Home | Files | Attributes | Concepts | Glossary

# Home - Layout

Previous Next

## Overview

A freshly formatted NTFS volume will look like:

B O O T | M F T | Free Space | More Meta data | Free Space

## Notes

### Other information

Everything is a file in NTFS. The index to these files is the Master File Table (MFT). The MFT lists the Boot Sector file ($Boot), located at the beginning of the disk. $Boot also lists where to find the MFT. The MFT also lists itself.

Located in the centre of the disk, we find some more Metadata files. The interesting ones are: $MFTMirr and $LogFile. The MFT Mirror is an exact copy of the first 4 records of the MFT. If the MFT is damaged, then the volume could be recovered by finding the mirror. The LogFile is journal of all the events waiting to be written to disk. If the machine crashes, then the LogFile is used to return the disk to a sensible state.

Hidden at the end of the volume, is a copy of the boot sector (cluster 0). The only Metadata file that makes reference to it is $Bitmap, and that only says that the cluster is in use.

### MFT Zone

To prevent the MFT becoming fragmented, Windows maintains a buffer around it. No new files will be created in this buffer region until the other disk space is used up. The buffer size is configurable and can be 12.5%, 25%, 37.5% or 50% of the disk. Each time the rest of the disk becomes full, the buffer size is halved.

        MFT Zone Reservation IS NOT STORED ON DISK
        MFT Zone (reserved space for MFT)
          1 = 12.5%
          2 = 25.0%
          3 = 37.5%
          4 = 50.0%
          Where is this stored on disk?
          volume?  mft?  boot?
          This is the 'system files' space at
          the beginning of the disk.
          NtfsMftZoneReservation

        link in to mft and bitmap

- cluster size 512 bytes, 1k, 2k, 4k, 8k, 16k, 32k, 64k
- very flexible, all the system files can be relocated, except $Boot
- supports streams named data streams
- attributes for a file can span several MFT records not necessarily contiguous or in order
- everything is an attribute, including the data
- filenames stored in Unicode
- journalling file system
- compression
- security
- hard links
- encryption
- LCNs vs VCNs

Copyright (C) Validate HTML Validate CSS