Defrag Analysis
Posted by: Richard Siddaway
One nasty fact of life we have to deal with as admins is disk fragmentation. We can discover how fragmented our disks are by Opening the Start Menu – Admin tools – Computer Management – Disk Management – pick a volume – click analyse. My fingers ache from all this clicking.
Our alternative is to use WMI.
The Win32_Volume class has a method called DefragAnalysis that allows us to this analysis – remember we can work on remote machines as well.
We can call it like this
Invoke-WmiMethod -Path ((Get-WmiObject -Class Win32_Volume -Filter "Name=’C:\\’").__PATH) -Name DefragAnalysis
which produces results like this. WMI needs to use \\ to represent the single \ in the volume name.
__GENUS : 2
__CLASS : __PARAMETERS
__SUPERCLASS :
__DYNASTY : __PARAMETERS
__RELPATH :
__PROPERTY_COUNT : 3
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
DefragAnalysis : System.Management.ManagementBaseObject
DefragRecommended : False
ReturnValue : 0
OK so we don’t need to defrag BUT we can’t see the results of the analysis – hmm not good. OK lets try plan B.
$dfa = Invoke-WmiMethod -Path ((Get-WmiObject -Class Win32_Volume -Filter "Name=’C:\\’").__PATH) -Name DefragAnalysis
PS> $dfa
Gives us this
__GENUS : 2
__CLASS : __PARAMETERS
__SUPERCLASS :
__DYNASTY : __PARAMETERS
__RELPATH :
__PROPERTY_COUNT : 3
__DERIVATION : {}
__SERVER :
__NAMESPACE :
__PATH :
DefragAnalysis : System.Management.ManagementBaseObject
DefragRecommended : False
ReturnValue : 0
but if we then wave our magic wands and do this
PS> $dfa.DefragAnalysis
__GENUS : 1
__CLASS : Win32_DefragAnalysis
__SUPERCLASS :
__DYNASTY : Win32_DefragAnalysis
__RELPATH : Win32_DefragAnalysis
__PROPERTY_COUNT : 27
__DERIVATION : {}
__SERVER : RSLAPTOP01
__NAMESPACE : ROOT\CIMV2
__PATH : \\RSLAPTOP01\ROOT\CIMV2:Win32_DefragAnalysis
AverageFileSize : 53
AverageFragmentsPerFile : 1.02
AverageFreeSpacePerExtent : 11710464
ClusterSize : 4096
ExcessFolderFragments : 58
FilePercentFragmentation : 0
FragmentedFolders : 23
FreeSpace : 114998321152
FreeSpacePercent : 66
FreeSpacePercentFragmentation : 35
LargestFreeSpaceExtent : 74555568128
MFTPercentInUse : 100
MFTRecordCount : 208383
PageFileSize : 0
TotalExcessFragments : 5742
TotalFiles : 203253
TotalFolders : 16620
TotalFragmentedFiles : 2988
TotalFreeSpaceExtents : 9802
TotalMFTFragments : 2
TotalMFTSize : 213385216
TotalPageFileFragments : 0
TotalPercentFragmentation : 0
TotalUnmovableFiles : 197
UsedSpace : 56800366592
VolumeName :
VolumeSize : 171798687744
Which is good but we can improve the display a bit
$dfa.DefragAnalysis | Format-List AverageFileSize, AverageFragmentsPerFile, AverageFreeSpacePerExtent, ClusterSize,ExcessFolderFragments, FilePercentFragmentation, FragmentedFolders, FreeSpace, FreeSpacePercent, FreeSpacePercentFragmentation, LargestFreeSpaceExtent, MFTPercentInUse, MFTRecordCount, PageFileSize, TotalExcessFragments, TotalFiles, TotalFolders, TotalFragmentedFiles, TotalFreeSpaceExtents, TotalMFTFragments, TotalMFTSize, TotalPageFileFragments, TotalPercentFragmentation, TotalUnmovableFiles, UsedSpace, VolumeName, VolumeSize
Will give a good display. If required we could use the calculated fields we have seen previously to perform even more more formatting
On Windows Vista\Windows 2008 and above we have to run PowerShell with elevated privileges for this to work. We will get a return code of 11 if running PowerShell without these privileges.




