywhere in the file.

usn
Typically used by support professionals. Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume.

volume
Manages a volume. Dismounts a volume or queries to see how much free space is available on a disk.

Note
• To view help for the available subcommands at the command prompt, type fsutil, type the subcommand, and then type help (that is, fsutil subcommand help).

Fsutil: behavior

Queries the current settings for generating 8.3 character-length file names, allowing extended characters in 8.3 character-length file names on NTFS volumes, updating the last access timestamp on NTFS volumes, how often quota events are written to the system log, and the size of the master file table (MFT) Zone. Enables or disables the use of 8.3 character-length file names, allowing extended characters in 8.3 character-length file names on NTFS volumes, and updating the last access timestamp on NTFS volumes. Enables you to change how often quota events are written to the system log and to change the amount of disk space reserved for the MFT Zone.

Syntax
fsutil behavior query {disable8dot3|allowextchar|disablelastaccess|quotanotify|mftzone}

fsutil behavior set [{disable8dot3 {1|0}|allowextchar {1|0}|disablelastaccess {1|0}|quotanotify frequency|mftzone value}]

Parameters
query : Queries the file system behavior parameters.

set : Changes the file system behavior parameters.

disable8dot3 {1|0} : Disables creation of 8.3 character-length file names on FAT- and NTFS-formatted volumes.

allowextchar {1|0} : Determines whether characters from the extended character set, including diacritic characters, can be used in 8.3 short file names on NTFS volumes.

disablelastaccess {1|0} : Determines whether NTFS updates the last access timestamp on each directory when it lists the directories on an NTFS volume.

quotanotify frequency : Configures how frequently NTFS quota violations are reported in the system log. Enter a frequency 0 through 4294967295 seconds for how often quota violations are written to the system log. Default is 1 hour (3600 seconds).

mftzone value : The master file table (MFT) Zone is a reserved area that enables the MFT to expand as needed, in order to prevent MFT fragmentation. Set the value from 1 (default) to 4 (maximum). The value is in 8ths of the disk.

Remarks
• The behavior subcommand writes changes to the registry, so you must restart the computer for changes to take effect.

• Using disable8dot3 {1|0}

When disable8dot3 is set to 0, every time you create a file with a long file name, NTFS creates a second file entry that has an 8.3 character-length file name. When NTFS creates files in a folder, it must look up the 8.3 character-length file names associated with the long file names.

This parameter updates the HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisable8dot3NameCreation registry key.

• Using allowextchar {1|0}

This parameter updates the HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsAllowExtendedCharacterIn8dot3Name registry key.

• Using disablelastaccess {1|0}

The disablelastaccess parameter is designed to reduce the logging impact of updating the last access timestamp on folders and directories. Disabling the Last Access Time improves the speed of folder and file access.

Each file and folder on an NTFS volume contains an attribute called Last Access Time. This attribute defines when the file or folder was last accessed, such as when a user lists folders, adds files to a folder, reads a file, or makes changes to a file. The most up-to-date Last Access Time is stored in memory and is eventually written to the disk in two different locations. One is within the file's attribute, which is part of its MFT record. The second is in the index of the directory that contains the file.

The Last Access Time on disk is not always current. This lag occurs because NTFS delays writing the Last Access Time to disk when users or programs perform read-only operations on a file or folder, such as listing the folder's contents or reading (but not changing) a file in the folder. If the Last Access Time is kept current on disk for read operations, all read operations become write operations, which impacts NTFS performance.

Note that file-based queries of Last Access Time are accurate even if all on-disk values are not current. NTFS returns the correct value on queries because the accurate value is stored in memory.

NTFS typically updates a file's attribute on disk if the current Last Access Time in memory differs by more than an hour from the Last Access Time stored on disk, or when all in-memory references to that file are gone, whichever is more recent. For example, if a file's current Last Access Time is 1:00 P.M., and you read the file at 1:30 P.M., NTFS does not update the Last Access Time. If you read the file again at 2:00 P.M., NTFS updates the Last Access Time in the file's attribute to reflect 2:00 P.M. because the file's attribute shows 1:00 P.M. and the in-memory Last Access Time shows 2:00 P.M.

NTFS updates the index of the directory that contains the file when NTFS updates the file's Last Access Time and detects that the Last Access Time for the file differs by more than an hour from the Last Access Time stored in the directory's index. This update typically occurs after a program closes the handle used to access a file within the directory. If the user holds the handle open for an extended time, a lag occurs before the change appears in the index entry of the directory.

Note that one hour is the maximum time that NTFS defers updating the Last Access Time on disk. If NTFS updates other file attributes such as Last Modify Time, and a Last Access Time update is pending, NTFS updates the Last Access Time along with the other updates without additional performance impact.

Note that using the disablelastaccess parameter can affect programs such as backup and Remote Storage that rely on this feature.

This parameter updates the HKLM\SYSTEM\CurrentControlSet\Control\FileSystem\NtfsDisableLastAccessUpdate registry key.

• Using mftzone value

The value is an approximation of the initial size of the MFT plus the MFT Zone on a new volume and is set at mount time for each file system. As space on the volume is used, NTFS adjusts the space reserved for future MFT growth. If the MFT Zone is already large, the full MFT Zone size is not reserved again. Since the MFT Zone is based on the contiguous range past the end of the MFT, it shrinks as the space is used.

The file system does not redetermine the MFT Zone location until the current MFT Zone is completely used. This never occurs on a typical system.

Fsutil: dirty

Queries to see whether a volume's dirty bit is set. Sets a volume's dirty bit. When a volume's dirty bit is set, autochk automatically checks the volume for errors the next time the computer is restarted.

Syntax
fsutil dirty {query|set} PathName

Parameters
query : Queries the dirty bit.

set : Sets a volume's dirty bit.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.

Remarks
• If a volume's dirty bit is set, this indicates that the file system may be in an inconsistent state. The dirty bit can be set because the volume is online and has outstanding changes, because changes were made to the volume and the computer shutdown before the changes were committed to disk, or because corruption was detected on the volume. If the dirty bit is set when the computer restarts, chkdsk runs to verify the consistency of the volume.

Every time Windows XP starts, Autochk.exe is called by the Kernel to scan all volumes to check if the volume dirty bit is set. If the dirty bit is set, autochk performs an immediate chkdsk /f on that volume. Chkdsk /f verifies file system integrity and attempts to fix any problems with the volume.

Examples
To query the dirty bit on drive C, type:
fsutil dirty query C:

Sample output:

Volume C: is dirty
or

Volume C: is not dirty
To set the dirty bit on drive C, type:

fsutil dirty set C:

Fsutil: file

Typically used by support professionals. Finds a file by security identifier, queries allocated ranges for a file, sets a file's short name, sets a file's valid data length, sets zero data for a file, or creates a new file.

Syntax
fsutil file [createnew] PathName length

fsutil file [findbysid] User PathName

fsutil file [queryallocranges] offset=offset length=length PathName

fsutil file [setshortname] PathName shortname

fsutil file [setvaliddata] PathName datalength

fsutil file [setzerodata] offset=offset length=length PathName

Parameters
createnew : Creates a file of the specified name and size, whose content consists of zeroes.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.

length : Specifies the file's valid data length.

findbysid : Finds files on NTFS volumes that belong to a specified user. The user is identified by their SID (security identifier).

User : Specifies the user's user name or logon name.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.

queryallocranges : Queries the allocated ranges for a file on an NTFS volume. Useful for determining whether a file has sparse regions.

offset=offset : Specifies the start of the range to set to zeroes.

length=length : Specifies the length of the range, in bytes.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.

setshortname : Sets the short name (8.3 character-length file name) for a file on an NTFS volume.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.

shortname : Specifies the file's shortname.

setvaliddata : Set the valid data length for a file on an NTFS volume.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.

datalength : Specifies the length of the file in bytes.

setzerodata : Sets a range (specified by offset and length) of the file to zeroes, which empties the file. If the file is a sparse file, the underlying allocation units are decommitted.

offset=offset : Specifies the file offset, the start of the range to set to zeroes.

length=length : Specifies the length of the range to set to zero.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.

Remarks
• Using setvaliddata

In NTFS, there are two important concepts of file length: the End of File (EOF) marker and the Valid Data Length (VDL). The EOF indicates the actual length of the file. The VDL identifies the length of valid data on disk. Any reads between VDL and EOF automatically return 0 in order to preserve the C2 object reuse requirement.

The setvaliddata parameter is only available for administrators because it requires the Manage Volume privilege. This feature is only required for advanced multimedia and system area network (SAN) scenarios.

Examples
To find user scottb on drive C by his SID, type:

fsutil file findbysid scottb C:\users

To query the allocated ranges for a file on an NTFS volume, type:

fsutil file queryallocranges offset=1024 length=64 C:\Temp\sample.txt

To set the short name for the file longfilename.txt on drive C to longfile.txt, type:

fsutil file setshortname C:\longfilename.txt longfile.txt

To set the valid data length for a file on an NTFS volume, type:

fsutil file setvaliddata C:\testfile.txt 4096

To set a range of a file on an NTFS volume to zeros and thus empty it, type:

fsutil file setzerodata offset=100 length=150 C:\Temp\sample.txt

Fsutil: fsinfo

Typically used by support professionals. Lists all drives, queries the drive type, queries volume information, queries NTFS-specific volume information, or queries file system statistics.
Syntax
fsutil fsinfo [drives]

fsutil fsinfo [drivetype] PathName

fsutil fsinfo [ntfsinfo] RootPathname

fsutil fsinfo [statistics] VolumePathname

fsutil fsinfo [volumeinfo] RootPathname

Parameters
drives : Lists all drives in the computer.

drivetype : Queries a drive and lists its type, for example CD-ROM drive.

ntfsinfo : Lists NTFS specific volume information for the specified volume, such as the number of sectors, total clusters, free clusters, and the start and end of the MFT Zone.

statistics : Lists file system statistics for the specified volume, such as metadata, log file, and MFT reads and writes.

volumeinfo : Lists information for the specified volume, such as the file system, and whether the volume supports case-sensitive file names, unicode in file names, or disk quotas.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.

RootPathname : Specifies the drive letter (followed by a colon) of the root drive.

VolumePathname : Specifies the drive letter (followed by a colon), mount point, or volume name.

Examples
To query the drive type of drive C, type:

fsutil fsinfo drivetype C:

Possible results:

• Unknown Drive

• No such Root Directory

• Removable Drive, for example floppy

• Fixed Drive

• Remote/Network Drive

• CD-ROM Drive

• Ram Disk

To query the volume information for volume E, type:

fsinfo volumeinfo E:\

Sample output:

Volume Name :
Volume Serial Number : 0xd0b634d9
Max Component Length : 255
File System Name : NTFS
Supports Case-sensitive filenames
Preserves Case of filenames
Supports Unicode in filenames
Preserves & Enforces ACL's
Supports file-based Compression
Supports Disk Quotas
Supports Sparse files
Supports Reparse Points
Supports Object Identifiers
Supports Encrypted File System
Supports Named Streams
To query drive F for NTFS-specific volume information, type:

fsutil fsinfo ntfsinfo F:\

Sample output:

NTFS Volume Serial Number : 0xe660d46a60d442cb
Number Sectors : 0x00000000010ea04f
Total Clusters : 0x000000000021d409
Free Clusters : 0x00000000000f222a
Total Reserved : 0x0000000000003550
Bytes Per Sector : 512
Bytes Per Cluster : 4096
Bytes Per FileRecord Segment : 1024
Clusters Per FileRecord Segment : 0
Mft Valid Data Length : 0x0000000003eab000
Mft Start Lcn : 0x0000000000000004
Mft2 Start Lcn : 0x000000000010ea04
Mft Zone Start : 0x0000000000003ea0
Mft Zone End : 0x0000000000004700
To query the file system statistics for drive E, type:

fsinfo statistics E:

Sample output:

File System Type : NTFS
Version : 1
UserFileReads : 75021
UserFileReadBytes : 1305244512
UserDiskReads : 71213
UserFileWrites : 8037
UserFileWriteBytes : 207685440
UserDiskWrites : 5278
MetaDataReads : 14377
MetaDataReadBytes : 58888192
MetaDataDiskReads : 14773
MetaDataWrites : 18705
MetaDataWriteBytes : 138108928
MetaDataDiskWrites : 21464
MftReads : 9394
MftReadBytes : 38477824
MftWrites : 17061
MftWriteBytes : 115359744
Mft2Writes : 0
Mft2WriteBytes : 0
RootIndexReads : 0
RootIndexReadBytes : 0
RootIndexWrites : 0
RootIndexWriteBytes : 0
BitmapReads : 136
BitmapReadBytes : 557056
BitmapWrites : 1180
BitmapWriteBytes : 11161600
MftBitmapReads : 4
MftBitmapReadBytes : 16384
MftBitmapWrites : 118
MftBitmapWriteBytes : 491520
UserIndexReads : 2938
UserIndexReadBytes : 12034048
UserIndexWrites : 2738
UserIndexWriteBytes : 20615168
LogFileReads : 4
LogFileReadBytes : 16384
LogFileWrites : 8407
LogFileWriteBytes : 180936704

Fsutil: hardlink

A hard link is a directory entry for a file. Every file can be considered to have at least one hard link. On NTFS volumes, each file can have multiple hard links, and thus a single file can appear in many directories (or even in the same directory with different names). Because all of the links reference the same file, programs can open any of the links and modify the file. A file is deleted from the file system only after all links to it have been deleted. After you create a hard link, programs can use it like any other file name.

Syntax
fsutil hardlink create NewFilename ExistingFilename

Parameters
create : Establishes an NTFS hard link between an existing file and a new file. An NTFS hard link is similar to a POSIX hard link.

NewFilename : Specifies the file to which you want to create a hardlink.

ExistingFilename : Specifies the file from which you want to create a hardlink.

Fsutil: objectid

Typically used by support professionals. Manages object identifiers (also known as OIDs), which are internal objects used by the Distributed Link Tracking (DLT) Client service and File Replication Service (FRS) to track other objects such as files, directories, and links. Object identifiers are invisible to most programs and should never be modified.

Warning

• Do not delete, set, or otherwise modify an object identifier. Deleting or setting an object identifier can result in the loss of data from portions of a file, up to and including entire volumes of data. In addition you might cause adverse behavior in the Distributed Link Tracking (DLT) Client service and File Replication Service (FRS).

Syntax
fsutil objectid [create] PathName

fsutil objectid [delete] PathName

fsutil objectid [query] PathName

fsutil objectid [set] ObjectID BirthVolumeID BirthObjectID DomainID PathName

Parameters
create : Creates object identifier if the file does not already have one, otherwise equivalent to query.

delete : Deletes an object identifier.

query : Queries an object identifier.

set : Sets an object identifier.

ObjectID : A file-specific 16 byte hexadecimal identifier that is guaranteed to be unique within a volume. It is used by the Distributed Link Tracking (DLT) Client service and the File Replication Service (FRS) to identify files. Any file that has an ObjectID, also has a BirthVolumeID, a BirthObjectID, and a DomainID. When you move a file, the ObjectID may change, but BirthVolumeID and BirthObjectID remain the same, which enables Windows XP to always find a file, no matter where it has been moved.

BirthVolumeID : A 16 byte hexadecimal identifier that indicates the volume on which the file was located when it first obtained an ObjectID. This value is used by the DLT Client service.

BirthObjectID : A 16 byte hexadecimal identifier that indicates the file's original ObjectID (note that the ObjectID may change when a file is moved). This value is used by the DLT Client service.

DomainID : 16 byte hexadecimal domain identifier. This value is not currently used and must be set to all zeros.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.

Examples
To create an object identifier, type:

fsutil objectid create C:\Temp\sample.txt

To delete an object identifier, type:

fsutil objectid delete C:\Temp\sample.txt

To query an object identifier, type:

fsutil objectid get C:\Temp\sample.txt

To set an object identifier, type:

fsutil objectid set 40dff02fc9b4d4118f120090273fa9fc f86ad6865fe8d21183910008c709d19e 40dff02fc9b4d4118f120090273fa9fc 00000000000000000000000000000000 C:\Temp\sample.txt

Fsutil: quota

Manages disk quotas on NTFS volumes in order to provide more precise control of network-based storage.

Syntax
fsutil quota [disable] volumename

fsutil quota [enforce] volumename

fsutil quota [modify] volumename threshold limit [UserName]

fsutil quota [query] volumename

fsutil quota [track] volumename

fsutil quota [violations]

Parameters
disable : Disables quota tracking and enforcement on the specified volume.

enforce : Enforces quota usage on the specified volume.

modify : Modifies an existing disk quota or creates a new quota.

query : Lists existing disk quotas.

track : Tracks disk usage on the specified volume.

violations : Searches the system and application logs and displays a message to indicate that quota violations have been detected, or that a user has reached their quota threshold or quota limit.

volumename : Specifies the drive letter for the volume (followed by a colon).

threshold : The limit at which warnings are issued.

limit : The maximum allowed disk usage.

UserName : Specifies the domain or user name.

Remarks
• Disk quotas are implemented on a per-volume basis and enable both hard and soft storage limits to be implemented on a per-user basis.

• You can use write scripts that use fsutil quota to set the quota limits every time you add a new user or to automatically track quota limits, compile them into a report, and automatically send them to the system administrator in e-mail.

Fsutil: reparsepoint

Typically used by support professionals. Queries or deletes reparse points, which are NTFS file system objects that have a definable attribute containing user-controlled data, and are used to extend functionality in the input/output (I/O) subsystem. Reparse points are used for directory junction points and volume mount points. They are also used by file system filter drivers to mark certain files as special to that driver.

Syntax
fsutil reparsepoint [query] PathName

fsutil reparsepoint [delete] PathName

Parameters
query : Retrieves the reparse point data associated with the file or directory identified by the specified handle.

delete : Deletes a reparse point from the file or directory identified by the specified handle, but does not delete the file or directory.

Warning

• The fsutil reparsepoint delete only deletes the file, not its associated reparse points. This might cause file open failures in processes or services that attempt to open the file.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.

Remarks
• On an NTFS volume, a file or directory can contain a reparse point, which is a collection of user-defined data. The format of this data is understood by the program that stores the data, and a file system filter, which you install to interpret the data and process the file. When an program sets a reparse point, it stores this data, plus a reparse tag, which uniquely identifies the data it is storing. When the file system opens a file with a reparse point, it attempts to find the file system filter associated with the data format identified by the reparse tag. If such a file system filter is found, the filter processes the file as directed by the reparse data. If no such file system filter is found, the file open operation fails.

For example, reparse points are used to implement NTFS links and Remote Storage. Remote Storage uses an administrator-defined set of rules to move infrequently used files to long term storage, such as tape or CD-ROM. It uses reparse points to store information about the file in the file system. This information is stored in a stub file that contains a reparse point whose data points to the device where the actual file is now located. The file system filter can use this information to retrieve the file.

Examples
To retrieve a reparse point data associated with C:\Server, type:

fsutil reparsepoint query C:\Server

To delete a reparse point from a specified file or directory, use the following format:

fsutil reparsepoint delete C:\Server

Fsutil: sparse

Manages sparse files A sparse file is a file with one or more regions of unallocated data in it. A program will see these unallocated regions as containing bytes with the value zero, but there is actually no disk space used to represent these zeros. In other words, all meaningful or nonzero data is allocated, whereas all non-meaningful data (large strings of data composed of zeros) is not allocated. When a sparse file is read, allocated data is returned as stored and unallocated data is returned, by default, as zeros, in accordance with the C2 security requirement specification. Sparse file support allows data to be de-allocated from anywhere in the file.

Syntax
fsutil sparse [queryflag] PathName

fsutil sparse [queryrange] PathName

fsutil sparse [setflag] PathName

fsutil sparse [setrange] PathName BeginningOffset length

Parameters
queryflag : Queries sparse.

queryrange : Scans a file looking for ranges that may contain nonzero data.

setflag : Marks the indicated file as sparse.

setrange : Fills a specified range of a file with zeroes.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.

BeginningOffset : Offset within the file to mark as sparse.

length : Length of the region in the file to be marked as sparse, in bytes.

Remarks
• In a sparse file, large ranges of zeroes may not require disk allocation. Space for nonzero data will be allocated as needed as the file is written.

• Only compressed or sparse files can have zeroed ranges known to the operating system.

• If the file is sparse or compressed, NTFS may de-allocate disk space within the file. This sets the range of bytes to zeroes without extending the file size.

Examples
To mark a file as sparse, type:

fsutil sparse setflag C:\Temp\sample.txt

Fsutil: usn

Typically used by support professionals. Manages the update sequence number (USN) change journal, which provides a persistent log of all changes made to files on the volume. As files, directories, and other NTFS objects are added, deleted, and modified, NTFS enters records into the USN change journal, one for each volume on the computer. Each record indicates the type of change and the object changed. New records are appended to the end of the stream.

Programs can consult the USN change journal to determine all the modifications made to a set of files. The USN change journal is much more efficient than checking time stamps or registering for file notifications. The USN change journal is enabled and used by the Indexing Service, File Replication Service (FRS), Remote Installation Service (RIS), and Remote Storage.

Syntax
fsutil usn [createjournal] MaximumSize AllocationDelta VolumePathname

fsutil usn [deletejournal] flags VolumePathname

fsutil usn [enumdata] FileRef LowUsn HighUsn PathName

fsutil usn [queryjournal] VolumePathname

fsutil usn [readdata] PathName

Parameters
createjournal : Creates a USN change journal.

m=MaximumSize : Specifies the maximum size, in bytes, that NTFS allocates for the change journal.

a=AllocationDelta : Specifies the size, in bytes, of memory allocation that is added to the end and removed from the beginning of the change journal.

VolumePathname : Specifies the drive letter (followed by a colon), mount point, or volume name.

deletejournal : Deletes or disables an active USN change journal.

flags : /D: Disables an active USN change journal, and returns I/O control while the change journal is being disabled.

VolumePathname : Specifies the drive letter (followed by a colon), mount point, or volume name.

enumdata : Enumerates and lists the change journal entries between two specified boundaries.

FileRef : Ordinal position within the files on the volume at which the enumeration is to begin.

LowUsn : Lower boundary of the range of USN values used to filter which records are returned. Only records whose last change journal USN is between or equal to the LowUsn and HighUsn member values are returned.

HighUsn : Upper boundary of the range of USN values used to filter which files are returned.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.

queryjournal : Queries a volume's USN data to gather information about the current change journal, its records, and its capacity.

volume pathname : Specifies the drive letter (followed by a colon), mount point, or volume name.

readdata : Read the USN data for a file.

PathName : Specifies the drive letter (followed by a colon), mount point, or volume name.


Remarks
• Using createjournal

If a change journal already exists on a volume, the createjournal parameter updates the change journal's MaximumSize and AllocationDelta parameters. This allows you to expand the number of records that an active journal maintains without having to disable it. If you specify zero for MaximumSize and AllocationDelta, the system chooses a default value based on the volume size.

• Using m=MaximumSize

The change journal can grow larger than this target value, but the change journal is truncated at the next NTFS checkpoint to less than this value. NTFS examines the change journal and trims it when its size exceeds the value of MaximumSize plus the value of AllocationDelta. At NTFS checkpoints, the operating system writes records to the NTFS log file that allow NTFS to determine what processing is required to recover from a failure.

• Using a=AllocationDelta

The change journal can grow to more than the sum of the values of MaximumSize and AllocationDelta before being trimmed.

• Using deletejournal

Deleting or disabling an active journal is very time consuming, because the system must access all the records in the master file table (MFT) and set the last USN attribute to zero. This process can take several minutes, and can continue after the system restarts, if necessary. During this process, the change journal is not considered active, nor is it disabled. While the system is disabling the journal, it cannot be accessed, and all journal operations return errors. You should use extreme care when disabling an active journal, because it adversely affects other applications using the journal.

Examples
To create a USN change journal on drive C, type:

fsutil usn createjournal m=1000 a=100 C:

To delete an active USN change journal on drive C, type:

fsutil usn deletejournal /D C:

To enumerate and list the change journal entries between two specified boundaries on drive C, type:

fsutil usn enumdata 1 0 1 C:

To query USN data for a volume on drive C, type:

fsutil usn queryjournal C:

To read the USN data for a file in the temp folder on drive C, type:

fsutil usn readdata C:\Temp\sample.txt

Fsutil: volume

Manages a volume. Dismounts a volume or queries to see how much free space is available on a disk.

Syntax
fsutil volume [diskfree] drivename

fsutil volume [dismount] VolumePathname

Parameters
diskfree : Queries the free space of a volume.

drivename : Specifies the drive letter (followed by a colon).

dismount : Dismounts a volume.

VolumePathname : Specifies the drive letter (followed by a colon), mount point, or volume name.

Examples
• To dismount a volume on drive C, type:

fsutil volume dismount C:

• To query the free space of a volume on drive C, type:

fsutil volume diskfree C:

[Retired Tech]

Ordinarily, check disk would tell you if there is anything needed

[Retired Tech]

You will be querying C: Y was in another post and was used as an example

[Retired Tech]

Run msconfig to clear the start up for programmes you rarely use

If you clear all of them, with the exception of the firewall, anti virus and any anti spyware programmes, the effect should be the PC will start quicker, the programmes will still run but take longer, (slightly) to start

[Retired Tech]

In XP it is an indication of an goof, it should have NTFS