The Windows NT file system (NTFS) provides a combination of performance, reliability, and compatibility not found in the FAT file system. It is designed to quickly perform standard file operations such as read, write, and search — and even advanced operations such as file-system recovery — on very large hard disks.
The NTFS file system includes security features required for file servers and high-end personal computers in a corporate environment. The NTFS file system also supports data access control and ownership privileges that are important for the integrity of critical data. While folders shared on a Windows NT computer are assigned particular permissions, NTFS files and folders can have permissions assigned whether they are shared or not. NTFS is the only file system on Windows NT that allows you to assign permissions to individual files. However, when you move or copy a file from an NTFS to a FAT volume, permissions and other attributes unique to the NTFS file system are lost.
The NTFS file system has a simple, yet very powerful design. Basically, everything on the volume is a file and everything in a file is an attribute, from the data attribute, to the security attribute, to the file name attribute. Every sector on an NTFS volume that is allocated belongs to some file. Even the file system metadata (information that describes the file system itself) is part of a file.
Like the FAT file system, the NTFS file system uses clusters as the fundamental unit of disk allocation. In the NTFS file system, the default cluster size depends on the volume size. In Disk Administrator, you can specify a cluster size up to 4K. If you use the command prompt program format to format your NTFS volume, you can specify any cluster size shown in the next table.
The default cluster sizes for the NTFS file system are shown in the following table.
Partition size | Sectors per cluster | Cluster size | |
512 MB or less | 1 | 512 bytes | |
513 MB - 1024 MB (1GB) | 2 | 1K | |
1025 MB - 2048 MB (2GB) | 4 | 2K | |
2049 MB - 4096 MB (4GB) | 8 | 4K | |
4097 MB - 8192 MB (8GB) | 16 | 8K | |
8193 MB - 16,384 MB (16GB) | 32 | 16K | |
16,385 MB - 32,768 MB (32GB) | 64 | 32K | |
> 32, 768 MB | 128 | 64K | |
Note
You cannot use NTFS compression when your cluster size is greater than 4K. See "NTFS Compression" in Chapter 18, "Choosing a File System," for more information.
Formatting a volume with the NTFS file system results in the creation of several system files and the Master File Table (MFT), which contains information about all the files and folders on the NTFS volume.
The first information on an NTFS volume is the Partition Boot Sector, which starts at sector 0 and can be up to 16 sectors long. It consists of two structures:
The first file on an NTFS volume is the Master File Table (MFT). The next section of this chapter, "Master File Table and the NTFS System Files," contains more information.
The following figure illustrates the layout of an NTFS volume when formatting has finished.
Figure 17.8 NTFS volume layout
When you format an NTFS volume, the format program creates a set of files that contains the metadata used to implement the file system structure. The NTFS file system reserves the first 16 records in the MFT for the information about these metadata files. The NTFS file system uses approximately 1 MB for the metadata files and the first 16 records in the MFT. The next table describes these records.
Table 17.1 NTFS System Files
System file | Filename | MFT record | Purpose of the file | |
Master File Table | $Mft | 0 | A list of all contents of the NTFS volume. | |
Master File Table2 | $MftMirr | 1 | A mirror of the first three records of the MFT, used to guarantee access to the MFT in the case of a single-sector failure. | |
Log File | $LogFile | 2 | A list of transaction steps used for NTFS recoverability. | |
Volume | $Volume | 3 | The volume name, NTFS version, and other information about the volume. | |
Attribute Definition Table | $AttrDef | 4 | A table of attribute names, numbers, and descriptions. | |
Root Filename Index | $. | 5 | Root folder. | |
Cluster Bitmap | $Bitmap | 6 | A representation of the volume, showing which clusters are in use. | |
Partition Boot Sector | $Boot | 7 | The bootstrap for the volume, if this is a bootable volume. | |
Bad Cluster File | $BadClus | 8 | A location where all the bad clusters in the volume are located. | |
Quota Table | $Quota | 9 | Disk quota usage for each user on a volume. Currently unused. | |
Upcase Table | $Upcase | 10 | Used for converting lowercase characters to the matching Unicode uppercase characters. | |
11-15 | Reserved for future use. | |||
The first record of the MFT describes the MFT itself, followed by the MFT mirror record. If the first MFT record is corrupted, the NTFS file system reads the second record to find the MFT mirror file, which is a copy of the first three records of the MFT. The locations of the data segments for both the MFT and the MFT mirror file are recorded in the Partition Boot Sector. A duplicate of the Partition Boot Sector is located at the end of the volume (Windows NT version 4.0) or the logical center of the volume (Windows NT version 3.51 and earlier).
The third record of the MFT is the log file, which the operating system uses to restore consistency to the NTFS file system in the event of a system crash. The log file size depends upon the volume size, and can be as large as 4 MB. The log file is discussed in more detail in the section titled "NTFS Recoverability" in Chapter 18, "Choosing a File System."
The MFT contains records that describe each file on an NTFS volume. The NTFS file system allocates space for each of the MFT records based upon the cluster size. The attributes of a file are written to the allocated space in the MFT. Small files and folders, such as the file illustrated in Figure 17.9, can be contained entirely within the MFT record.
Figure 17.9 MFT Record for a Small File or Folder
Records for folders are contained within the MFT, just like records for files. All of the information for small folders reside entirely within the MFT record. Large folders are organized into B-trees, having records with pointers to external clusters containing folder entries that could not be contained within the MFT structure.
The NTFS file system views each file (or folder) as a set of file attributes. Elements such as the file's name, its security information, and even its data, are all file attributes. Each attribute is identified by an attribute type code and, optionally, an attribute name.
When a file's attributes can fit within the MFT file record, they are called resident attributes. For example, information such as filename and time stamp are always included in the MFT file record. When all of the information for a file is too large to fit in the MFT file record, some of its attributes are nonresident. The nonresident attributes are allocated one or more clusters of disk space elsewhere in the volume. NTFS creates the Attribute List attribute to describe the location of all of the attribute records.
Table 17.2 lists all of the file attributes currently defined by the NTFS file system. This list is extensible, meaning that other file attributes can be defined in the future.
Table 17.2 NTFS File Attribute Types
Attribute type | Description | |
Standard Information | Includes time stamps, link count, and so on. | |
Attribute List | Lists the location of all of the attribute records when they do not all fit in the MTF record. | |
Filename | A repeatable attribute for both long and short filenames. The long name of the file can be up to 255 Unicode characters. The short name is the MS-DOS- readable, eight-plus-three, case-insensitive name for this file. Additional names, or hard links, required by POSIX can also be included as additional filename attributes. | |
Security Descriptor | Shows information about who can access the file, who owns the file, and so on. | |
Data | Contains file data. NTFS allows multiple data attributes per file. Each file typically has one unnamed data attribute. In addition, a file can have one or more named data attributes, using a particular syntax. | |
Index Root | Used to implement folders. | |
Index Allocation | Used to implement folders. | |
Volume Information | Used only in the $Volume system file and includes information such as the version and name of the volume. | |
Bitmap | Provides a map representing records in use on the MFT or folder. | |
Extended Attribute Information | Used by file servers that are linked with OS/2 systems. This attribute type isn't used by Windows NT. | |
Extended Attributes | Used by file servers that are linked with OS/2 systems. This attribute type isn't used by Windows NT. | |
By default, Windows NT version 3.5 and later support MS-DOS-readable filenames on all NTFS volumes. To improve performance on volumes with many long, similar names, you can disable this feature by setting the NtfsDisable8dot3NameCreation parameter of the following Registry entry to 1:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem
Windows NT does not generate short (eight-plus-three) filenames for files created by POSIX-based applications on an NTFS volume. This means that MS-DOS-based and Windows-based applications cannot view these filenames if they are not valid eight-plus-three filenames. If you want to use files that are created by a POSIX application with MS-DOS-based or Windows-based applications, be sure to use standard MS-DOS eight-plus-three naming conventions.
For general information about long and short filenames for both FAT and NTFS volumes, see the section "Generating and Viewing Short Filenames," presented later in this chapter.