- Interface Properties
- Case-sensitive (like Unix).
- Names in Unicode.
- But the Win32 wrapper on top is not.
- Files are collections of several attributes.
- Each attribute value is a stream of bytes.
- An unnamed attribute is the file contents.
- Any number of additional streams, usually small, but may be any size.
- Allow recording of metadata and support information, such as
- Many aps are careless with alternate streams, and lose them.
- Hard links and soft links.
- Hard links only exposed in the Posix subsystem.
- Soft links only for administrators.
I believe Windows shortcuts are above the FS.
- Note that Windows has a Posix mode in which more Unix-like features
of NTFS are exposed.
- Volume layout
MFT = Master File Table.
- Each volume is a series of blocks. Sizes vary with the size of
the partition, but 4K is common.
- Blocks identified by offset from the start.
- Boot block contains pointer to the MFT, which may be anywhere.
- The Master File Table (MFT).
- MFT is a series of 1-K records.
- Each record describes one file.
- Multiple records may be used for large files.
- The first is the base record, and points to the others.
- The first 16 entries are special-use files.
12-15. Reserved for future use.
- MFT itself.
- Mirror copy of MFT, for reliability.
- The log file (journal).
- Volume information: size, label, version, etc.
- Attributes definitions.
- Root directory.
- Bitmap of used blocks.
- Bootstrap loader (first code to run?).
- Bad block list. These should not be used ni a file.
- Security descriptors.
- Case mapping (not trivial for some languages).
- Directory containing extensions.
- MFT Entries
- Each MFT entry is a series of attributes,
a code followed by a value.
- Attributes appear in fixed order; some may repeat. All need not
- Value may be recorded immediately
- Value may be in the data section and location in the entry.
- Small directories are simple lists, but large directories are
- Reparse points are used for symbolic links and Unix-style mounts.
- Security information used to be in an attribute, was moved to the
single security file to save space.
- Storage Allocation
- Blocks are allocated in groups whenever possible.
- Location of non-resident attributes are recorded as a series of runs..
- Header gives the number of first block, then first-past.
- Each run describes the location and number of blocks.
- Files can be marked for compression.
- NTFS attempts to compress each 16-block group.
- If it get smaller, store compressed.
- If it doesn't, store uncompressed.
- Directories can be marked for encryption.
- All files placed there are encrypted.
- NTFS doesn't perform the encryption, but uses call-backs.
- A registers the callbacks.