FAT & NTFS File Systems

in Windows XP
Version 1.2 — Last Updated September 1, 2002
Hold mouse here for list of most recent changes.
Receive notice whenever this page is updated.

by Alex Nichol, MS-MVP

© 2002 by Author, All Rights Reserved

1. INTRODUCTION

Files in Windows XP can be organised on the hard disk in two different ways.
• The old FAT (File Allocation Table) file system was developed originally (when the
original IBM PCs came out) for MS-DOS on small machines and floppy disks. There are
variants — FAT12 is used on all floppy disks, for example — but hard disk partitions in
Windows XP can be assumed to use the FAT32 version, or 32-bit File Allocation Table.
• Later, a more advanced file system was developed for hard disks in Windows NT, called
NTFS (the “NT File System”). This has matured, through several versions, into the latest
one that exists alongside FAT in Windows XP.
The file system used goes with an individual partition of the disk. You can mix the two types on
the same physical drive. The Windows XP operating system is the same, whichever file system is
used for its partition, so it is a mistake (and source of confusion) to speak of “a FAT disk reading an
NTFS partition.” It is the operating system, not the disk, that does the reading.
Actual files are unaffected by which file system they are on; that is merely a matter of a method of
storage. An analogy would be letters stored in an office. They might be in box-files on shelves
(FAT) or in suspended folders in file cabinets (NTFS); but the letters themselves would be
unaffected by the choice of which way to store them, and could be moved from one storage place to
the other. Similarly, files can be moved between folders on an NTFS partition and folders on a FAT
partition, or across a network to another machine that might not even be running Windows.
EXAMPLE: Consider the downloading to your computer of a file through a link on a web page.
You click on the link, and the file is copied across the Internet and stored on your hard drive. If you
download the file from this present site, the file is stored on a computer running Unix, which uses
neither FAT nor NTFS. The file itself is not affected when it is copied from a Windows computer to
the Unix-based server, or copied from that server to your Windows-based computer.
However, if a machine has two different operating systems on it, dual booted, they may not both be
able to read both types of partition. DOS (including an Emergency Startup boot floppy), Windows
95/98, and Windows ME cannot handle NTFS (without third party assistance). Early versions of
Windows NT cannot handle FAT32, only FAT16. So, if you have such a mixed environment, any
communal files must be held on a partition of a type that both operating systems can understand —
meaning, usually, a FAT32 partition. (See the article Planning Your Partitions on this site, under the
section “Multiple Operating Systems,” for a table of which file system each recent version of
Windows can use and understand.)

2. WHICH SYSTEM TO USE?

There are three considerations that affect which file system should be chosen for any partition:
a. Do you want to use the additional capabilities that only NTFS supports?
 NTFS can provide control of file access by different users, for privacy and security. The
Home Edition of Windows XP only supports this to the limited extent of keeping each user’s
documents private to him or herself. Full file-access control is provided in Windows XP
Professional, as is encryption of individual files and folders. If you use encryption it is
essential to back up the encryption certificates used — otherwise, if the partition containing
your "Documents and Settings" has to be reformatted, the files will be irretrievably lost.

b. Considerations of Stability and Resilience

NTFS has stronger means of recovering from troubles than does FAT. All changes to files
are “journalized,” which allows the system to roll back the state of a file after a crash of the
program using it or a crash of the system. Also, the structure of the file system is less likely
to suffer damage in a crash, and is therefore more easily reinstated by CheckDisk
(CHKDSK.EXE). But in practical terms, the stability of FAT is adequate for many users,
and it has the benefit that a FAT partition is accessible for repair after booting from a DOS
mode startup floppy, such as one from Windows 98. If an NTFS partition is so damaged that
it is not possible to boot Windows, then repair can be very difficult.

c. Considerations of economy and performance

In a virtual memory system like Windows XP, the ideal size of disk clusters matches the
internal “page size” used by the Intel processors — 4 kilobytes. An NTFS partition of almost
any size you are likely to meet will use this, but it is only used in FAT32 up to an 8 GB
partition. Above that, the cluster size for FAT increases, and the wastefulness of the “cluster
overhang” grows. (For a table of the varying default cluster sizes used by FAT16, FAT32,
and Win XP’s version of NTFS, for partitions of varying sizes, click here.)

On the other hand NTFS takes much more space for holding descriptive information on
every file in that file’s own block in the Master File Table (MFT). This can use quite a large
proportion of the disk, though this is offset by a possibility that the data of a very small file
may be stored entirely in its MFT block. Because NTFS holds significant amounts of these
structures in memory, it places larger demands on memory than does FAT.

Searching directories in NTFS uses a more efficient stucture for its access to files, so
searching a FAT partition is a slower process in big directories. Scanning the FAT for the
pieces of a fragmented file is also slower. On the other hand, NTFS carries the overhead of
maintaining the “journalized” recovery.
Also, of course, in a dual boot system, there may be the overriding need to use FAT on a partition so
that it can also be read from, say, Windows 98.

3. ON BALANCE

Leaving matters of access control and dual use aside, as partition sizes grow, the case for NTFS gets
stronger. Microsoft definitely recommends NTFS for partitions larger than 32 GB — to the extent
that Windows XP will not format a FAT partition above that size. However, with smaller sizes,
FAT is likely to be more efficient — certainly below 4 GB, and probably below 8 GB. I suggest that
NTFS should be used for partitions of 16 GB or above, where the FAT 32 cluster size goes up to 16
KB, the intermediate region (that is, partitions between 8 and 16 GB in size) being largely a matter
of taste.
4. CAN I CONVERT ONE SYSTEM TO THE OTHER?

Ideally, a disk is initially formatted in the file system which is to be used permanently — NTFS, for
example, can then put the Master File Table in its optimal location in the middle of the partition.
However, on an upgrade of an existing system, the file system is left as it is. For example, an
upgraded Windows 98 system will be on FAT32. Also, some computer makers ship new computers
with all partitions formatted as FAT32. These can be converted to NTFS if that seems more suitable
to your needs. If you use the method described here, the result will be nearly as satisfactory as if a
fresh format to NTFS had been done.
But this conversion is a one-way process. Windows XP provides a native tool for converting FAT to
NTFS, but no tool for converting NTFS to FAT. It may be possible to convert NTFS to FAT using
Partition Magic 7.01, but the result is uncertain. It you attempt it, it is essential that you first decrypt
all encrypted files, or they will be forever inaccessible. (For this reason, Partition Magic will stop if
it finds one.) If it is a new machine, too, be sure that your warranty will not be compromised by
doing a file system conversion.
A further aspect that needs caution is that the conversion may result in the NTFS permissions on the
partition and its folders being not the simple general access that might be expected. It is certainly
important that the conversion be done when logged in as an Administrator.

5. BACKUP & DISK IMAGING

Will a backup or image made from NTFS remain NTFS if I restore to a newly formatted partition?
This depends on the approach of the particular backup program you use. It may make an exact
image of the partition, including the file system’s structures, in which case the restored partition
will be exactly as the original. (Indeed, any format of the drive before restoring the drive image not
only is unnecessary, but all that it accomplishes will be overwritten when you restore the image.)
Or, the software may work on a file-by-file basis, in which case the files themselves will be restored
— to whatever file system has been used in formatting the partition to which you restore them. But,
again, note that a file-by-file restore from a backup of NTFS to a FAT partition will result in
encrypted files being unreadable, because there is no way to decrypt them on FAT!

http://aumha.org/win5/a/xpvm.php

Virtual Memory in Windows XP

Version 1.6 — Last Updated February 21, 2006
Hold mouse here for list of most recent changes.

by Alex Nichol
(MS-MVP - Windows Storage Management/File Systems)
© 2002-2005 by Author, All Rights Reserved
Introduction

This page attempts to be a stand-alone description for general users of the way Virtual Memory
operates in Windows XP. Other pages on this site are written mainly for Windows 98/ME (see
Windows 98 & Win ME Memory Management) and, while a lot is in common, there are significant
differences in Windows XP.

What is Virtual Memory?

A program instruction on an Intel 386 or later CPU can address up to 4GB of memory, using its full
32 bits. This is normally far more than the RAM of the machine. (The 32nd exponent of 2 is exactly
4,294,967,296, or 4 GB. 32 binary digits allow the representation of 4,294,967,296 numbers —
counting 0.) So the hardware provides for programs to operate in terms of as much as they wish of
this full 4GB space as Virtual Memory, those parts of the program and data which are currently
active being loaded into Physical Random Access Memory (RAM). The processor itself then
translates (‘maps’) the virtual addresses from an instruction into the correct physical equivalents,
doing this on the fly as the instruction is executed. The processor manages the mapping in terms of
pages of 4 Kilobytes each - a size that has implications for managing virtual memory by the system.

What are Page Faults?

Only those parts of the program and data that are currently in active use need to be held in physical
RAM. Other parts are then held in a swap file (as it’s called in Windows 95/98/ME: Win386.swp)
or page file (in Windows NT versions including Windows 2000 and XP: pagefile.sys). When a
program tries to access some address that is not currently in physical RAM, it generates an
interrupt, called a Page Fault. This asks the system to retrieve the 4 KB page containing the
address from the page file (or in the case of code possibly from the original program file). This — a
valid page fault — normally happens quite invisibly. Sometimes, through program or hardware
error, the page is not there either. The system then has an ‘Invalid Page Fault’ error. This will be a
fatal error if detected in a program: if it is seen within the system itself (perhaps because a program
sent it a bad request to do something), it may manifest itself as a ‘blue screen’ failure with a STOP
code: consult the page on STOP Messages on this site.
If there is pressure on space in RAM, then parts of code and data that are not currently needed can
be ‘paged out’ in order to make room — the page file can thus be seen as an overflow area to make
the RAM behave as if it were larger than it is.

What is loaded in RAM?

Items in RAM can be divided into:

• The Non-Paged area. Parts of the System which are so important that they may never be
paged out - the area of RAM used for these is called in XP the ‘Non-Paged area’. Because
this mainly contains core code of the system, which is not likely to contain serious faults, a
Blue Screen referring to ‘Page Fault in Non-Paged area’ probably indicates a serious
hardware problem with the RAM modules, or possibly damaged code resulting from a
defective Hard disk. It is, though, possible that external utility software (e.g. Norton) may
put modules there too, so if such faults arise when you have recently installed or updated
something of this sort, try uninstalling it.
 • The Page Pool which can be used to hold:
• Program code,
• Data pages that have had actual data written to them, and
• A basic amount of space for the file cache (known in Windows 9x systems as
Vcache) of files that have recently been read from or written to hard disk.
Any remaining RAM will be used to make the file cache larger.

Why is there so little Free RAM?

Windows will always try to find some use for all of RAM — even a trivial one. If nothing else it
will retain code of programs in RAM after they exit, in case they are needed again. Anything left
over will be used to cache further files — just in case they are needed. But these uses will be
dropped instantly should some other use come along. Thus there should rarely be any significant
amount of RAM ‘free’. That term is a misnomer — it ought to be ‘RAM for which Windows can
currently find no possible use’. The adage is: ‘Free RAM is wasted RAM’. Programs that purport
to ‘manage’ or ‘free up’ RAM are pandering to a delusion that only such ‘Free’ RAM is available
for fresh uses. That is not true, and these programs often result in reduced performance and may
result in run-away growth of the page file.

Where is the page file?

The page file in XP is a hidden file called pagefile.sys. It is regenerated at each boot — there is no
need to include it in a backup. To see it you need to have Folder Options | View set to ‘Show
Hidden and System files’, and not to ‘Hide Protected mode System files’.
In earlier NT systems it was usual to have such a file on each hard drive partition, if there were
more than one partition, with the idea of having the file as near as possible to the ‘action’ on the
disk. In XP the optimisation implied by this has been found not to justify the overhead, and
normally there is only a single page file in the first instance.

Where do I set the placing and size of the page file?

At Control Panel | System | Advanced, click Settings in the “Performance” Section. On the
Advanced page of the result, the current total physical size of all page files that may be in existence
is shown. Click Change to make settings for the Virtual memory operation. Here you can select any
drive partition and set either ‘Custom’; ‘System Managed’ or ‘No page file’; then always click Set
before going on to the next partition.

Should the file be left on Drive C:?

The slowest aspect of getting at a file on a hard disk is in head movement (‘seeking’). If you have
only one physical drive then the file is best left where the heads are most likely to be, so where most
activity is going on — on drive C:. If you have a second physical drive, it is in principle better to put
the file there, because it is then less likely that the heads will have moved away from it. If, though,
you have a modern large size of RAM, actual traffic on the file is likely to be low, even if programs
are rolled out to it, inactive, so the point becomes an academic one. If you do put the file elsewhere,
you should leave a small amount on C: — an initial size of 2MB with a Maximum of 50 is suitable
— so it can be used in emergency. Without this, the system is inclined to ignore the settings and
either have no page file at all (and complain) or make a very large one indeed on C:
In relocating the page file, it must be on a ‘basic’ drive. Windows XP appears not to be willing to
accept page files on ‘dynamic’ drives.
NOTE: If you are debugging crashes and wish the error reporting to make a kernel or full dump,
then you will need an initial size set on C: of either 200 MB (for a kernel dump) or the size of RAM
(for a full memory dump). If you are not doing so, it is best to make the setting to no more than a
‘Small Dump’, at Control Panel | System | Advanced, click Settings in the ‘Startup and Recovery’
section, and select in the ‘Write Debug information to’ panel

Can the Virtual Memory be turned off on a really large machine?

Strictly speaking Virtual Memory is always in operation and cannot be “turned off.” What is meant
by such wording is “set the system to use no page file space at all.”
Doing this would waste a lot of the RAM. The reason is that when programs ask for an allocation of
Virtual memory space, they may ask for a great deal more than they ever actually bring into use —
the total may easily run to hundreds of megabytes. These addresses have to be assigned to
somewhere by the system. If there is a page file available, the system can assign them to it — if
there is not, they have to be assigned to RAM, locking it out from any actual use.

How big should the page file be?

There is a great deal of myth surrounding this question. Two big fallacies are:
• The file should be a fixed size so that it does not get fragmented, with minimum and
maximum set the same
• The file should be 2.5 times the size of RAM (or some other multiple)
Both are wrong in a modern, single-user system. A machine using Fast User switching is a special
case, discussed below.)
Windows will expand a file that starts out too small and may shrink it again if it is larger than
necessary, so it pays to set the initial size as large enough to handle the normal needs of your system
to avoid constant changes of size. This will give all the benefits claimed for a ‘fixed’ page file. But
no restriction should be placed on its further growth. As well as providing for contingencies, like
unexpectedly opening a very large file, in XP this potential file space can be used as a place to
assign those virtual memory pages that programs have asked for, but never brought into use. Until
they get used — probably never — the file need not come into being. There is no downside in
having potential space available.
For any given workload, the total need for virtual addresses will not depend on the size of RAM
alone. It will be met by the sum of RAM and the page file. Therefore in a machine with small
RAM, the extra amount represented by page file will need to be larger — not smaller — than that
needed in a machine with big RAM. Unfortunately the default settings for system management of
the file have not caught up with this: it will assign an initial amount that may be quite excessive for
a large machine, while at the same leaving too little for contingencies on a small one.
How big a file will turn out to be needed depends very much on your work-load. Simple word
processing and e-mail may need very little — large graphics and movie making may need a great
deal. For a general workload, with only small dumps provided for (see note to ‘Should the file be
left on Drive C:?’ above), it is suggested that a sensible start point for the initial size would be the
greater of (a) 100 MB or (b) enough to bring RAM plus file to about 500 MB. EXAMPLE: Set the
Initial page file size to 400 MB on a computer with 128 MB RAM; 250 on a 256 MB computer; or
100 MB for larger sizes.
But have a high Maximum size — 700 or 800 MB or even more if there is plenty of disk space.
Having this high will do no harm. Then if you find the actual pagefile.sys gets larger (as seen in
Explorer), adjust the initial size up accordingly. Such a need for more than a minimal initial page
file is the best indicator of benefit from adding RAM: if an initial size set, for a trial, at 50MB never
grows, then more RAM will do nothing for the machine's performance.
Bill James MS MVP has a convenient tool, ‘WinXP-2K_Pagefile’, for monitoring the actual usage
of the Page file, which can be downloaded here. A compiled Visual Basic version is available from
Doug Knox's site which may be more convenient for some users. The value seen for ‘Peak Usage’
over several days makes a good guide for setting the Initial size economically.
Note that these aspects of Windows XP have changed significantly from earlier Windows NT
versions, and practices that have been common there may no longer be appropriate. Also, the ‘PF
Usage’ (Page File in Use) measurement in Task Manager | Performance for ‘Page File in Use’
include those potential uses by pages that have not been taken up. It makes a good indicator of the
adequacy of the ‘Maximum’ size setting, but not for the ‘Initial’ one, let alone for any need for more
RAM.

Should the drive have a big cluster size?

While there are reports that in Windows 95 higher performance can be obtained by having the swap
file on a drive with 32K clusters, in Windows XP the best performance is obtained with 4K ones —
the normal size in NTFS and in FAT 32 partitions smaller than 8GB. This then matches the size of
the page the processor uses in RAM to the size of the clusters, so that transfers may be made direct
from file to RAM without any need for intermediate buffering

What about Fast User Switching then?

If you use Fast User Switching, there are special considerations. When a user is not active, there will
need to be space available in the page file to ‘roll out’ his or her work: therefore, the page file will
need to be larger. Only experiment in a real situation will establish how big, but a start point might
be an initial size equal to half the size of RAM for each user logged in.

Problems with Virtual Memory

It may sometimes happen that the system give ‘out of memory’ messages on trying to load a
program, or give a message about Virtual memory space being low. Possible causes of this are:
• The setting for Maximum Size of the page file is too low, or there is not enough disk space
free to expand it to that size.
• The page file has become corrupt, possibly at a bad shutdown. In the Virtual Memory
settings, set to “No page file,” then exit System Properties, shut down the machine, and
reboot. Delete PAGEFILE.SYS (on each drive, if more than just C:), set the page file up
again and reboot to bring it into use.
• The page file has been put on a different drive without leaving a minimal amount on C:.
• There is trouble with third party software. In particular, if the message happens at shutdown,
 suspect a problem with Symantec’s Norton Live update, for which there is a fix posted here.
It is also reported that spurious messages can arise if NAV 2004 is installed. If the problem
happens at boot and the machine has an Intel chipset, the message may be caused by an early
version (before version 2.1) of Intel’s “Application Accelerator.” Uninstall this and then get
an up-to-date version from Intel’s site.
• Another problem involving Norton Antivirus was recently discovered by MS-MVP Ron
Martell. However, it only applies to computers where the pagefile has been manually resized
to larger than the default setting of 1.5 times RAM — a practice we discourage. On such
machines, NAV 2004 and Norton Antivirus Corporate 9.0 can cause your computer to revert
to the default settings on the next reboot, rather than retain your manually configured
settings. (Though this is probably an improvement on memory management, it can be
maddening if you don’t know why it is happening.) Symantec has published separate repair
instructions for computers with NAV 2004 and NAV Corporate 9.0 installed. [Added by
JAE 2/21/06.]
• Possibly there is trouble with the drivers for IDE hard disks; in Device Manager, remove the
IDE ATA/ATAPI controllers (main controller) and reboot for Plug and Play to start over.
• With an NTFS file system, the permissions for the page file’s drive’s root directory must
give “Full Control” to SYSTEM. If not, there is likely to be a message at boot that the
system is “unable to create a page file.”

http://www.rojakpot.com/showarticle.aspx?artno=143

Virtual Memory Optimization Guide Rev. 4.1!

Digg this article: | Bookmark this article:
Virtual Memory
Back in the 'good old days' of command prompts and 1.2MB floppy disks, programs needed very
little RAM to run because the main (and almost universal) operating system was Microsoft DOS
and its memory footprint was small. That was truly fortunate because RAM at that time was
horrendously expensive. Although it may seem ludicrous, 4MB of RAM was considered then to be
an incredible amount of memory.
However when Windows became more and more popular, 4MB was just not enough. Due to its
GUI (Graphical User Interface), it had a larger memory footprint than DOS. Thus, more RAM
was needed.
Unfortunately, RAM prices did not decrease as fast as RAM requirement had increased. This meant
that Windows users had to either fork out a fortune for more RAM or run only simple programs.
Neither were attractive options. An alternative method was needed to alleviate this problem.
The solution they came up with was to use some space on the hard disk as extra RAM. Although the
hard disk is much slower than RAM, it is also much cheaper and users always have a lot more hard
disk space than RAM. So, Windows was designed to create this pseudo-RAM or in Microsoft's
terms - Virtual Memory, to make up for the shortfall in RAM when running memory-intensive
programs.
 FloatingFrame

How Does It Work?

Virtual memory is created using a special file called a swapfile or paging file.
Whenever the operating system has enough memory, it doesn't usually use virtual memory. But if it
runs out of memory, the operating system will page out the least recently used data in the memory to
the swapfile in the hard disk. This frees up some memory for your applications. The operating
system will continuously do this as more and more data is loaded into the RAM.
However, when any data stored in the swapfile is needed, it is swapped with the least recently used
data in the memory. This allows the swapfile to behave like RAM although programs cannot run
directly off it. You will also note that because the operating system cannot directly run programs off
the swapfile, some programs may not run even with a large swapfile if you have too little RAM.