I am new to the topic of the MFT in NTFS. I have read a number of documents about it but so far I haven't found explicit statements on some questions that immediately come to mind.
If you have a Windows desktop and read files from a removable medium which is NTFS-formatted (say, a USB stick or removable HD), then I assume that the timeline information (access dates etc) gets written to the MFT on the removable medium. So, if the USB or HD is removed, the timeline disappears. Does the host OS (the Windows desktop) retain any information separately about which files were opened and on which removable volume?
Articles on MFT say that initially, no MFT record is deleted when a file is deleted. So the MFT grows and grows. There is mention that some of the records of deleted files will eventually get overwritten as the disk fills up: but I can't find details about the algorithm used. At the same time there is the implication that there is no upper limit on MFT size, and that it can crash thinly-resourced systems. This sounds rather extreme. So, is there any way of trimming the dead wood (eg, a utility which will permanently delete the unwanted entries)? I read that the OS won't allow the MFT size to be changed on an active system, but perhaps a utility could run before the full system loads, as CHKDSK does (I think)?
Can a hard upper limit on MFT size be set (short of completely filling the HD)?