Defrag NTFS $LogFile

windows-7 ntfs sysinternals

5,147

The $Logfile is a special NTFS system file. It is a circular log of all disk operations and is used to safely roll back unsuccessful disk operations. The file has a fixed size and is allocated when the disk is formatted. It cannot be deleted, moved, or defragmented.

The "chkdsk" Windows commandline utility can show and change the size of the $Logfile. Making the $Logfile bigger will not move it, but will append a new fragment. Making the $Logfile smaller will remove fragments from the end.

CHKDSK c: /L:XXX   
where XXX is the size in KB. /L without a size will show info.

You could try setting a smaller size temporarily, defrag and then resize it again.

5,147

Martijn

Updated on September 18, 2022

Comments

Martijn almost 2 years
I have the super descriptive "my computer is slow" issue. In resource manager I notice that c:\$LogFile access times are continuously around 800 ms, and I suspect this is causing much of the slowdown. At How do you defragment the MFT on an NTFS disk? I found that contig could - in theory - help. In practice though, running contig $LogFile in a cmd window run as administrator gives me
```
Contig v1.7 - Makes files contiguous
Copyright (C) 1998-2012 Mark Russinovich
Sysinternals - www.sysinternals.com

------------------------
Access is denied.

No files fragmented.
```
$Bitmap, $Boot, and $BadClus also give me Access is denied.

$Mft, $Volume, $AttrDef, $Secure, $UpCase and $Extend work fine.

How can I work around this? Can I attach this disk to a different machine, not mount in some way, and defrag those files from there? If so, how would that work? Or are there simpler ways to do the same?
- Jason almost 10 years
  
  The consensus seems to be that you can't, but I'd be interested to see what happens to $LogFile after cloning the drive. In my experience, unlike defrag utilities, cloning a drive makes every file contiguous.
- Jason almost 10 years
  
  The TechNet page for Contig actually says: Contig can also analyze and defragment the following NTFS metadata files: $LogFile. I also get access denied.
- Vinayak almost 10 years
  
  Running Contig as SYSTEM also didn't work. Maybe try running it from the recovery console or Windows PE environment?
Martijn almost 10 years

If it can't be defragmented, why does contig explicitly mention $LogFile as a possible target?
Marcelo almost 10 years

Not sure. Have you tried Contig on a disk other than the one holding the operating system? I believe resizing a NTFS partition would reset the $LogFile, so maybe it is possible to defrag on a partition without any file locks on it.
Martijn almost 10 years

The disk is a disk in my laptop, which has only place for one disk and not much room for experimentation of non-boot disks.
Jamie Hanrahan almost 10 years

NTFS does not log "all disk operations" in $logfile. NTFS logging, two-phase commit, etc., is only for changes to file system metadata. It doesn't log (or allow rollbacks, etc.) of file content. ntfs.com/transaction.htm