NTFS file system manages - NTFS file system metafiles

In NTFS file system; the files are also assigned according to clusters. A cluster must be the integral multiple of physical sector, moreover always integer powers of 2. NTFS file system does not care for about sector, nor sector size (for example not 512 bytes), but cluster size is assigned automatically according to the volume size by format program when formatting.

By master file table (MFT) to determine the file storage location in disk. The master file table is a corresponding database composed of series of file records-each file has a record in a volume (large files may have many corresponding records). The first file record is called basic file record with some information of other extended file records. Master file table itself also has its own file record.

Each file in NTFS volume has a unique identifier of 64 bit called file quotation number/File Reference Number. The file quotation number consists of two parts: file number and file order. The file number is 48 bit, corresponding to the position of MFT. The file order increases as repeating usage of file records, which is designed for internal consistency examination of NTFS.

NTFS locates clusters with logic cluster number (LCN) and virtual cluster number (VCN). LCN is the simple number for all clusters from beginning to end. With volume factors multiplying LCN, we can get physical byte offset in volume, thus obtaining physics disk address. VCN is the number for specified files from beginning to end, which is convenient for quoting the data of files. VCN can be mapped as LCN, but it does not request physical continuity.

Directory of NTFS is only a simple filename and index of the file quotation number. If the directory attribute list is smaller than the length of a record, then all information of this directory are saved in the main file table records, as to that bigger than record directory, it was managed with B+ tree.

In the basic file recording of master file table, it has an indicator aiming at the index cache which is not usually used, including sub-directory and file exterior cluster, but B+ tree structure is convenient for the file and the sub-directory in large-scale table of contents.

In NTFS, all data saved in the volume are contained in file, including file construction that is used to locate and obtain files, boot program and bitmap files that record volume size and service condition. This manifests the principle of NTFS: all things in disk are called files. Saving everything in files makes the file system very easy to locate and maintain data. The file fixes its storage location in disk with master file table.

The relationship of NTFS' each region

Size of file records in MFT is generally fixed. No matter the size of a cluster, the records all are 1KB, which equals to inode (i node) in Linux. File records in MFT file record array are physically continual, number from 0. Therefore NTFS can be considered as the pre-definition file system. MFT is only used by system's organization and framework file system. This is called Metadata in NTFS. Thereinto the basic first 16 records are extremely important Metadata files used by operating system. These Metadata file names all start with "$", the hidden files, cannot be listed in Windows NT/2000/ XP/2003 by dir order as ordinary files. But Microsoft Corporation provides an OEM TOOL called NFI.EXE, which may demonstrates the important Metadata files of NTFS master file table. The result is as following:

These Metadata files are necessary for system driver management volume; Windows NT/2000/ XP/2003 assigning a drive letter to each partition does not mean that this partition contains distinguishable file system for Windows NT/2000/XP/2003. If MBR is damaged, then this partition in Windows NT/2000/XP/2003 is unable to read. In order to make this partition be distinguished in Windows NT/2000/Under XP/2003, first we must to establish file system form i.e. MFT, which can be distinguished by Windows NT/2000/XP/2003. This process can be completed through high-level format of this partition. Windows locates the file storage location in disk by cluster number. In FAT file system, the indicator related with cluster number is contained in FAT, while in NTFS, it is contained in $MFT and the $MFTMirr file

Number	Metadata	Function
0	$MFT	MFT itself
1	$MFTMirr	Part image of MFT
2	$LogFile	Log file
3	$Volume	volume file
4	$AttrDef	Attribute definitionlist
5	$Root	root directory
6	$Bitmap	Bitmap file
7	$Boot	boot file
8	$BadClus	Bad cluster file
9	$Secure	Secure file
10	$UpCase	Capitalized file
11	$Extended metadatadirectory	Extended Metadatadirectory
12	$Extend\$Reparse	Reparse Points file
13	$Extend\$UsnJrnl	Log changing file
14	$Extend\$Quota	Quota management file
15	$Extend\$ObjId	Object ID file
16~23		Reserved
24~		User files anddirectories

Each MFT recording corresponds with different file. If a file has many attributes or be dispersed into several fragments, it is probable that it needs more file records. By now, the first record that stores its file record position is called "base file record".

Records in $MFT

	Metadata	Function
1st record	$MFT	$MFT itself
2nd record	$MFTMirr	For the importance of $MFTfile, to insure reliability of file systemstructure, system sets a Mirror file ($MFTMirr)inthe beginning of its record, that is 2nd record ofMFT.
3rd record	$LogFile	Log file. It isdesigned for the recoverability and security of NTFS.It records all the operations that affect NTFSvolume construction.
4th record	$Volume	Volume file. Itcontains volume label, NTFS version and a mark bitthat labels whether the disk is spoiled. Hereby NTFScan decide whether it needs Chkdsk to recover.
5th record	$AttrDef	Attribute definitiontable. It saves all file attributes that volumesupports, and indicates whether they can be indexedor recovered.
6th record	$Root	It saves index of allfiles and directories in root directory. Aftervisiting the first file, NTFS can retain MFT quoteof the file. After that it can visit directly.
7th record	$Bitmap	Bitmap file. Serviceconditions of clusters in NTFS are all saved in it;thereinto each bit represents a cluster in volume,indicating it is free or assigned.
8th record	$Boot	Boot file. It isanother important file system, storing boot programcode of Windows NT/2000/XP/2003. It must be locatedin specified place of disk to boot system.
9th record	$BadClus	Bad cluster file. Itrecords all destroyed cluster numbers, preventingsystem assigning and using it.
10th record	$Secure	Secure file. It savessecurity descriptor database of the whole volume.NTFS file and directory have their own securitydescriptors. To save space, NTFS saves the samesecurity descriptors of them in the public file.
11th record	$UpCase	Upper case file.
12th record	$Extended metadatadirectory	Extended Metadatadirectory
13th record	$Extend\$Reparse	Reparse Points file
14th record	$Extend\$UsnJrnl	Log changing file
15th record	$Extend\$Quota	Quota management file
16th record	$Extend\$ObjId	Object ID file
17~24th record		Reserved for furtherextend

Space allocation of MFT:

NTFS volume divides disk into two major parts, in which about 12% assigned to MFT to meet unceasing growth of the file quantity. In order to maintain the continuity of Metadata in MFT, MFT enjoys the sole right to this 12% space, the rest 88% space is assigned to save files. The leavings disk space contains all physical leaving space - including that of MFT. In another word, when files use up the storage space, Windows operating system would reduce the MFT space simply, and assign it to the file storage. When there is leavings space, it would be divided again to MFT. Although the system tries its best to maintain the dedication of MFT space, sometimes, it has to sacrifice. Sometimes although the MFT fragments are unendurable, it is unable to prevent its occurrence actually.

The process of NTFS's visiting the volume through MFT questionnaire is as following:
First, when NTFS visits a volume, it must be "loading" this volume: NTFS will check the boot file (file defined by $Boot Metadata file), and find physical disk address of MFT.
Then, it can obtain mapping information from VCN to LCN in data attribute of file records, and save it in memory. This mapping information locates where MFT runs in disk.
The next, NTFS opens MFT records of several Metadata files, and then opens these files. If it is necessary, NTFS will start to execute file system recovery operation. After opening the leavings Metadata file in NTFS, users can visit this volume.