Hotfix to Enable Mini-Filter Performance Diagnostics With XPerf for Windows Server 2008R2

Greetings ntdebugging community, Bob here again and today I would like to let everyone know about a new feature implemented in Windows Server 2008 R2’s kernel and filter manager binaries released in knowledge base article 2666390.   Beginning with this update, a minifilter that is adversely affecting system performance can be identified in Windows 2008…

2

Where Did My Disk I/O Go?

Hello, Mr. Ninja back again.  I recently discovered that although my team often tracks I/O from the file system through to the disk controller, we have never publicly documented the steps required to do this.  This seems like a great opportunity for a blog because most of the structures are known, and they are even…

4

Determining The Interrupt Line For A Particular PCI-E Slot

Hi debuggers, this is Graham McIntyre again. These days I’m working more closely with hardware so I thought I’d share some hardware related debugging tips.  I recently debugged an issue where a PCI-E storage device failed to work after hot swapping it from one slot to another slot on the system without rebooting.  We determined…

5

NTFS And 4K Disks

Since the 1960’s, hard disks have always used a block size of 512 bytes for the default read/write block size.  Recently drive manufacturers have been moving toward a larger block size to improve performance and reliability.  Currently there are two types of disks available with a 4KB sector size: 512 byte emulated, and 4KB block…

5

Ntfs Misreporting Free Space (Part 2)

Continuing our discussion on the internals of disk usage, we will now shift our focus to internal metadata usage. …….. KB in …. Indexes.   Consider for a moment a world without indexes…  The $MFT is a database containing records that are accessed via FRS (file record segment) numbers.  This FRS number includes an embedded sequence number…

4

NTFS Misreports Free Space?

I have recently seen a number of issues where customers called in to report a significant difference between the “Size on disk” for the root of a volume, and the reported amount of “Used space” in the volume properties.  While considering this, I noticed that my own C: drive had a mysterious 20GB difference.   Below…

14