(I've looked around a bit, but I can't find an exact answer to this)

I wanted to dual-boot Ubuntu on my Windows 11 PC, but when I went to shrink C: down ~50GB, there was only ~2,000MB or so available; even after the following, I only ended up with ~19,000MB available:

  • I disabled PageFile, Hibernation, System Restore, Kernel Memory Dumps, and Temporary Files
  • I defragged, used Perfect Disk Defrag, and Disk Cleanup

A volume shrink analysis was initiated on C: and this event log entry details information about the last unmovable file that could limit the maximum number of reclaimable bytes:

  • Last unmovable file appears to be: \$Mft::$DATA
  • Last cluster of file: 0x6f5d551
  • Shrink potential target [LCN address]: 0x5869a8f
  • NTFS file flags: -S--D
  • Shrink phase: <analysis>

To find more details about this file, please use command:

fsutil volume querycluster \\?\Volume{b9b8761d-1c30-40e5-897d-dadb1b30e10a} 0x6f5d551
  • 1
    To piggyback on @joepvansteen's answer: SysInternals' contig, or it's GUI front-end Power Defragmenter, can be used to defrag hidden filesystem data directories and files. Generally speaking, the native Windows defragmenter has never been great for hidden data directories and files used by the filesystem (it's possible this has changed recently, but since I haven't used mechanical HDDs in a non-server for over a decade, I can't verify, as defrag is usually never used on an SSD because it causes more problems than it solves)
    – JW0914
    Sep 2, 2023 at 12:26

1 Answer 1


It appears it's referring to the $DATA attribute of the $MFT itself ($MFT is self-referencing), as $DATA is referencing clusters that actually make up the $MFT.


There are free defrag tools that may allow you to move the MFT fragments towards the start of the drive, the Windows defrag API even allows for this to be done 'online', and I think even Defraggler can do it.

  • My own DiskTuna tool was capable of doing it too, but since it's over a decade old and not touched since then, I'd use something else.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .