NTFS Optimization
If you investigate your storage needs, you can tune some of global NTFS parameters to achieve significant increase of disk performance. Other techniques like disk defragmentation could help you either.
There are several factors (we do not mention here drive type, rpm ...) that affect the NTFS Performance: Cluster Size, location and fragmentation of Master File Table (MFT) and paging file, NTFS Volume compression, NTFS Volume Source (created or converted from existing FAT volume).
Define Cluster Size Properly
Cluster is an allocation unit. If you create file lets say 1 byte in size, at least one cluster should be allocated on FAT file system. On NTFS if file is small enough, it can be stored in MFT record itself without using additional clusters. When file grows beyond the cluster boundary, another cluster is allocated. It means that the bigger the cluster size, the more disk space is wasted, however, the performance is better.
The following table shows the default values that Windows NT/2000/XP uses for NTFS formatting:
Drive size
(logical volume) Cluster size Sectors
----------------------------------------------------------
512 MB or less 512 bytes 1
513 MB - 1,024 MB (1 GB) 1,024 bytes (1 KB) 2
1,025 MB - 2,048 MB (2 GB) 2,048 bytes (2 KB) 4
2,049 MB and larger 4,096 bytes (4 KB) 8
However, when you format the partition manually, you can specify cluster size 512 bytes, 1 KB, 2 KB, 4 KB, 8 KB, 16 KB, 32 KB, 64 KB in the format dialog box or as a parameter to the command line FORMAT utility.
What it gives us? Determine average file size and format the partition accordingly. How to determine? The simplest (but rough) way is to divide number of files on the drive by total disk usage in kilobytes. Another idea is to estimate the approximate data size in advance before formatting the hard drive. If you are going to store multimedia stuff that is usually huge in size, make cluster bigger to increase a performance. If you plan to store small web pages or text documents, make cluster size smaller not to lose a lot of disk space. Think!
Note: On Volumes, having cluster size more than 4 KB compression is not supported
MFT Reservation and Fragmentation
MFT contains frequently used system files and indexes, so performance of MFT affects a lot to the entire volume performance.
By default NTFS reserves zone, 12.5% of volume size for MFT and does not allow writing there any user's data, which lets MFT to grow. However, when, for example, a lot of files are placed to the drive, MFT can grow beyond the reserved zone and becomes fragmented. Another reason is when you delete file, NTFS does not always use its space in MFT to store new one, it just marks MFT entry as deleted and allocates new entry for the new file. It provides some performance and recovery benefits, however it forces MFT to be fragmented.
The more MFT fragmentation, the more the HDD heads movements to access the data, the less overall performance of file system.
Starting from Windows NT 4.0 SP4 you can define MFT Zone Reservation value through the Registry.
Key: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlFileSystem
Value NtfsMftZoneReservation of DWORD type (1 to 4) allows you to specify MFT Zone for the newly created/formatted volumes(12.5 percent, 25 percent, 37.5 percent, 50 percent of NTFS volume accordingly)
File and Directory Fragmentation
Not only MFT but also other files and directories can be fragmented when drive becomes full and you perform lots of copying and deleting actions with files. It also slows down system performance, so using standard Defragmentation Tools regularly is advisable when you perform a lot of copy/move/delete operations on the volume. Starting from Windows 2000, Disk Defragmenter is a part of Operating System and you can find it in Computer Management console.
If you do not have such tools, you can try doing it manually. Just copy files and folders to another partition, leaving original one nearly empty, and then copy them back. This solution is less effective than using standard Defragmentation Toools, however, it could greatly improve the volume performance in case if your partition was heavily fragmented.
Note: It's not an acceptable solution if you have security/permissions setup on these files. While copying between partitions you'll loose this information.
To prevent directory fragmentation, just perform complete drive defragmentation before installing new applications or copying lots of files onto the volume.
Paging File Fragmentation
You cannot use standard Defragmentation Tools to defragment Paging File (PAGEFILE.SYS) because it's being constantly used by Operating System for virtual memory storage. However, you still can do it manually. Just change it's location to another drive (or decrease it's size to minimal value if you do not have another drive), re-boot machine, perform volume Defragmentation, and change parameters of Paging File back to the original state. That's it!
Compression on NTFS Volumes
Compression could save some space on your volume and could increase or decrease your overall performance depending on CPU speed, Volume Size, and Compressible Data. If you have fast CPU and relatively slow HDD, compression is recommended because compressed data takes less size on volume and will be read and decompressed in the memory much faster than reading the whole uncompressed block from the slow drive. The larger the volume (> 8Gb), the lesser its performance if compressed. And, for sure, there is no use of compressing the Volume or folder containing uncompressible data, such as JPG images, ZIP files, etc... Ideal data for the compression are text and office documents, bitmap images and other files consisting of lots of repeating characters.
To compress the file/folder/volume - just go to its properties in Windows Explorer and mark Compressed checkbox.
Conversion volume from FAT to NTFS
If you did not setup Windows on the newly created NTFS Volume, but converted volume from FAT to NTFS, usually it causes MFT fragmentation so generally converted partitions are much slower than the ones being originally created as NTFS. Defragmentation tools are in general unable to defragment MFT, however, you can try to backup the whole system, re-format the volume with proper cluster size, and restore it back.
Unnecessary Access Updates
NTFS automatically updates the last access time and date stamp on folders and files when NTFS traverses its B-tree folder structure. To enhance NTFS performance you can disable this behavior and reduce NTFS's operational overhead without significantly impairing functionality. In the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlFileSystem Registry key, change the NtfsDisableLastAccessUpdate value of type REG_DWORD from the default value 0 (enabled) to 1 (disabled). This Registry value doesn't exist by default, so you need to enter it manually.
Outdated DOS 8.3 Name creation
You can increase NTFS performance if you disable DOS 8.3 name creation. In the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlFileSystem Registry key, change the NtfsDisable8dot3NameCreation value of type REG_DWORD from the defaoult value 0 (enabled) to 1 (disabled).
Recommended Reading:
HOW TO: Defragment Your Disk Drive Volumes in Windows XP (Q314848):
http://support.microsoft.com/kb/314848
Description of the New Command Line Defrag.exe Included with Windows XP:
http://support.microsoft.com/kb/283080
The Default Cluster Size for the NTFS and FAT File Systems (Q314878) :
http://support.microsoft.com/default.aspx?scid=kb;EN-US;q314878
How NTFS Reserves Space for its Master File Table (MFT) (Q174619)
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q174619
Optimizing NTFS
http://technet.microsoft.com/en-us/library/cc767961.aspx
How to Disable the 8.3 Name Creation on NTFS Partitions
http://support.microsoft.com/kb/121007
$EFS attribute size
Computer SID and user number. It specifies folder where EFS stores certificates. In order to get folder name EFS makes some manipulations:
Public key thumbprint
Private key GUID (also used as container name). This name EFS uses when it aquires context from CryptoAPI provider. If there's only one DDFin $EFS attribute, container name can be figured out from $EFS (this field), but as more users added to the file (more DDFs or DRFs), PK GUID is not stored for all of them and must be retrieved from certificate storage based on public key thumbprint. 
Cryptographic provider name = Microsoft Base Cryptographic Provider v.1.0
User name, to whom current DDF or DRF belongs
Encrypted FEK. Usually FEK is 128-bit long (in case of DESX) but since it's encrypted with 1024-bit RSA key, its encrypted length is 1024 bits.
