NTFS File System

The Windows NT file system (NTFS) offers major improvements over FAT in the areas of performance, reliability and compatibility.  It is designed to perform standard file operations such as read, write, and search rapidly on very large hard disks.

The first item of information on an NTFS volume is the Partition Boot Sector, which starts at sector 0 and can be up to 16 sectors long. This is followed by the Master File Table (MFT). The following figure shows the layout of an NTFS volume:

The NTFS file system includes security features required for file servers in a corporate environment and it supports data access control and ownership privileges. NTFS files and folders can have permissions assigned whether they are shared or not. NTFS is the only Microsoft file system that allows permissions to be assigned to individual files.

The NTFS design is simple but powerful. Everything on an NTS volume is a file and everything in a file is an attribute, eg: data attribute, security attribute, file name attribute, etc.  Every allocated sector on an NTFS volume belongs to some file.

NTFS5, introduced with Windows 2000, incorporates a number of additional features including file encryption via the Encrypting File System (EFS) and disk quotas, which can be used to monitor and limit disk-space use.

Each file on an NTFS volume is represented by a record in the Master File Table (MFT). The first 16 records in the MFT are reserved for special information about the table itself, known as metadata. The first record describes the MFT itself and is followed by a MFT mirror record which duplicates the same information. The position of the mirror record varies depending on the version of NTFS.

The locations of the data segments for both the MFT and MFT mirror file are stored in the boot sector and a duplicate of the boot sector is held at the logical centre of the disk.

The MFT allocates a certain amount of space for each file record. This is used to store the attributes of the file. Small files and directories (1500 bytes or less) can be stored entirely within the MFT record.

NTFS file access is very fast in comparison to FAT. FAT uses a file allocation table to list the names and addresses of each file and the FAT directory entries contain an index to the file allocation table. If you want to access a file, FAT reads the file allocation table to ensure that it exists, then retrieves the file by searching the chain of allocation units assigned it. With NTFS, as soon as you look up the file, it’s available for use.

Directory records are stored within the master file table just like file records, but instead of data, they contain index information. Small directory records can be stored entirely within the MFT structure. Large directories are organized into trees consisting of records with pointers to external clusters containing directory entries.

A fuller description of How NTFS Works can be found at:

http://technet2.microsoft.com/WindowsServer/en/Library/8cc5891d-bf8e-4164-862d-dac5418c59481033.mspx

Next: Input/Output