File Systems
Every allocated sector on an NTFS volume belongs to a file. Even the file system metadata is part of a file. NTFS views each file (or folder) as a set of file attributes. Elements such as the file name, its security information, and even its data, are all file attributes. Each attribute is identified by an attribute type code and, optionally, an attribute name.
When a file's attributes can fit within the MFT file record for that file, they are called resident attributes. Information such as file name and timestamp are always resident attributes. When the information for a file is too large to fit in its MFT file record, some of the file attributes are nonresident. Nonresident attributes are allocated one or more clusters of disk space and are stored as an alternate data stream in the volume. NTFS creates the Attribute List attribute to describe the location of all of the attribute records.
Table 17.8 lists the file attributes currently defined by NTFS.
Table 17.8 NTFS File Attribute Types
Attribute Type |
Description |
|---|---|
Standard Information |
Includes information such as timestamp and link count. |
Attribute List |
Lists the location of all attribute records that do not fit in the MFT record. |
File Name |
A repeatable attribute for both long and short file names. The long name of the file can be up to 255 Unicode characters. The short name is the 8.3, case-insensitive name for the file. Additional names, or hard links, required by POSIX can be included as additional file name attributes. |
Security Descriptor |
Describes who owns the file and who can access it. |
Data |
Contains file data. NTFS allows multiple data attributes per file. Each file typically has one unnamed data attribute. A file can also have one or more named data attributes, each using a particular syntax. |
Object ID |
A volume-unique file identifier. Used by the distributed link tracking service. Not all files have object identifiers. |
Logged Tool Stream |
Similar to a data stream, but operations are logged to the NTFS log file just like NTFS metadata changes. This is used by EFS. |
Reparse Point |
Used for volume mount points. They are also used by Installable File System (IFS) filter drivers to mark certain files as special to that driver. |
Index Root |
Used to implement folders and other indexes. |
Index Allocation |
Used to implement folders and other indexes. |
Bitmap |
Used to implement folders and other indexes. |
Volume Information |
Used only in the $Volume system file. Contains the volume version. |
Volume Name |
Used only in the $Volume system file. Contains the volume label. |