NTFS Basics

The Windows NT file system (NTFS) provides a combination of performance, reliability, and compatibility not found in the FAT file system.

It is designed to quickly perform standard file operations such as read, write, and search — and even advanced operations such as file-system recovery — on very large hard disks.

Formatting a volume with the NTFS file system results in the creation of several system (metadata) files such as $MFT — Master File Table, $Bitmap, $LogFile and others, which contains information about all the files and folders on the NTFS volume.

The first information on an NTFS volume is the Partition Boot Sector ($Boot metadata file), which starts at sector 0 and can be up to 16 sectors long. This file describes the basic NTFS volume information and a location of the main metadata file — $MFT.

The following figure illustrates the layout of an NTFS volume when formatting has finished.

Formatted NTFS Volume

Formatted NTFS Volume

This chapter covers information about NTFS. Topics covered are listed below:

The NTFS file system includes security features required for file servers and high-end personal computers in a corporate environment.

The NTFS file system also supports data access control and ownership privileges that are important for the integrity of critical data. While folders shared on a Windows NT computer are assigned particular permissions, NTFS files and folders can have permissions assigned whether they are shared or not.

NTFS is the only file system on Windows NT that allows you to assign permissions to individual files.

The NTFS file system has a simple, yet very powerful design. Basically, everything on the volume is a file and everything in a file is an attribute, from the data attribute, to the security attribute, to the file name attribute. Every sector on an NTFS volume that is allocated belongs to some file. Even the file system metadata (information that describes the file system itself) is part of a file.

What's New in NTFS ver. 3.0 (introduced in Windows 2000)

Encryption The Encrypting File System (EFS) provides the core file encryption technology used to store encrypted files on NTFS volumes. EFS keeps files safe from intruders who might gain unauthorized physical access to sensitive, stored data (for example, by stealing a portable computer or external disk drive).

Disk Quotas Windows 2000 supports disk quotas for NTFS volumes. You can use disk quotas to monitor and limit disk-space use.

Reparse Points Reparse points are new file system objects in NTFS that can be applied to NTFS files or folders. A file or folder that contains a reparse point acquires additional behavior not present in the underlying file system. Reparse points are used by many of the new storage features in Windows 2000, including volume mount points.

Volume Mount Points Volume mount points are new to NTFS. Based on reparse points, volume mount points allow administrators to graft access to the root of one local volume onto the folder structure of another local volume.

Sparse Files Sparse files allow programs to create very large files but consume disk space only as needed.

Distributed Link Tracking NTFS provides a link-tracking service that maintains the integrity of shortcuts to files as well as OLE links within compound documents.

What's New in NTFS ver. 3.1 (introduced in Windows 2000)

Spare MFT record number added in MFT record for recovery purposes.

For more detailed information see resource kits on Microsoft's web site
http://www.microsoft.com/windows/reskits/webresources/default.asp