Using NTFS Cluster Allocation Behavior to Find the Location of User Data

Disk Cluster Allocation Behavior in Windows and NTFS

“…That corresponds to files between 4 and 20 KiB in size. We have earlier found the average amount of files in a standard office computer to be approximately 350000 by counting the files in 25 (office) computers running mostly Windows 7 [5,11]. If we combine that with the official disk space requirement of 20 GiB for a standard Windows 7 to 10 installation [12-14] we get an average file size of 60 KiB.…”

“…In most of the file operations executed during our experiment the algorithm behaved as a strict best fit type, but when having access to a very large area of free clusters it started to allocate parts of that area instead of using options corresponding to a best fit allocation strategy. Looking at data from previous experiments [5,11] we have found that having a few very large areas of free clusters at the end of a NTFS partition is the standard situation, thus the allocation strategy used by Windows together with NTFS is only best fit in special circumstances. Likewise the allocation strategy is not strictly best fit when dealing with stream written files, where the allocation algorithm is creating increasingly larger fragments as more data is written (the fragment size and the currently written size correlates).…”

“…The disk of the Windows 7 machine was already used since it was taken from one of our earlier experiments [5], where 10000 file operations were performed in a pseudorandom pattern with bias towards file writing. This had given a heavily fragmented file system corresponding to an old and well used (home) computer.…”

“…The experiment is part of the future work presented in two earlier articles [5,11] where we develop a framework to create maps of user data placement on hard disks. The maps give the probability of finding unique user data at different Logical Block Addressing (LBA) positions in Windows NTFS partitions and can for example be used for triage, planning of hard disk investigations and to enable different areas to be prioritized in file carving processes.…”

“…Since the book was written in 2005 it does not cover the allocation algorithms used by Windows 7 and newer. Our previous experiments [5,11] indicate that the actual behavior of the allocation algorithm in NTFS is not strictly best fit. The results from experiments indicate that groups of free clusters are allocated in descending order of size, which is best fit, but not always.…”