------------------------------------------------------------------------------
MC logo
Windows NTFS
[^] CSc 422
------------------------------------------------------------------------------
[Chapter 1][Chapter 2][Chapter 3][Chapter 4]
[File System Abstraction] [File System Structure] [File System Consistency] [File System Management and Optimization] [Flash Storage] [Examples] [Windows NTFS]
  1. Interface Properties
    1. Case-sensitive (like Unix).
    2. Names in Unicode.
    3. But the Win32 wrapper on top is not.
    4. Files are collections of several attributes.
      1. Each attribute value is a stream of bytes.
      2. An unnamed attribute is the file contents.
      3. Any number of additional streams, usually small, but may be any size.
      4. Allow recording of metadata and support information, such as image thumbs.
      5. Many aps are careless with alternate streams, and lose them.
    5. Hard links and soft links.
      1. Hard links only exposed in the Posix subsystem.
      2. Soft links only for administrators.
        I believe Windows shortcuts are above the FS.
    6. Note that Windows has a Posix mode in which more Unix-like features of NTFS are exposed.
  2. Volume layout

    MFT = Master File Table.
    1. Each volume is a series of blocks. Sizes vary with the size of the partition, but 4K is common.
    2. Blocks identified by offset from the start.
    3. Boot block contains pointer to the MFT, which may be anywhere.
  3. The Master File Table (MFT).
    1. MFT is a series of 1-K records.
    2. Each record describes one file.
      1. Multiple records may be used for large files.
      2. The first is the base record, and points to the others.
    3. The first 16 entries are special-use files.
      1. MFT itself.
      2. Mirror copy of MFT, for reliability.
      3. The log file (journal).
      4. Volume information: size, label, version, etc.
      5. Attributes definitions.
      6. Root directory.
      7. Bitmap of used blocks.
      8. Bootstrap loader (first code to run?).
      9. Bad block list. These should not be used ni a file.
      10. Security descriptors.
      11. Case mapping (not trivial for some languages).
      12. Directory containing extensions.
      12-15. Reserved for future use.
  4. MFT Entries
    1. Each MFT entry is a series of attributes, a code followed by a value.
    2. Attributes appear in fixed order; some may repeat. All need not be present.
      1. Value may be recorded immediately
      2. Value may be in the data section and location in the entry. nonresident attribute
    3. Attributes..
    4. Small directories are simple lists, but large directories are B+ trees.
    5. Reparse points are used for symbolic links and Unix-style mounts.
    6. Security information used to be in an attribute, was moved to the single security file to save space.
  5. Storage Allocation
    1. Blocks are allocated in groups whenever possible.
    2. Location of non-resident attributes are recorded as a series of runs..
      1. Header gives the number of first block, then first-past.
      2. Each run describes the location and number of blocks.
  6. Files can be marked for compression.
    1. NTFS attempts to compress each 16-block group.
    2. If it get smaller, store compressed.
    3. If it doesn't, store uncompressed.
  7. Directories can be marked for encryption.
    1. All files placed there are encrypted.
    2. NTFS doesn't perform the encryption, but uses call-backs.
    3. A registers the callbacks.