New Technology File System (NTFS)

New Technology File System (NTFS) was introduced with the first version of Windows NT (3.1) and was a completely rewritten file system instead of an upgrade for FAT. NTFS introduced metadata for objects on the file system, allowing many more file system capabilities, such as security configuration and auditing information. A subset of the metadata for each file is stored in the master file table (MTF), which is used to quickly see free space on a volume, determine where to place new files, and cut down on fragmentation. Fragmentation occurs when a file is written to disk but not to a contiguous block of space. The file is scattered over separate areas of the disk. Why is this a problem? This fragmentation means that when the data is read, instead of one disk seek (a slow operation), many disk seeks are needed to read the data.

Numerous versions of NTFS exist. Windows XP, 2003, Vista, and Windows Server 2008 all run version 3.1. The version of an NTFS volume (seen in the third line of the following output) can be checked with the fsutil command:

C:\>fsutil fsinfo ntfsinfo c:\
NTFS Volume Serial Number : 	0x886a8ca26a8c8f1e
Version : 			3.1
Number Sectors : 		0x0000000009c3ffff
Total Clusters : 		0x0000000001387fff
Free Clusters : 		0x000000000104b337
Total Reserved : 		0x0000000000000040
Bytes Per Sector : 		512
Bytes Per Cluster : 		4096
Bytes Per FileRecord Segment : 	1024
Clusters Per FileRecord Segment : 0
Mft Valid Data Length : 	0x0000000003cb0000
Mft Start Lcn : 		0x00000000000c0000
Mft2 Start Lcn : 		0x00000000009c3fff
Mft Zone Start : 		0x00000000000c3ca0
Mft Zone End : 			0x00000000000cc820
RM Identifier: 			827C9D5C-FCD5-11DB-9486-E19769CE1781

The output shows version 3.1; the number of sectors, clusters, and so forth; the location of the start of the MFT; and the location of MFT2. The MFT2 is a mirror of the first 16 records of the MFT, which describe the metadata files themselves and are, therefore, the most vital. The MFT2 is stored at the end of the partition as a spare copy of the MFT in case of corruption. The MFT2 can be used to make your NTFS volume usable again.

(Search the Microsoft Knowledge Base for details on how.) These files are stored at the root of the C: drive as super hidden files $MFT and $MFTMirr. There is no way to view them within Windows itself. More of these super hidden files exist, such as the following:

• $AttrDef: A description of the metadata that can be used as attributes of data stored on the volume
• $BadClus: List of all clusters on the disk that are marked as bad
• $Bitmap: Map of the clusters on the volume, including which are currently free
• $Boot: Copy of the boot sector
• $LogFile: Transaction log file for the volume
• $Quota: Quota entries on the volume for NTFS 5.0 volumes
• $UpCase: Table to convert filenames to Unicode
• $Volume: Key information about the volume, such as the NTFS version, creation time, and volume name

The core features of NTFS are discussed later, but let's start off with some new NTFS features introduced with Windows Server 2008.