NTFS arguably stands for "New Technology File System". However considering there is a debate about what the NT in Windows NT stands for, who knows.
???Explain VOLUMES???
Just as with FAT, drive/volume space is divided up into clusters. The cluster size is determined at the time the drive is formatted based on the size of the drive/volume. Data on a drive is addressed by multipling its Logical Cluster Number (LCN) by the cluster size of the volume.
| Disk Size | FAT16 Cluster Size | FAT32 Cluster Size | NTFS Cluster Size |
|---|---|---|---|
| 0MB - 127MB | 2KB | n/a | 512B |
| 128MB - 255MB | 4KB | n/a | 512B |
| 256MB - 511MB | 8KB | 4KB | 512B |
| 512MB - 1GB | 16KB | 4KB | 1KB |
| 1GB - 2GB | 32KB | 4KB | 2KB |
| 2GB - 8GB | 64KB | 4KB | 4KB |
| 8GB - 60GB | n/a | 8KB | 4KB |
| 60GB - 2TB | n/a | 16KB | 4KB |
| 2TB - ? | n/a | 32KB | 4KB |
The NT File System (NTFS) is based around a number of structures, which are all stored as regular (although of course hidden) files.
These structures allow for a great many features that are not available in FAT based file systems.
Each file in an NTFS has one or more 1KB file records (what is referred to as an i-node on Unix systems) stored in the Master File Table (MFT) . The file records are composed of attributes, which are accessed using a filename:attribute syntax. An attribute represents a piece of metadata about the file, for example the file name, the DOS 8.3 version of the file name or the time the file was created. Even the data contained in a file is represented by an attribute, although it is distinguished by being the only unnamed attribute. When the Dos DIR command lists the size of a file it only counts the size of the data attribute.
Attributes stored in the file record are called resident attributes, while those stored outside the file record are called non-resident attributes and are stored in extent files, which are located by pointers that are stored in the file record. Usually the data in a file is stored in an extent file, but if it is small enough NTFS will store it in the file record itself to speed access.
If one file record is too small for a file, due to too many attributes or the file becoming too fragmented and therefore requiring too many extent pointers to be stored, then overflow records are created within the MFT which are referred to by the base file record.
This serves to eliminate any arbitrary file size, allowing a file to grow to the limits of the available physical hard drive space available.
Each file record is identified by a 64-bit file reference, which takes the form of a 48-bit file number which is the record number within the MFT and a 16-bit sequence number which is incremented each time the MFT entry is re-used... blah blah consistency check.
A directory in an NTFS is simply an index of filenames and some related data, stored as a 4KB index buffer in the MFT. They take the form of B+ trees, indexed alphabetically by the name of the file to enable fast searches. Each entry/leaf in the tree contains information about a file's name, reference, size and the time the file was last updated. This duplicates some of the metadata stored within the MFT for the file itself, with the idea being to improve the speed of directory listings, since the system doesn't have to refer to the MFT entries for the files themselves.
An important feature of NTFS is journaling.
Before a change is made to the metadata of a file, a transaction is logged in the $LOGFILE. These transactions list the operations required to redo or undo the changes. Once the transaction has been logged, the file system can go ahead and perform the change. Once it has completed the actual change to the data, a commit record is added to the log to show that has been successful.
With this transaction log, it is possibly for a NTFS to quickly recover from a system failure by replaying the redo or undo transactions that do not have a commit record.
Also to keep the size of the $LOGFILE to a minimum, a checkpoint record is written to the log every so often (for example every five seconds). The system will ignore any records before the checkpoint record.
Please note that the journaling system only protects file system metadata, it does not actually protect the data stored within files.
2001: Version 3.1 (aka version 5.1) debuts in "Windows XP".
2000: Version 3.0 (aka version 5.0) debuts in "Windows 2000" introducing
encryption, quotas, sparse files and reparse points.
1996: Version 1.2 (aka version 4.0) debuts in "Windows NT 4".
1993: Version 1.0 (aka version ?3.1?) debuts in "Windows NT 3.1".
Operating System Concepts by Abraham Silberschatz, Baer Peter Galvin & Greg Gagne
Practical File System Design with the Be File System by Dominic Giampaolo
Inside Microsoft Windows 2000 by David A. Solomon & Mark E. Russinovich
NT's native file system - past, present, and future by Mark Russinovich
Inside Win2K NTFS, Part 1 by Mark Russinovich
Inside Win2K NTFS, Part 2 by Mark Russinovich
NTFS System Files