NTFS

NTFS or New Technology File System is the standard file system of Windows NT and its descendants Windows 2000, Windows XP and Windows Server 2003. Windows version 95, 98, 98SE and ME, cannot natively read NTFS filesystems, although utilities do exist for this purpose.

NTFS replaced Microsoft's previous FAT filesystem, used in MS-DOS and early versions of Windows. NTFS has several improvements over FAT such as improved support for metadata and the use of advanced data structures to improve performance, reliability and disk space utilization plus additional extensions such as security access control lists and file system journaling.

NTFS has three versions: v1.2 found in NT 3.51 and NT 4, v3.0 found in Windows 2000 and v3.1 found in Windows XP and Windows Server 2003. These versions are sometimes referred to as v4.0, v5.0 and v5.1, after the version of Windows they ship with. Newer versions added extra features: Windows 2000 introduced quotas.

Contents

1 Internals 2 Interoperability 3 Features 4 Notes 5 References 6 See also 7 External links

Internals

In NTFS, everything that has anything to do with a file (file name, creation date, access permissions and even contents) is stored as metadata. This elegant, albeit abstract approach allowed easy addition of filesystem features during the course of Windows NT's development - an interesting example is the addition of fields for indexing used by the Active Directory software. File Names are stored in Unicode (UCS-2.)

Internally, NTFS uses B-trees in order to store the file system data; although complex to implement, this allows fast access times and decreases fragmentation. A file system journal is used in order to guarantee the integrity of the file system itself (but not of each individual file). Systems using NTFS are known to have improved reliability, a particularly important requirement considering the unstable nature of the older versions of Windows NT.

Details on the implementation's internals are closed, so third-party vendors have a difficult time providing tools to handle NTFS. Currently, the Linux kernel includes a module which makes it possible to read NTFS partitions; however the general complexity of the filesystem and inadequate developer resources, both in time and persons, have delayed the addition of full write support. As a workaround, a project called Captive NTFS [1] (http://www.jankratochvil.net/project/captive/) allows access to the NTFS by providing the operating system with an interface to the ntfs.sys driver which already exists on most NTFS partitions (and on all Windows NT installations). However, this provides slow read/write support and a few people have reported data loss [2] (http://www.jankratochvil.net/pipermail/captive-list/2004-February/). Captive NTFS also limits the maximum writable file size on an NTFS partition.

Interoperability

Microsoft currently provides a tool to convert the FAT32 format to NTFS but not the other way around. PartitionMagic by Symantec and the open source NTFSResize utility (http://mlf.linux.rulez.org/mlf/ezaz/ntfsresize.html) are both capable of resizing NTFS partitions.

For historical reasons, the versions of Windows that do not support NTFS all keep time internally as local zone time, and therefore so do all file systems other than NTFS that are supported by current versions of Windows. However, Windows NT and its descendants keep internal timestamps as GMT/UTC and make the appropriate conversions for display purposes. Therefore, NTFS timestamps are in GMT/UTC. This means that when files are copied or moved between NTFS and non-NTFS partitions, the OS needs to convert timestamps on the fly. But if some files are moved when summer or "daylight" local time is in effect, and other files are moved when winter or "standard" local time is in effect, there can be some ambiguities in the conversions. As a result, especially shortly after one of the days on which local zone time changes, users may observe that some files have timestamps that are incorrect by one hour.

Features

NTFS 5.0 was the third version of NTFS to be introduced to the Windows world by Microsoft. It included several new features: quotas, sparse file support, reparse points, distributed link tracking and the Encrypting File System (EFS).

Quotas 

File system quotas were introduced in NTFS 5. They allow the administrator of a computer that runs a version of Windows that supports NTFS to set a threshold of disk space that users may utilise. It also allows administrators to keep a track of how much disk space each user is using. An administrator may specify a certain level of disk space that a user may use before they receive a warning, and then deny access to the user once they hit their upper limit of space. Disk quotas do not take into account NTFS's transparent file-compression, should this be enabled. Applications that query the amount of free space will also see the amount of free space left to the user who has a quota applied to them.

Sparse files 

These are files which are mostly filled with zeros. This is called a sparse data set, and most things that generate such data sets are scientific applications, and they can generate very large sparse data sets. Because of this, Microsoft has implemented support for sparse files by only allocating disk space for regions that do not contain blocks of zero data. An application that reads a sparse file reads it in the normal manner with the file system calculating what data should be returned based upon the file offset. As for compressed files, the actual size of sparse files are not taken into account when determining quota limits. Template:Ref

Reparse points 

NTFS 5.0 introduced reparse points. These are used by associating a reparse tag in the user space attribute of a file or directory. When the object manager (see executive) parses a file system name lookup and encounters a reparse attribute, it knows to reparse the name lookup, passing the user controlled reparse data to every file system file system filter driver that is loaded into Windows 2000. Each filter driver examines the reparse data to see if it is associated with that reparse point, and if that filter driver determines a match then it intercepts the file system call and executes its special functionality. Reparse points are used to implement Volume Mount Points, Directory Junctions, Hierarchical Storage Management, Native Structured Storage and Single Instance Storage:

Volume mount points 

these are similar to Unix mount points, where a file system can be attached as a directory that exists in a regular file system. In NTFS, every file and directory must exist in a drive (for instance, C: or D:), however a volume point will allow one or many disk volumes to exist on a single drive.

Directory Junctions 

these are similar to Volume Mount Points, however instead of referencing volumes they reference other directories in the file system. For instance, the directory C:\exampledir with a directory junction attribute that contains a link to D:\linkeddir will automatically refer to the directory D:\linkeddir when it is accessed by a user-mode application. They are the equivalent of a Unix symbolic link, though in Unix a symbolic link can be applied on files as well as on directories Template:Ref.

Hierarchical Storage Management (HSS) 

HSS is a means of transferring files that are not used for some period of time to less expensive storage media. When the file is next accessed the reparse point on that file determines that it is needed and retrieves it from storage.

Native Structured Storage (NSS) 

NSS was an ActiveX document storage technology that has since been discontinued by Microsoft. It allowed ActiveX documents to be stored in the same multi-stream format that ActiveX uses internally. An NSS file system filter was loaded and used to process the multiple streams transparently to the application, and when the file was transferred to a non-NTFS formatted disk volume it would also transfer the multiple streams into a single stream Template:Ref.

Single Instance Storage (SIS) 

When there are several directories that have different but similar files, some of these files may have identical content. SIS allows identical files to be merged to one file and create references to that merged file. SIS consists of a file system filter that manages copies, modification and merges to files; and a user space service (or groveler) that searches for files that are identical and need merging. SIS was mainly desiged for remote installation servers as these may have multiple installation images that contain many identical files Template:Ref.

Encrypting File System (EFS) 

EFS introduced strong encryption into the Windows file world. It allowed any folder or drive on an NTFS volume to be encrypted transparently to the end user. EFS works in conjunction with the EFS service, Microsoft's CryptoAPI and the EFS File System Run-Time Library (FSRTL). As of February 2004, its encryption has not been compromised.

EFS works by encrypting a file with a bulk symmetric key (also known as the File Encryption Key, or FEK), which is used because it takes a relatively smaller amount of time to encrypt and decrypt large amounts of data than if an asymmetric key cipher is used. The symmetric key that is used to encrypt the file is then encrypted with a public key that is associated with the user who encrypted the file, and this encrypted data is stored in the header of the encrypted file. To decrypt the file, the file system uses the private key of the user to decrypt the symmetric key that is stored in the file header. It then uses the symmetric key to decrypt the file. Because this is done at the file system level, it is transparent to the user. Template:Ref Also, in case of a user losing access to their key, support for recovery agents that can unencrypt files has been built in to the EFS system.

Notes

References

• Bolosky, William J.; Corbin, Scott; Goebel, David; & Douceur, John R. "Single Instance Storage in Windows 2000 (http://research.microsoft.com/sn/Farsite/WSS2000.pdf)". Microsoft Research & Balder Technology Group, Inc. (white paper).
• Custer, Helen (1994). Inside the Windows NT File System. Microsoft Press. ISBN 155615660X.
• Nagar, Rajeev (1997). Windows NT File System Internals: A Developer's Guide (1st ed). O'Reilly. ISBN 1565922492.

See also

• Comparison of file systems
• HPFS
• WinFS
• Captive NTFS

External links

• Inside Win2K NTFS (http://www.winnetmag.com/Windows/Article/ArticleID/15719/15719.html) by Mark Russinovich
• http://www.codeproject.com/datetime/dstbugs.asp - Excellent explanation of the timestamp issue with NTFS and seasonal time changes.
• Linux-NTFS (http://linux-ntfs.sourceforge.net) - an older DEPRECATED (and very unsafe) open source project to add NTFS support to the Linux kernel
• Captive NTFS (http://www.jankratochvil.net/project/captive/) - A more modern (and much safer) open source programming effort at implementing NTFS support within the Linux kernel
• NTFS.com (http://www.ntfs.com/) - documentation and resources for NTFS
• Transactional NTFS (http://blogs.msdn.com/because_we_can/) - An extension to NTFS in Longhorn to allow Transactional isolation to be used with NTFS access
• Microsoft NTFS Technical Reference (http://www.microsoft.com/technet/prodtechnol/windowsserver2003/library/TechRef/81cc8a8a-bd32-4786-a849-03245d68d8e4.mspx)de:NTFS

es:NTFS fa:NTFS fr:New Technology File System he:NTFS it:NTFS ja:NT File System nl:New Technology File System pl:NTFS pt:NTFS ru:NTFS zh:NTFS