Introduction to NTFS

1
Introduction to NTFS

• By Jian-Zhou Huang

2
Outline

• NTFS Architecture Overview
• NTFS system metadata files
• Master File Table
• NTFS directory
• NTFS file attribute
• NTFS files and data storage
• NTFS file naming
• NTFS reparse points
• Reference

3
NTFS Architecture Overview

• New Technology File System
• Large partition size 264 clusters minus 1
  cluster
• Weaknesses of the FAT file system
• performance, reliability, compatibility,
  security.
• Layout
• Every Structure in NTFS is a file, every file in
  an NTFS partition is a collection of attributes.

4
NTFS System Metadata Files
5
NTFS System Metadata Files (cont.)
6
Master File Table

• Information about every file and directory.
• Each record is equal to the cluster size of the
  volume, but with a minimum of 1024 bytes and a
  maximum of 4096 bytes.
• Resident non-resident.
• MFT zone
• 12.5 of the diskspace following the MFT

7
NTFS Directories

• Hierarchical model
• Only stores information about the directory
  itself.
• MFT record for directory
• Header
• Standard information attribute
• Create/modify/access time
• File name attribute
• Index root attribute
• Index allocation attribute
• Pointers to the rest of the index if the index is
  too large
• Security descriptor attribute
• Small directories stores in MFT, large
  directories broke into small ones.
• NTFS uses a special way of storing these index
  entries B-Tree
• database
• XFS B-tree, ReiserFS B-tree

8
NTFS File Attributes

• Chunks of information of various sorts
• All file and directory attribute are stored in
  one of two different ways, depending on their
  size.
• Resident Attributes attributes that require a
  relatively small amount of storage space are
  stored directly within the files primary MFT
  record itself.
• Non-Resident Attributes if an attribute requires
  more space than is available within the MFT
  record, the attribute is placed in a separate
  location. A pointer is placed within the MFT that
  leads to the location of the attribute.
• Extent
• External attribute

9
NTFS File Attributes (cont.)

• Attribute List attribute that describes other
  attributes.
• Bitmap cluster allocation bitmap
• Data file data
• Extended Attribute and Extended Attribute
  Information for OS/2 only
• File name name associated with a file or
  directory
• Index root attribute
• Index Allocation Attribute
• Security Descriptor ACLs
• Standard Information create/modify/access time
• Volume name/information/version

10
NTFS files and data storage

• Collection of attributes
• Header
• Standard information attribute
• File name attribute
• Data attribute
• Security descriptor attribute
• How to store a file?
• Store the entire file in MFT if possible
• If file is too large, the data attribute is made
  non-resident, the entry for the data attritube
  inf the MFT contains pointers to data runs which
  are blocks of data stored in contiguous sections
  of the volume, outside the MFT

11
NTFS files and data storage

• How to store a file? (cont.)
• If too many pointers, the list of data attribute
  pointer is itself made non-resident
• The data runs are where most file data in an NTFS
  volume is stored.

12
NTFS File Naming

• MS-DOS 8.3 standard
• Characteristics of regular file names
• Length up to 255
• Case mixed case, but references o filenames are
  case-insensitive.
• Characters any, except ? / \ lt gt
• Unicode storage 16-bit (ascii 7bits)

13
NTFS reparse points

• Create special file system functions and
  associate them with files or directories.
• The use of reparse points begins with
  applications. An application that wants to use
  the feature stores data specific to the
  application--which can be any sort of data at
  all--into a reparse point. The reparse point is
  tagged with an identifier specific to the
  application and stored with the file or
  directory. A special application-specific filter
  (a driver of sorts) is also associated with the
  reparse point tag type and made known to the file
  system. More than one application can store a
  reparse point with the same file or directory,
  each using a different tag. Microsoft themselves
  reserved several different tags for their own
  use.

14
NTFS reparse points

• When accessing the file, the file system notices
  the reparse point. It then "reparses" the
  original request for the file, by finding the
  appropriate filter associated with the
  application that stored the reparse point, and
  passing the reparse point data to that filter.
• The filter can then use the data in the reparse
  point to do whatever is appropriate based on the
  reparse point functionality intended by the
  application.
• Flexible how exactly the reparse point works is
  left up to the application.
• Transparent to the user this creates seamless
  extensions to file system functionality.

15
NTFS reparse points

• Examples
• Symbolic links
• Junction points similar to a symbolic link,
  redirects access from one directory to another.
• Volume mount points allow several different
  partitions to appear to the user as if they were
  all in one logical volume.
• Remote Storage Server (RSS) uses a set of rules
  to determine when to move infrequently files on
  an NTFS volume to archive storage (CD-RW or tape)

16
Reference

• XFS http//oss.sgi.com/projects/xfs/
• ReiserFS http//namesys.com/
• B-tree http//www.bluerwhite.org/btree/
• NTFS
• http//www.pcguide.com/ref/hdd/file/ntfs/index.htm
  
• http//www.ntfs.com/
• http//www.microsoft.com/resources/documentation/W
  indowsServ/2003/all/techref/en-us/W2K3TR_ntfs_intr
  o.asp
• Advanced filesystem implementors guide
  http//www-106.ibm.com/developerworks/library/l-fs
  .html