Skip to main content

NTFS File System

The Windows NT file system (NTFS) offers major improvements over FAT in the areas of performance, reliability and compatibility. It is designed to perform standard file operations such as read, write, and search rapidly on very large hard disks.

The first item of information on an NTFS volume is the Partition Boot Sector, which starts at sector 0 and can be up to 16 sectors long. This is followed by the Master File Table (MFT). The following figure shows the layout of an NTFS volume.

The NTFS file system includes security features required for file servers in a corporate environment and it supports data access control and ownership privileges. NTFS files and folders can have permissions assigned whether they are shared or not. NTFS is the only Microsoft file system that allows permissions to be assigned to individual files.

The NTFS design is simple but powerful. Everything on an NTS volume is a file and everything in a file is an attribute, eg: data attribute, security attribute, file name attribute, etc. Every allocated sector on an NTFS volume belongs to some file.

NTFS5, introduced with Windows 2000, incorporates a number of additional features including file encryption via the Encrypting File System (EFS) and disk quotas, which can be used to monitor and limit disk-space use.

Each file on an NTFS volume is represented by a record in the Master File Table (MFT). The first 16 records in the MFT are reserved for special information about the table itself, known as metadata. The first record describes the MFT itself and is followed by a MFT mirror record which duplicates the same information. The position of the mirror record varies depending on the version of NTFS.

The locations of the data segments for both the MFT and MFT mirror file are stored in the boot sector and a duplicate of the boot sector is held at the logical centre of the disk.

Next: Master File Table