Windows File Systems - NTFS

NTFS, Disk Key & MFT

Some advantages of NTFS over DOS are -

• Transaction logs exist to help recover from disk failures.
• NTFS has the ability to control access at file level by setting permissions for directories and/or individual files.
• NTFS files are not accessible from other operating systems such as DOS. This stops people hacking security by booting from a DOS floppy disk.
• If the amount of data is less than about 2 KB, the data is actually stored in the directory entry itself, that's faster retrieval and space saving!
• NTFS disk can span over several physical volumes, essential for large industrial strength applications.
• NTFS uses a data retrieve technique called "elevator seeking". Data reads are sorted and read in track order, rather than in the order submitted. This means the reads heads aren't seeking back and forward over the disk, but read the IOs in sequence up the disk
• The directory is stored in the middle the disk, to reduce seek time to find files. You have to read the directory to find where the file is, Once located in the directory, your file is never more than half the disk away from the read heads.
• NT will try to allocate data in a single contiguous extent. This also reduces seek time when reading the whole file.

NTFS has uses two critical files to manage its systems.
The Diskkey manages all the disks defined to the system.
Within each logical disk, the MFT manages all the defined files.

The Disk Key

The HKLM\System\Disk key is created when disk drives are first defined to NT using Disk Administrator. The information it stores about every hard-disk in the system includes:

• how they are partitioned,
• how drive letters are allocated
• configuration details of fault-tolerant drives.

FT-Disk reads the disk key to work out the hardware configuration. It needs to know about drive types, volume sets, mirrored drives, stripe sets and stripe sets with parity.
Win32 also reads the disk key when it allocates drive letters.

NT 5.0, incorporates Veritas' volume-management technology, so disk management is changing. Disk information is still kept in the HKLM\Disk\, but the fault-tolerant information is stored directly on disk, to improve resilience. The HKLM\DISK\ data is retained for backward compatibility with older NT releases.

The MFT

In NTFS, all objects are files, even the metadata about files. This allows the file system to handle all objects consistently. The Master File Table (MFT) is the most important system file. It contains information about all the files on the volume. There is exactly one MFT per volume. There is also at least one entry in the MFT for every file on an NTFS volume. If the base file record is not big enough to hold all the information about a file, an extension record is created. The MFT file records contain all the information about a file, including its size, time and date stamps,permissions, data content, etc.
Its important that the MFT does not become fragmented, as this can affect system performance. NTFS will reserve space for the MFT, but if the rest of the disk fills up, this reserved space will be used. NTFS does not delete records from the MTF when files are deleted, but it does mark them as reusable.

If you allocate lots of small files on your disk, you will fill up the MFT before the disk fills up. If you allocate big files, you will run out of disk space and before the MFT is full. You can change the amount of space reserved by NTFS for the MFT by updating the NTFS zone reservation parameter, by editing

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem

Add Value name NtfsMftZoneReservation as a type REG_DWORD and set the data value to a number between 1and 4. The bigger the number, the more space that will be reserved for the MFT. Caution - Microsoft warn that before you make any change to the registry, you should take a backup, and be prepared for the system to crash.

Reparse points were introduced with Windows 2000 storage subsystem. They provide ‘hooks’ into the file system that can be used by ISVs to add storage functionality.

NTFS Change Journal

Change Journal software was introduced with Windows 2000 operating system. It is used by functions that are only interested in processing new or changed files on a volume. Examples are backup, virus scanning, indexing services and auditing. A record is added to the Change Journal every time a file or directory is updated. Applications that need to find changed files can get their information from the Change Journal, they do not have to scan the entire volume. This can mean a considerable saving in I/O operations and time, especially if not many files have changed.

NTFS cluster sizes

The minimum size of a file in the NTFS file system is the size of a single cluster and files cannot share space within a cluster. The smaller the cluster size, the more efficiently a disk stores information, the bigger the cluster the better the performance as more data is moved per IO operation. The file system has limits on the number of clusters it can support so it chooses the default cluster size of the volume. The default cluster size can be overridden by a user.

The FAT16 file system supports a maximum of 65,524 clusters per volume. FAT32 volumes must have a minimum of 65,527 clusters on a 32-GB volume, which is the largest FAT32 volume that Windows Server 2003 can format.

Volume Size	FAT16 Cluster Size	FAT32 Cluster Size
7 MB – 16 MB	2 KB	Not supported
17 MB – 32 MB	512 bytes	Not supported
33 MB – 64 MB	1 KB	512 bytes
65 MB – 128 MB	2 KB	1 KB
129 MB – 256 MB	4 KB	2 KB
257 MB – 512 MB	8 KB	4 KB
513 MB – 1,024 MB	16 KB	4 KB
1,025 MB – 2 GB	32 KB	4 KB
2 GB – 4 GB	64 KB	4 KB
4 GB – 8 GB	Not supported	4 KB
8 GB – 16 GB	Not supported	8 KB
16 GB – 32 GB	Not supported	16 KB
32 GB – 2 terabytes	Not supported	Not supported

back to top

By entering and using this site, you accept the conditions and limitations of use