60. The $Bitmap

• $Bitmap file describes the allocation status of each cluster in the file system

• Entry #6 in $MFT

• $DATA attribute in the file contains a string of bytes where each bit indicates whether the corresponding cluster is

  • available (0) or

  • allocated (1)

• The size of $DATA is always a multiple of 8. Since each byte contains 8 bits, this is equivalent to saying that NTFS bitmap describes the disk in chunks of 64 clusters. However, in most cases the real size of a disk is not a multiple of 64 NTFS clusters. To avoid a mapping mismatch, there is usually a section at the end of the $Bitmap file that corresponds to the space beyond the end of the drive, and all bits of that section are always marked as 1.

• The $DATA attribute is always non-resident.

• $BITMAP attribute is used to describe the allocation status of index records and MFT entries.

• The Defrag utility would want each byte in the bitmap to be either 0x00 or 0xFF. Anything else is "a hole" requiring a defragmentation.