| <<< The $LOGGED_UTILITY_STREAM Attribute | Index | $LogFile >>> |
The purpose of this file is to backup the starting point of the $MFT.
$MFTMirr is usually located half way through the volume.
It only contains the vital records needed to get the $MFT readable again.
$MFTMirr is always either 4 records, or one cluster.
Generally, the record size in the MFT is 1024 bytes and the cluster size of the drive is 4048 bytes.
In 90% of cases the $MFTMirr will contain 4 MFT records.
In case of the cluster size being smaller than 4K, $MFTMirr occupies as many clusters as necessary to accommodate first 4 records of the MFT
If the cluster size is bigger than 4K, then there is more room, and it may contain more than 4 records.
(Since having clusters larger than 4K breaks some of the other features, such as compression, this rarely occurs.)
If MFT starting sector fails,
the whole $MFT would become unreadable
the pointer to the $MFTMirr would also be lost, so it's hard to determine what really does the $MFTMirr gain.
| <<< The $LOGGED_UTILITY_STREAM Attribute | Index | $LogFile >>> |