Windows Storage - Defragmentation

The first thing to note is that you cannot defragment file system volumes that are not NTFS, Fat or Fat32.

What is Fragmentation?

When a Windows operating system is first installed on a disk and then applications are added, all the files are contiguous and arranged in the optimal place on the disk for performance. This means that the read-write heads do not need to move much to read a single file. A file is fragmented when it is not contiguous, but is split up into pieces in various parts of the disk. Now the read-write heads have to move back and forward over the disk to read the whole file. This takes time, and causes 'seek delay' performance problems.

When a file is updated, it usually needs space to grow. The NTFS file system leaves space before and after a file, to allow it a bit of room to grow without causing fragmentation. Microsoft initially thought that this meant that the NTFS was fragmentation proof, and were so confident that they did not supply a defragmentation tool. However, this is not quite correct. The 'guard space' which NTFS leaves on either side of files is about 30% of the space used by the file, so once an NTFS partition hits the 70% full mark, the data has actually hit the end of the disk. When more new files are added, they will be allocated into the 'guard bands', and may well be fragmented.
Over time, as files are deleted and new files added, the free space becomes fragmented, so it is impossible to allocate a new file into a single space. Fragmentation and performance will get worse with time.

In the real world, performance does not die when partitions are loaded beyond 70%. This is probably due to a combination of the other NTFS performance features, and also that the big cache in RAID disks mask sequential access and seek problems (because the files are no longer allocated in nice contiguous chunks, but are split up and striped over several disks).

A defragmentation tool basically works by moving files around on the disk, so each file becomes consolidated into one contiguous extent, and to consolidate the freespace into a single contiguous extent for new allocations. This ideal cannot be achieved in practice, as some files cannot be moved.
Commercially available Disk defragmenter software is evolving so that instead of fixing fragmentation issues, it tries to prevent them from happening in the first place, using 'intelligent write' processes.

Problem files and volumes

You cannot defragment specific types of file system volumes or drives:
You cannot defragment volumes that the file system has locked.
You cannot defragment volumes that the file system has marked as dirty, which indicates possible corruption. You must run chkdsk on a dirty volume before you can defragment it. You can determine if a volume is dirty by using the fsutil dirty query command. For more information about chkdsk and fsutil dirty, see additional references.
You cannot defragment network drives.
You cannot defragment cdROMs.
You cannot defragment file system volumes that are not NTFS, ReFS, Fat or Fat32.
With Windows Server 2008 R2 , Windows Server 2008 , and, Windows Vista, you can schedule to defragment a volume. However, you cannot schedule to defragment a Solid State Drive (SSD) or a volume on a Virtual Hard Disk (VHD) that resides on an SSD.
To perform this procedure, you must be a member of the Administrators group on the local computer, or you must have been delegated the appropriate authority. If the computer is joined to a domain, members of the Domain Admins group might be able to perform this procedure. As a security best practice, consider using Run As to perform this procedure.
A volume must have at least 15% free space for defrag to completely and adequately defragment it. defrag uses this space as a sorting area for file fragments. If a volume has less than 15% free space, defrag will only partially defragment it. To increase the free space on a volume, delete unneeded files or move them to another disk.

Files which cannot be moved with Windows active are
Bootsect.dos
Safeboot.fs
Safeboot.csv
Safeboot.rsv
Memory.dmp
FAT directories
Change journal
and any other files open for exclusive use.

Master File Table
The MFT is an index file that maps everything stored on a disk, and is usually held right in the centre of the disk. The MFT is explained in the NTFS page. As MTF entries are being constantly added or deleted as files are created or deleted, the MTF gradually becomes fragmented, resulting in longer disk access times and diminished performance.
Paging File
Windows uses the Paging File to swap data in and out of Random Access Memory (RAM). When the RAM fills up, Windows needs to create more room to load programs or data, so it swaps the oldest data from memory out to the paging file on disk. If the Paging File becomes fragmented, performance will suffer, and you can usually hear the hard drive thrashing while you wait for a response.
Hibernate File
The Hibernate File is where memory data is stored when the computer is turned off. Because the location of the Hibernate File is determined very early in the boot process, it cannot be moved.

It is impossible to defragment any of the three files above using normal Windows defragmentation tools, you need a third party tool which works at boot time

Directories can also become fragmented; adding to the time it takes to access files. Windows 2000 directories on an NTFS disk can be defragmented while the operating system is running. However, FAT directories can only be defragmented at boot time.

Good defragmentation policies

  • Delete any files that you don't need before starting a defrag
  • Purge the deleted files using a utility like spybot
  • Run a chkdsk to make sure your disk is not dirty.
  • Make sure you have at least 15% free space to be used as a sorting area
  • Kill off as many active processes as possible to minimise files in use
  • A defrag can take several hours. Defragmentation speed is related to the number of files on a disk, so it will take much longer for large, full disks.

back to top


Defragmentation with Commands

If you are running Windows Server 2016, both variants of Windows Server 2012 or Windows 10, you can run a defrag with a command, although you need to be a member of he local Administrators group. The syntax of the command is simply 'defrag volume followed by switches. These are best illustrated by examples;

defrag d: /U /V

/U means show the defrag progress and /V means verbose

defrag d: g: /M

Defragment two volumes in parallel in the background

defrag d: mountpoint /A /U

Run a fragmentation analysis of the d: with progress

defrag /C /H

/C means this command applies to all volumes. /H means run with normal priority

A full list of switches is:
/A   Perform analysis on the specified volumes.
/C   Perform the operation on all volumes.
/D   Perform traditional defrag (this is the default).
/E   Perform the operation on all volumes except those specified.
/H   Run the operation at normal priority (default is low).
/K   Perform slab consolidation on the specified volumes.
/L   Perform retrim on the specified volumes.
/M   Run the operation on each volume in parallel in the background.
/O   Perform the proper optimization for each media type.
/T   Track an operation already in progress on the specified volume.
/U   Print the progress of the operation on the screen.
/V   Print verbose output containing the fragmentation statistics.
/X   Perform free space consolidation on the specified volumes.

While defrag is analyzing and defragmenting a volume, it displays a blinking cursor. When defrag is finished analyzing and defragmenting the volume, it displays
By default, defrag displays a summary of both the analysis and defragmentation reports if you do not specify the /a or /v parameters.
You can send the reports to a text file by typing >FileName.txt, where FileName.txt is a file name you specify. For example: defrag volume /v > FileName.txt
To interrupt the defragmentation process, at the command line, press CTRL+C.
Running the defrag command and Disk defragmenter are mutually exclusive. If you are using Disk defragmenter to defragment a volume and you run the defrag command at a command-line, the defrag command fails. Conversely, if you run the defrag command and open Disk defragmenter, the defragmentation options in Disk defragmenter are unavailable.

back to top


Defragmentation from the GUI

Microsoft provided a system defragmenter tool from Windows 2000 onwards. It is based on the Diskeeper product described below. It has two functions, an analyze function to determine if a disk needs defragging, and the defragmentation function itself. Windows 7, 8 and 10 will run a scheduled weekly defrag automatically so there is no need to run one yourself. To run a defrag manually -

On Windows 7 and earlier, click Start - Programs - Accessories - System Tools - Disk Defragmenter; Select the volume that you want to check for fragmentation; Click Analyze and the message box will tell you if a defragment is necessary. If so, click Defragment.
On Windows 8, open a Search window by typing Windows+Q or swiping in from the right and opening the Search Charm and then search for 'Defragment'. Select the result 'Defragment and optimize your drives'.
On Windows 10, from the good old Start button, select 'Windows Administrative Tools', then 'Defragment and Optimise Drives', This will oped up a window which will tell you the optimisation state of all your drives and give you a chance to defragment them.

Third party tools

Diskeeper

Diskeeper is supplied by Condusiv Technologies, and in fact, the Microsoft defrag tool used Diskeeper code. So why would you buy a third party tool when Microsoft provide one with the operating system?
Diskeeper defrags your directories at boot time, outside of the Windows OS, so allowing access to files that are normally reserved. In theory, this might mean the boot takes longer, but it can actually improve performance as files used by the boot process are optimised.
One Diskkeeper feature is InvisiTasking technology which allow you to run normal work while defragmentation occurs in the background. This can be set up to run automatically, and almost invisibly.
The IntelliWrite defragmentation routines intelligently write files to the disk to avoid 85 percent of files from ever getting fragmented. This keeps most drives in a continual fragmentation free state. Diskeeper 15 extnds this functionality to SAN disks. It cannot defrag SAN drives directly, but it will perform intelligent writes so SAN disks are always optimised.
Diskeeper can defragment the paging file and the MFT at boot time. It is also possible to schedule this for remote servers using remote boot. Diskeeper supports Windows 2008 and 2012 versions.

O&O Defrag

O&O Defrag has the usual defrag facilities, it can defrag systems files at boot time, and it will run in 'screen saver' mode to automatically defragment disks when a computer is not is use, with no negative performance impact on your systems. It integrates with Windows explorer to present a simple user interface. It will defragment an unlimited number of drives or partitions, and can defragment almost any type of disk including USB sticks, memory cards and RAID devices, with only about 5% free space needed for operation (the Windows defragmenter needs 15% free space).
O&O Defrag 19 supports Windows 10 and has the ability to optimise data access on SSD disks by telling the SSD to reuse space left by data that has been deleted.

back to top