Kaspersky and MFT usage

Hello,

I've heard that Kaspersky creates lots of indexes for the sake of i-Checker and i-Swift technology.

In order to check whether I tested it on my friends PC.
My friend uses NOD32 AV, first I created a disc usage snapshot using perfect disc. Then I installed Kaspersky AV v7.0.0.125 performed a full system scan and then again took disc usage snapshot using perfect disc.

The results were shocking....Kaspersky generated ample of MFT data!!

Take a look here before KAV installation:

http://img242.imageshack.us/my.php?image=beforekisinstallationov8.jpg

After KAV installation:

http://img241.imageshack.us/my.php?image=afterkisinstallationcs8.jpg


Post your comments.....

 

And this means?

 

Well, it possibly has something to do with allegations of Kaspersky influencing MFT fragmentation and hence increasing the need and frequency of defragging. But personally I have never seen MFT issues with Kaspersky. I've only seen the chkdsk issue.

 

okey... and whats the point of this thread?
... the MFT data hasn't increased, only the MFT Zone has... they're different.
Increasing the Zone doesn't mean anything has been added.
Increasing the MFT means something's been added.

Some enlightenment from Perfect Disk's Help File for you... (clearly you haven't done any research into the difference):

If you think thats "shocking", you need to get out a bit more.

 

But I do not get the point...why is there a drastic increase in the MFT reservoir?

 

During scanning iSwift assigns an ObjectID to every file that doesn't already have one (and most don't). These ObjectIDs, which are stored in the MFT, each require 16 bytes of disk space. However, every file that is assigned an ObjectID must also be given a BirthVolumeID, BirthObjectID and DomainID, each of which also consumes 16 bytes, resulting in a total of 64 bytes per file.

I haven't tested this specifically, but I believe that if you multiply 64 bytes times the number of files in your partition you should have a reasonable estimate of the size increase of your MFT. However, there may be additional factors that I am not accounting for. Please review your MFT's before and after sizes and let me know if my estimate is correct.

PS: Your second image is not loading.

 

Reuploaded images.

 

Unless I'm interpreting the graph wrong it looks as though the MFT Zone has increased quite a bit while the MFT itself is about the same size. However, I'm pretty sure PerfectDisk has several tabs full of statistics. What do they show? You can also open the standard XP defrag program (but just choose Analyze, not Defragment) and then look at the report data and compare the before and after statistics, including the size of the MFT and the size of the MFT Zone.

While you're looking at the PerfectData statistics take a look at the metadata fragmentation, as this tends to increase considerably after running a KAV7 scan.

 

Yeah! There was a 32% MFT fragmentation after performing a full system scan! I think such a high intensity of I/O operation definitely decreases HDD life...

 

Well, offcourse we can all keep on searching on things to bash the several av companies. kaspersky is certainly a great name to bash at as well. I've been running Kaspersky for several years now and I really don't have had any problems yet. Even while I'm running betas allmost all of the time

 

as kaspersky grows, it opens itself to bashing.

maybe now, people can understand Nortons situation.

 

Exactly!! Good one, Chris

 

Others have also reported metadata fragmentation, but my observation is that in real life it appears to have no noticeable effect on performance. Also, portions of the MFT are held in both memory and prefetch, so the hard drive I/O might not be as much as you think.

I would be interested in knowing whether or not you notice any performance changes after allowing PerfectDisk to defrag the metadata. My guess, however, is that any differences will be so slight that they will be completely masked by the overhead of running a full-time virus scanner. Thus, if you attempt to run these types of comparison tests you may first want to temporarily shut down KAV and any other memory-resident file scanners that are running.

Incidentally, what you are doing is similar to some of early research I performed when I was trying to get to the bottom of the KAV-related chkdsk issues. I'm curious to see how your results compare to mine.

(Sjoeii, C.S.J, please take it easy, this is a technical discussion, not bashing. You are going off-topic.)

 

i disagree, i see many of these threads.

ive [heard] kaspersky does this to your computer,

i did this, i tried that on a [friends] machine

results were [shocking]

sure, it sounds like a technical question, but ive seen enough of these to know it was simply created to bash kaspersky, thats what i think.

regarding kaspersky and whatever problems people can surface, if people just use the software, there are no problems, and especially no noticable ones. People hatching-on to a problem with the software, creates threads like this. (almost automatically)

 

The apparent metadata fragmentation might explain the dramatic increase in the size of the MFT zone. Perhaps the ObjectIDs were inserted in an inefficient manner. (The MFT Zone can expand as needed up to a certain point, but it generally does not shrink). I'll have to go in with a hex editor, among other things, to see what's going on. This could get tricky!

 

Thanks for supporting my thread...
I like your understanding nature.

I tried it on my friends PC, because he uses the latest hardware; and my PC is a bit old one.

I've known one more thing....Kaspersky version 5 had the capability to delete every index entry during uninstallation...but it took very long....so the feature has been removed from Version 6 and onwards.

Here is a concrete proof of what Kaspersky does with NTFS volumes....take a look at this huuuuuuuuuuuuuuuuge thread:

http://forum.kaspersky.com/index.php?showtopic=14995&hl=CHKDSK

 

That post started over a year ago with what seemed like KAV6.

I have KAV7 installed and I don't notice any problems.

Is there any mention on that post that KAV7 has these issues?

 

Why did you install it on your friend's computer then?.. you've read everyone else talking about it, should have known about it or been aware of the possibilities. A great friend you are installing programs which you think will decrease HDD life

We were all supporting your thread... posting comments about your first post. hmmm, thanks for thanking us as well... sweet!

First I thought you were just misunderstood and didn't know too much about what you're talking about; (your "shocking" screenshots). Now it looks like you're just re-iterating what other people have said and seems like you're simply looking to damage its reputation and many people (including you) have seen these threads around for ages!

C.S.J... I totally agree with your posts here

 

Wooooooooops!!

I see lots of Kaspersky fans here......maybe may people are in "love" with Kaspersky.

Let your love reach the height of mountains.....and the depths of oceans.

No AV is perfect.....whether its Kaspersky, NOD32, Norton or Live One Care. Why not consider it as a bug thread.....right, so it will not hurt your precious warm feelings for Kaspersky. ....and one more thing I deeply apologize if I might have hurt your feelings because of my MFT findings.

And as far as I tested it on "my friend's PC"......it depends upon my mood on whose PC I'll test it.....BTW I tested it on his PC as he is going to buy a new one soon.....and it didn't matter to him. We both are best friends....so it has nothing to do with what I do with his PC...Okay....

Have a nice day,
Sunny.

 

Nothing to do with being fans... you wanted our opinions... we gave it

 

Some of the problems listed above are legitimate, its counter-productive to assume every thread discussing an issue with KIS is there just to bash them.

Having said that, when the OP asks for people to "post their comments"... Well, that's sure as heck asking for opinions

I've seen both sides of things on this one. My machine wont run KIS well - I have some of the issues that have been described. However, I'm sure as heck not going to bash them just because my PC doesn't run it well. Note my sig - My wife's PC runs it, and it runs just great there.

As has been stated here (and elsewhere) many, many times: No AV works well on every PC. Its a matter of finding which one has the right matrix of functionality, performance, and lack of problems for your particular machine.

 

Dont use Kaspersky on machines where you actually have any high value data like pics, xls etc. Its presents too high a risk. I dont. I use NIS2008 whom I trust, especially after the last 2 Kaspersky's screw ups in a week, one system lockup and one explorer.exe deletion.

Kaspersky ought to stop bashing Norton on their website and other marketing material and take a good long look in the mirror cause they are screwing up way too often.

 

and norton should stop posting stuff like kaspersky has no anti-spam component on their website (they fixed it recently)
this topic is really starting to transform in a kaspersky vs others bashing topic.

 

Again, as I just stated, that's on your machine. Saying you're having the problem is legitimate. Saying EVERYONE needs to stay away because your PC is having a problem is wrong.

There are many, many users that have zero problems with Kaspersky, and they far outweigh the number of users that do have problems.