NT file system

The main characteristics of the NT file system are described by the boot record. The file system starts at the location of the boot sector and ends at this sector plus the sectors in the volume field. The volume is organized in clusters of multiples of 512 bytes. The start of the volume is associated with cluster number 0.

Any addressing within the file system is done using the cluster number instead of a sector number. Any kind of file information is contained in a structure called Master file table (MFT). The start of the MFT is indicated by the boot sector's field 1st MFT cluster. The MFT is a database containing information about every file or directory on the volume. The default size of an entry in the MFT is 1024 bytes. Each entry describes a file or directory on the volume (including the MFT itself) and has a record number that equals the byte position inside the MFT divided by 1024. Each MFT entry consists of a header and a list of attributes. The attributes describe file names, time stamps, file sizes, data allocations and more. In the file entry details view you can inspect any attribute of any MFT entry. Most important attributes are:

• $10 Standard information: contains time stamps and DOS attributes,
• $30 File name: contains the file's name for different name spaces (usually NT's native Unicode file name and DOS compatible DOS file name),
• $80 Data: if the entry represents a file, this attribute contains the file's data.
• $90 Index root: if the entry is a directory, this attribute describes the root of a binary tree in which the directory entries are located,
• $A0 Index allocation: if the entry is a directory, this attribute contains a list of file names.

If the attributes are too large to fit into 1024 bytes, some of them will be non-resident, meaning the value part the specific attribute will be found outside of the entry. In this case the outside data allocation will be described by a run list. A run list is a list of clusters used. When in the file entry details view you can inspect a non-resident attribute's data by following a link.

Introduction    Menu    Main screen    Glossary