4. FSInfo
This mode is one of the
more interesting and immediately usable modes. It provides you with
statistics regarding the file system. For example, you can use it to
obtain a list of active drives on the current system. You could redirect
this list to a text file for use with a script or output it to a batch
file to perform a task on every attached drive. This mode uses the
following syntax:
FSUtil FSInfo [drives] [drivetype Volume] [volumeinfo Volume]
[ntfsinfo Volume] [statistics Volume]
The following list describes each of the command line arguments.
drives
Displays the current list of active drives on the system.
drivetype
VolumeDisplays the drive
information for the specified volume. The output is a generic term for
the drive type such as Fixed Drive or CD-ROM Drive.
volumeinfo
VolumeDisplays
statistics about the specified volume including the volume name, volume
serial number, maximum component length, and file system name. In
addition, the output tells whether the drive supports case-sensitive
filenames, Unicode in filenames, file-based compression, disk quotas,
sparse files, reparse points, object identifiers, the encrypted file
system, and named streams. Finally, you can determine whether the volume
preserves the case of filenames, and if it preserves and enforces
Access Control Lists (ACLs).
ntfsinfo
VolumeDisplays the
low-level statistics about the NTFS volume. This information includes
NTFS version, number of sectors, total clusters, free clusters, total
reserved clusters, bytes per sector, bytes per cluster, bytes per file
record segment, and clusters per file record segment. In addition, you
can learn the following MFT statistics: valid data length, start
location (MFT1 and MFT2), zone start, and zone end.
statistics
VolumeDisplays a
list of the operational statistics for the specified volume. The
statistics include the following user information: UserFileReads,
UserFileReadBytes, UserDiskReads, UserFileWrites, UserFileWriteBytes,
and UserDiskWrites. These are all standard counters, so you can also
access them using the Performance console. In addition to user
information, you can obtain metadata, MFT, root file, and log file
statistics.
5. Hardlink
A hard link is a connection
between two files. The new file that you create is a pointer to the
existing file. In essence, you're creating another directory entry to a
single file. The file continues to exist until you remove all of the
directory entries pointing to it. Any change you make to the content of
the new file also appears within the existing file, and vice versa. The
main reason to use hard links is to create the same file in multiple
locations on the hard drive. For example, you might need to use the same
initialization file with multiple applications. Instead of copying the
file multiple times, you can simply create multiple hard links to it.
This mode uses the following syntax:
FSUtil Hardlink Create NewFilename Filename
The following list describes each of the command line arguments.
NewFilename
The name of the
new file to create from the existing file. The new file is simply a
directory entry, not an actual copy of the file.
Filename
The name of the
existing file. You can include a drive and either relative or absolute
path information to the file, along with the filename.
6. ObjectID
Files on NTFS volumes
have four identifiers: object, birth volume, birth object, and domain.
Each of these identifiers is a 16-byte hexadecimal number in the form of
17e0b9211e61da11879e0013d4337d7d. The first three identifiers always
have a value; the fourth identifier (domain) isn't currently used.
Generally, unless a file is damaged in some way, you should never need
to change the identifiers. This mode uses the following syntax:
FSUtil ObjectID [query Filename] [set ObjectId BirthVolumeId
BirthObjectId DomainId Filename] [delete Filename] [create Filename]
The following list describes each of the command line arguments.
Filename
Specifies the name of the file to query or modify.
ObjectId
Contains a
16-byte hexadecimal number that uniquely identifies the file on a
particular volume. This identifier is extremely important because the
Distributed Link Tracking (DLT) Client service and the File Replication
Service (FRS) use it to identify files. This identifier can change when
you move a file from one volume to another. However, the BirthVolumeId and BirthObjectId values never change, so Windows can always identify a particular file using these values no matter where you move it.
BirthVolumeId
Contains a
16-byte hexadecimal number that identifies the initial file volume. The
DLT Client service uses this value to identify moved files.
BirthObjectId
Contains a 16-byte hexadecimal number that reflects the file's initial ObjectID. The DLT Client service uses this value to identify moved files.
DomainId
Contains a
16-byte hexadecimal value of all zeros. Windows doesn't currently use
this identifier and you should always set it to 0.
query
Displays the ObjectId, BirthVolumeId, BirthObjectId, and DomainId for the specified file.
set
Changes the ObjectId, BirthVolumeId, BirthObjectId, and DomainId of the specified file.
delete
Removes the ObjectId, BirthVolumeId, BirthObjectId, and DomainId from the specified file.
create
Adds an ObjectId, BirthVolumeId, BirthObjectId, and DomainId to the specified file. Windows automatically generates unique identifiers for you.
7. Quota
Quotas help keep
resource usage under control on systems with multiple users. Each user
receives a specific amount of disk space to use for personal needs.
Every file that has the user as an owner counts against the total. When
the user exceeds their quota, the system informs both the user and the
administrator (using a system of violation notifications). This mode
uses the following syntax:
FSUtil Quota [disable Path] [track Path] [enforce Path]
[violations] [modify Path Threshold Limit User] [query Path]
The following list describes each of the command line arguments.
Path
Specifies the
target path (generally an entire volume) for a particular quota action.
The path can include a drive specification. It can also rely on an
absolute or relative path specification.
Threshold
Defines the amount
of space in bytes that the user can use on the drive before the system
alerts the user to a possible limit violation. The user still has
additional space on the drive, but the threshold is normally the point
at which the user should consider cleaning up old files. The threshold
is a warning point.
Limit
Defines the
amount of space in bytes that the user can access on the drive.
Generally, the system begins issuing warnings for every disk activity at
this point. Depending on the quota setup, the drive could prohibit
additional drive use. The user must clean up old files on the hard drive
after reaching the limit.
User
Specifies the Windows account that has a quota attached to it.
disable
Stops quota tracking and enforcement for the specified resource.
track
Enables quota tracking for the specified resource. This option doesn't enable enforcement of any rules you have in place.
enforce
Enables quota enforcement for the specified resource. This option doesn't enable tracking.
violations
Displays a list of
quota violations found in the event log. If the event log doesn't have
any quota violations, the utility displays a "No quota violations
detected" message. The utility checks both the system and application
logs for both quota threshold and quota limit violations.
modify
Changes the
quota settings for a particular user. You must supply the drive,
threshold, limit, and user inputs when using this option.
query
Displays the query
settings for the specified resource. In addition to the actual quota
settings, this command displays the per user settings. This information
includes the user SID, change time, quota used, quota threshold, and
quota limit.
8. Repair
This mode lets you repair
a file system object from the command line. You use it to place the
system object in a known good state. In some cases, repairing the system
object could mean data loss because the object is broken in such a way
that repairing it means losing the data (perhaps due to a pointer or
other problem). This mode uses the following syntax:
FSUtil Repair [query Volume] [set Volume Flags] [wait FSObject]
[initiate Volume FileReference]
The following list describes each of the command line arguments.
query
VolumeDetermines
the repair status of the specified volume. The repair status defines
what kinds of repairs you can perform on the volume. The status includes
any of the following values.
- 1 The volume supports general repair.
- 8 The volume warns about potential data loss when performing a repair.
set
Volume FlagsChanges the repair
status of the specified volume. The flag contains a number that
specifies the repair status. See the query keyword for a list of
acceptable values.
wait
FSObjectTells the FSUtil to wait for the specified file system object repairs before performing any other tasks.
initiate
Volume FileReferencePerforms a repair of
the specified file on the referenced volume. To use this feature, you
must provide the segment number of the file.
