File - $Bitmap (6)

Overview

This file lists which clusters are in use. Each bit in this file represents one LCN.

Attributes

Type	Description	Name
0x10	$STANDARD_INFORMATION
0x30	$FILE_NAME	$Bitmap
0x80	$DATA	[Unnamed]

Layout of the File

Unnamed Data Stream

The lowest bit represents the lowest numbered LCN. Thus:

Bit	LCN
00000001₂	0
00000010₂	1
00000100₂	2
...	etc

Notes

MFT Zone

To prevent the MFT becoming fragmented, Windows maintains a buffer around it. No new files will be created in this buffer region until the other disk space is used up. The buffer size is configurable and can be 12.5%, 25%, 37.5% or 50% of the disk. Each time the rest of the disk becomes full, the buffer size is halved.

Other Information

The size of this file is always a multiple of 8 bytes (64 clusters). Because of this rounding-up, the $Bitmap will represent slightly more clusters than the disk has. These bit are always set to 1.

The backup copy of the boot sector lies in this no-mans-land the cluster is hence marked as in use.

In theory, on very small volume, this attribute could be resident. In practice, Windows crashes.