NTFS

NTFS File System

The NTFS File System was created in the early 1990s. Microsoft wanted to createa high-quality, high performance, reliable and secure operating system. All the operating systems Microsoft had before Windows XP or Windows 2000 had the power or features needed for Microsoft to take on UNIX or other serious operating systems. One of the biggest weaknesses of MS-DOS and Windows 3.x was that they relied on the FAT file system. FAT provided few of the features needed for data storage and management in a

high-end, networked, corporate environment. To avoid crippling Windows NT, Microsoft had to create for it a new file system that was not based on FAT. The result was the New

Technology File System or NTFS. NTFS is definitely "new" from the standpoint that it is not based on the old FAT file system. NTFS was designed to meet a number of specific goals. In no particular order,

the most important of these are:

Reliability - NTFS implements specific features to allow important transactions to be completed as an integral whole, to avoid data loss, and to improve fault tolerance.

Security and Access Control - One of the most important advantages that users gain when choosing the NTFS file system over older file systems such as FAT, is greater control over who can perform what sorts of operations on various data within the file system.

Storage Efficiency - Again, at the time that NTFS was developed, most PCs used FAT16, which results in significant disk space due to slack. NTFS avoids this problem by using a very different method of allocating space to files than FAT does.

Breaking Size Barriers - Unlike FAT where maximum partition was up to 4GB,

NTFS allows larger partition size of 16 exabyte(1018).

Long File Name - NTFS allows file names upto 255 characters instead of 8.3

characters limitation of conventional FAT.

NTFS Disk Structure

Formatting a volume with the NTFS file system results in the creation of several system files and the Master File Table (MFT), which contains information about all the files and folders on the NTFS volume.

The first information on an NTFS volume is the Partition Boot Sector, which starts at sector 0 and can be up to 16 sectors long. The first file on an NTFS volume is the Master File Table (MFT).

The following figure (Figure 3) illustrates the layout of an NTFS volume when formatting has finished.

Fig: 3 Layout of an NTFS volume

Partition Boot Sector

The first piece of information on the partition is the boot sector. The partition boot

sector contains information, which the file system uses to access the volume. The boot

sector is up to 8KB in length. Partition Boot Sector consists of two different primary

structures:

BIOS parameter block - This has information about the partition and about the

volume name, size and location of metafiles.

Volume Boot Code - This is a small block of program code that instructs the

system on how to load the operating system.

Master File Table (MFT)

The NTFS file system contains a file called the master file table, or MFT. There is

at least one entry in the MFT for every file on an NTFS volume, including the MFT

itself. All information about a file, including its size, time and date stamps, permissions,

and data content, is stored either in MFT entries, or in space outside the MFT that is

described by MFT entries. As files are added to an NTFS volume, more entries are added

to the MFT and the MFT increases in size. When files are deleted from an NTFS volume,

their MFT entries are marked as free and may be reused. However, disk space that has

been allocated for these entries is not reallocated, and the size of the MFT does not

decrease. File attributes that do not require much space are stored in the MFT and they

are called resident attributes. When all of the information for a file is too large to fit in the

MFT file record, some of its attributes are non-resident. The non-resident attributes are

allocated one or more clusters of disk space elsewhere in the volume.

The master file table allocates a certain amount of space for each file record. The attributes of a file are written to the allocated space in the MFT. Small files and directories (typically 512 bytes or smaller), such as the file illustrated in next figure, can entirely be contained within the master file table record.

Metadata Stored in the Master File Table

System File	File Name	MFT Record	Purpose of the File
Master file table	$Mft	0	Contains one base file record for each file and folder on an NTFS volume. If the allocation information for a file or folder is too large to fit within a single record, other file records are allocated as well.
Master file table 2	$MftMirr	1	A duplicate image of the first four records of the MFT. This file guarantees access to the MFT in case of a single-sector failure.
Log file	$LogFile	2	Contains a list of transaction steps used for NTFS recoverability. Log file size depends on the volume size and can be as large as 4 MB. It is used by Windows NT/2000 to restore consistency to NTFS after a system failure.
Volume	$Volume	3	Contains information about the volume, such as the volume label and the volume version.
Attribute definitions	$AttrDef	4	A table of attribute names, numbers, and descriptions.
Root file name index	$	5	The root folder.
Cluster bitmap	$Bitmap	6	A representation of the volume showing which clusters are in use.
Boot sector	$Boot	7	Includes the BPB used to mount the volume and additional bootstrap loader code used if the volume is bootable.
Bad cluster file	$BadClus	8	Contains bad clusters for the volume.
Security file	$Secure	9	Contains unique security descriptors for all files within a volume.
Upcase table	$Upcase	10	Converts lowercase characters to matching Unicode uppercase characters.
NTFS extension file	$Extend	11	Used for various optional extensions such as quotas, reparse point data, and object identifiers.
		12-15	Reserved for future use.
Quota management file	$Quota	24	Contains user assigned quota limits on the volume space.
Object Id file	$ObjId	25	Contains file object IDs.
Reparse point file	$Reparse	26	This file contains information about files and folders on the volume include reparse point data

Metadata

NTFS stores both user data and internal management data, in the form of files.

The most important of these are a set of special system files, which are also called

metadata files. Metadata files contain internal information about the data in NTFS

Volume. These metadata files are automatically formed when the NTFS partition is

formatted, and is placed at the top of the partition. The MFT is actually one of these

metadata files, but it also contains descriptions of the other metadata files. In fact, the

first 16 records of the MFT are reserved for metadata files.

The table below provides the important information about the metadata files,

including their English names, file names, MFT record numbers and a brief description of

what each does:

Features of NTFS

NTFS multiple data streams

NTFS supports multiple data streams, where the stream name identifies a new

data attribute on the file. A handle can be opened to each data stream. A data stream,

then, is a unique set of file attributes. Streams have separate opportunistic locks, file

locks, and sizes, but common permissions.

NTFS Compressed Files

One of the most attractive features of NTFS is file-based compression. With

compression it is possible to store most files in a way that they take up less space on the

disk than they normally would. Most of the operating systems allow compression for the

entire disk volume, but NTFS allows almost all individual files and folders within the

NTFS partition to compress. The compression is handled by the operating system during

writes, and decompression is automatic whenever an application needs to read the file.

Performance when working with compressed files can be degraded compared to regular

files, because of the overhead required to compress and decompress the file on a regular

basis--it takes CPU time.

NTFS Security and Encryption

All the recourses in a system (e.g. disks, folders, and files) are treated as objects.

Any user who wants access to these objects should have the right to do so. This feature

cannot be overridden in any way, including attempt to view the volume through another

operating system. One of the security features is encryption.

The Encrypting File System (EFS) provides the core file encryption technology

used to store encrypted files on NTFS volumes and thus cannot be read by another NT

installation. In combination with a standard and very much safe password on the system

itself, this possibility provides the safety of files selected by the user. If an intruder tries

to access, open, read, copy, move or rename the encrypted file or folder, he/she receives

an “access denied” message.

NTFS Sparse File

A sparse file has an attribute that causes the I/O subsystem to allocate only

meaningful (nonzero) data. Nonzero data is allocated on disk, and non-meaningful data

(large strings of data composed of zeros) is not. When a sparse file is read, allocated data

is returned, as it was stored; non-allocated data is returned, by default, as zeros. NTFS

deallocates sparse data streams and only maintains other data as allocated. When a

program accesses a sparse file, the file system yields allocated data as actual data and

deallocated data as zeros.

Hard Links

A hard link is when the same file has two names. (e.g. adi.txt and adi1.txt), if a user deletes the first file (adi.txt), the second file (adi1.txt) remains. If he deletes the second file, the first one will remain. Although both the files are same, they are independent of each other.