File Systems
When a volume is formatted with NTFS, an MFT file and other pieces of metadata are created. In NTFS, metadata are the files used to implement the file system structure. NTFS reserves the first 16 records of the MFT for metadata files (approximately 1 MB).
.gif "note-icon")
Note
The data segment locations for both the MFT and the backup MFT, $Mft and $MftMirr respectively, are recorded in the boot sector. If the first MFT record is corrupted, NTFS reads the second record to find the MFT mirror file. A duplicate of the NTFS boot sector is located at the end of the volume.
For more information about the NTFS boot sector, see Disk Concepts and Troubleshooting in this book.
Table 17.7 describes the metadata stored in the MFT.
Table 17.7 Metadata Stored in the Master File Table
System File |
File Name |
MFT Record |
Purpose of the File |
|---|---|---|---|
Master file table |
$Mft |
0 |
Contains one base file record for each file and folder on an NTFS volume. If the allocation information for a file or folder is too large to fit within a single record, other file records are allocated as well. |
Master file table 2 |
$MftMirr |
1 |
A duplicate image of the first four records of the MFT. This file guarantees access to the MFT in case of a single-sector failure. |
Log file |
$LogFile |
2 |
Contains a list of transaction steps used for NTFS recoverability. Log file size depends on the volume size and can be as large as 4 MB. It is used by Windows 2000 to restore consistency to NTFS after a system failure. For more information about the log file, see NTFS Recoverability earlier in this chapter. |
Volume |
$Volume |
3 |
Contains information about the volume, such as the volume label and the volume version. |
Attribute definitions |
$AttrDef |
4 |
A table of attribute names, numbers, and descriptions. |
Root file name index |
$ |
5 |
The root folder. |
Cluster bitmap |
$Bitmap |
6 |
A representation of the volume showing which clusters are in use. |
Boot sector |
$Boot |
7 |
Includes the BPB used to mount the volume and additional bootstrap loader code used if the volume is bootable. |
Bad cluster file |
$BadClus |
8 |
Contains bad clusters for the volume. |
Security file |
$Secure |
9 |
Contains unique security descriptors for all files within a volume. |
Upcase table |
$Upcase |
10 |
Converts lowercase characters to matching Unicode uppercase characters. |
NTFS extension file |
$Extend |
11 |
Used for various optional extensions such as quotas, reparse point data, and object identifiers. |
|
|
12–15 |
Reserved for future use. |
The remaining records of the MFT contain the file and folder records for each file and folder on the volume.
NTFS creates a file record for each file and a folder record for each folder created on an NTFS volume. The MFT includes a separate file record for the MFT itself. These file and folder records are stored on the MFT. NTFS allocates space for each MFT record based on the cluster size of the file. The attributes of the file are written to the allocated space in the MFT. Besides file attributes, each file record contains information about the position of the file record in the MFT.
Each file usually uses one file record. However, if a file has a large number of attributes or becomes highly fragmented, it might need more than one file record. If this is the case, the first record for the file, the base file record, stores the location of the other file records required by the file. Small files and folders (typically 1,500 bytes or smaller) are entirely contained within the file's MFT record. Figure 17.11 shows the contents of an MFT record for a small file or folder.
.gif "Cc938949.fncc06(en-us,TechNet.10).gif")
Figure 17.11 MFT Record for a Small File or Folder
Folder records contain index information. Small folder records reside entirely within the MFT structure, while large folders are organized into B-tree ** structures and have records with pointers to external clusters that contain folder entries that cannot be contained within the MFT structure.