Windows 95/98

Windows Support Menu


File and Disk Administration

Disk Defragmenter

File location \windows
Inf file associated? No
How to launch – Start, Run, and type Defrag
or.. Start - Programs - Accessories - System Tools

The time taken to start applications has long been associated with "software bloat." Microsoft discovered that although several performance metrics improve with a faster CPU, application start time did not improve significantly. Moving to a faster chip improved application launch times only on the order of around 3 percent. Research shows that disk I/O is the bottleneck and that disk seeks are the true culprit—a sector read takes an average of 2ms on current hard drives, while seeks to another sector takes an average of 12ms.

The goal of Defrag is to minimize seeks while launching an application. The new feature in Defrag works better on 4K cluster drives than it does on 16K or 32K cluster partitions. This is because memory pages are faulted in 4K chunks. A greater-than-4K cluster size is going to restrict how well a disk can be rearranged to minimize seeks. With 32K clusters, the second page that needs to be read during an application launch does not often fall in the same cluster as the first page to be read. With 4K clusters, these pages can be placed adjacent to each other. With larger cluster sizes, the 2 pages are forced to be non-adjacent due to the other information contained in the >4K cluster size.

Over time, as programs read from and write to a hard disk, information stored on the disk can become fragmented - that is, files are stored in noncontiguous sectors. Fragmentation doesn't affect the validity of the information - the files are still complete when they are opened.

It takes much longer for the computer to read and write fragmented files than it does for unfragmented files. Previous versions of the Disk Defragmenter optimized a disk by grouping individual files together in contiguous clusters.

Windows 98 Disk Defragmenter

While grouping clusters together is a good method for reducing the time to open files, what happens if several files used to open a program are not grouped together? Using the previous example, it is possible that two files used to open the same program are at opposite ends of the disk. This still produces a slow startup time for an application.

The significant change to Disk Defragmenter relocates the executable and supporting files of Windows programs to a single contiguous area of your hard drive. This placing of a program and all of its supporting files into contiguous disk space can significantly increase the speed at which the application loads and executes.

Disk Defragmenter is also different in that it can literally fragment program files to improve start times.

Optimizing the Optimizer

In order to get the most out of the new capabilities in Defrag consider the following:

  • The file system must use 4K clusters for the biggest performance gains (available with FAT32).
  • The process requires Defrag to be run.
  • All improvement is RAM dependent—a shortage of RAM will cause the system write to the swap file, which can not be optimized, and will reintroduce disk seeks in addition to the actual writing that must take place.
  • For compatibility with older applications, files marked as both system and hidden are not moved (in the pool for cluster reordering / optimization).
  • Do not run other defragmentation programs.

Application Launch Optimization

Essentially there are three steps to disk optimization:

  • Generating a disk trace during the launch of an application
  • Generating a cluster from/to list for disk rearrangement to minimize seeks
  • Using the disk defragmenter to reorder the clusters on the disk

There is a small program—Taskmon.exe—that is constantly running and watches the Create_Process routine. When Create_Process is called, it checks registry settings for that process to determine whether or not it needs to log. If not, it does nothing. Otherwise, it loads Fiolog.vxd, which performs the disk trace.

Fiolog stops logging after 2.5 seconds of no loader activity for that process, and Fiolog.vxd is unloaded automatically after 10 minutes if it is not executing. This log is written to disk through file system lazy writing, to minimize the impact of system performance while the log is recorded. This generally happens shortly after the application has finished launching.

When Defrag is run, the from/to list is calculated based on the available Applog files and the list is fed to the defrag engine; then the defrag engine orders the clusters.

Relevant components

  • Clusalgo.dll - DLL used to generate the from/to list determining cluster ordering
  • CvtAplog.exe - 32-bit program that communicates with Clusalgo.dll
  • Defrag.exe - 16-bit disk defragmenter program that performs cluster movements
  • Fiolog.vxd - Driver that is used for getting the disk trace while an application launches
  • Taskmon.exe - Utility that monitors when apps are launched to determine when to start a disk trace
  • Tmapi.dll - DLL that produces Applog.dtc from *.lc? files, which Cvtaplog uses to reorder disk


The new Defragmenter uses a process called autologging, written in conjunction with Intel, which tracks the order of program files accessed. During defragmentation, the program files are stored in a manner to produce the best loading time for applications. The priority is not to store files contiguously, but in the way they are loaded when the application starts.

Autologging works like this: The first time you launch a program after installing Windows 98, a folder named \applog is created in the Windows directory. Taskmon.exe monitors applications that you launch and creates a log file for each application in the %windir%\applog folder identifying all the files used to start the application. The log file is created the second time you launch an application.

The format of the log file name is application.lgn, where application is the name of the application and n is the drive letter where the application resides. The table below outlines sample log file name formats:

Notepad.lgc Log file for Notepad,which is located on drive C.
Word.lgd Log file for Word, which is located on drive D.
Excel.lgd Log file for Microsoft Excel, which is located on drive D.
Msinfo32.lgc Log file for MSInfo, which is located on drive C.

A sample of the Notepad.lgn file is below. Notice that the file identifies each file used. This file can also be used in troubleshooting customer's programs that do not run properly. For example, if a program GPFs when launched but at one time ran properly, the log file for that program can indicate which files are being called. You might be able to use the new SFC utility to expand specific files in your attempt to solve the problem.

Based on the information contained in a log file, Defrag may actually fragment files based on sequence of loading all the support files for a program.

o c1542b70 ac00 "C:\WINDOWS\NOTEPAD.EXE"
R c1542b70 0 40
R c1542b70 80 f8
R c1542b70 80 1c0
r c1542b70 7000 1000
R c1542b70 6000 e00
o c14b7ca0 153f10 "C:\WINDOWS\SYSTEM\SHELL32.DLL"
R c14b7ca0 87000 a00
o c1550e80 2b550 "C:\WINDOWS\SYSTEM\COMDLG32.DLL"
R c1550e80 1d000 800
r c1542b70 1000 1000
r c1542b70 2000 1000
R c1542b70 5000 400
r c1542b70 8000 1000
R c1542b70 9000 c00
r c1542b70 3000 1000
o c1448440 1500 "C:\WINDOWS\FONTS\VGAFIX.FON"
R c1448440 1c0 1140
o c151dd70 32d "C:\SETUPS~1\1CHECK~1\SCANDISK.LOG"
R c151dd70 0 32d
C c151dd70
R c1542b70 4000 e00

The format of the Applog files is shown below. Microsoft does not support editing, rearranging, appending, rewriting or changing these files.

o -file_handle- -file_size- "-file_name-" // open file
R -file_handle- -offset- -length- // read file
C -file_handle- // close file

Other Support Files


Microsoft Defragmenter uses the file, Applog.ind, to track which files are used and how often they are run. This binary file will increase in size as each program is opened. When you run the Microsoft Defragmenter for the first time, the Optlog.txt file is created that is a text file version of the Applog.txt.


The Optlog.txt file is generated the first time you run the Microsoft Defragmenter. This text file identifies the order in which programs will be organized on your drive based on how many times you have run a program. This optimization log also tracks program names, number of times each program is used, last execution date and the program's path.

Not all programs are eligible for the new optimization procedure. The Optlog.txt file also identifies which files will not be optimized as well as explaining why. A sample of the file is shown below

Troubleshooting Defrag

In the event that the Disk Defragmenter stops responding, it is possible that a log file has become corrupted. To solve this problem, delete the Applog folder, restart Windows 98 and run Disk Defragmenter again. The customer will have to reopen any programs to re-log the files. The Applog folder is recreated on restarting the system.

Logging Performance Hit

The one issue with automatic logging is that on occasion—usually the first time a user launches an application—it is going to take longer than it otherwise does, by nature of the system-generated the disk trace for optimization. Testing has shown that in cases where a log is generated, it can increase application launch time by up to 7%. This increase is due to the system writing part of the log to disk during application launch; because the file system lazy writer buffer is full, or another event occurred that forces the file system to flush its buffers.

Cases where a disk log is not generated have shown that TaskMon is not a detriment to general system performance or application launch time.

Registry Settings

Registry information for Defrag is stored in


Registry Settings for TaskMon

The following shows the definitions for the registry keys that TaskMon uses:

  • HKLM\Software\Microsoft\Windows\CurrentVersion\TaskMon\ExcludeApps
  • String. The Exclude application list for applications that TaskMon doesn’t log. Each name is separated by a backslash (\). For example, "Winword\Excel\Notepad".
  • HKLM\Software\Microsoft\Windows\CurrentVersion\TaskMon\Stopper
  • String. The application name that will disable Task Monitor from being launched.

Other Disk Optimizers

Third party disk optimizers may report that the drive is heavily fragmented after Disk Defragmenter completes because Disk Defragmenter literally fragments program files to improve start times.