NTFS file system manages - NTFS index record and contents

In NTFS, the file directory is merely a filename index. NTFS organizes the filenames in a special way for fast access. When creating a directory, NTFS must index the filenames in it.

Root directory files index:

MFT record of a directory sorts filenames and sub-directories in it, and preserves in the index root attribute. However, for a big directory, filename actually is stored in index cache with a fixed organization filename of 4KB. The index cache is realized by the B+ tree data structure. The B+ tree is one of balance trees. For data in disk, the balance tree is an ideal sorting organization form, which reduces the times that searching an entry to the lowest. The root index attribute contains B+ tree's first? level (root sub-directory) and point to the index cache of the next level (major sub directories, possibly files).

The above chart only shows filenames and the index cache in the root index attribute. But each entry in index also includes information on file quotation that describes where description file is in MFT, file time and file size and so on. NTFS duplicates the time mark and file size information according to file MFT records. This technique need write renew information into two places, is troublesome. However, it still is a good way to fasten browsing directories. Because it may display each file's time and size on the condition of that the file system does not open any file in directory.

The index assignment attribute contains VCN to LCN mapping index cache, and bitmap attribute tracks that in index cache which VCNs are in use which are not. The above chart shows that each file entry occupies a VCN, but in fact many file entries are packed in the same cluster. Each index cache of 4KB size may contain 20 to 30 file entries.

In NTFS, directory is also a kind of file using file record to manage. Take an example of root directory, its file record are as the following chart:

From the above chart we may see, the root directory file record is also composed by the standard record head and the attribute, this directory has some attributes such as 0x10/0x30/0x40/0x50/0x90/0xa0/0xb0 and so on, which are respectively standard attribute, filename attribute, object ID attribute, security descriptor attribute, index root attribute, index assignment attribute, bitmap attribute.