What the ntfs network filesystem allows to do. Files and streams

The name of the NTFS file system includes the words "new technology". NTFS contains a number of significant improvements and changes that significantly distinguish it from other file systems. From a user perspective, files are still stored in directories (often referred to as "folders"). However, in NTFS, in contrast to FAT, work on large disks is much more efficient; there are means to restrict access to files and directories, mechanisms have been introduced that significantly increase the reliability of the file system, many restrictions have been removed on maximum amount disk sectors and / or clusters.

The main features of the NTFS file system:

reliability. High-performance computers and shared systems (servers) must have increased reliability, which is a key element in the structure and behavior of NTFS. One way to increase reliability is to introduce a transaction mechanism that logs file operations;

extended functionality. NTFS was designed with extensibility in mind. Many additional features were embodied in it - improved fault tolerance, emulation of other file systems, a powerful security model, parallel processing of data streams and the creation of user-defined file attributes;

POSIX support. Because the US government required all systems it purchases to be at least minimally POSIX compliant, NTFS also provided this capability. The basic features of the POSIX file system include the optional use of case-sensitive file names, storage of the time of the last access to the file, and the mechanism of so-called "hard links" - alternative names that allow you to refer to the same file by two or more names;

flexibility. Distribution model disk space NTFS is extremely flexible. The cluster size can vary from 512 bytes to 64 KB; it is a multiple of the internal disk space allocation. NTFS also supports long filenames, set Unicode characters and 8.3 format aliases for FAT compatibility.

NTFS copes excellently with processing large amounts of data and performs quite well when working with volumes ranging from 300 - 400 MB, and when working with the largest possible volumes and files - 16 EB (exabyte 64 bytes, or 16,000 billion gigabytes). The number of files in the root and non-root directories is not limited. Because the NTFS directory structure is based on an efficient data structure called a "binary tree". File search times in NTFS (as opposed to FAT-based systems) are not related linear relationship with their number.

NTFS also has some self-healing features. NTFS supports various mechanisms for checking the integrity of the system, including transaction logging, which allows you to replay file write operations against a special system log.

NTFS file system supports object model NT security and treats all volumes, directories, and files as separate entities. NTFS provides file-level security; this means that access rights to volumes, directories and files can be affected by account user and those groups to which he belongs. Every time a user accesses a file system object, his access rights are checked against the list of permissions of this object... If the user has a sufficient level of rights, his request is satisfied; otherwise, the request is rejected. This security model applies to both local user logon to NT computers and remote network requests.

In addition, NTFS also has built-in compression that can be applied to individual files, entire directories, and even volumes (and subsequently overridden or assigned as you see fit).

Volume structure with NTFS file system.

One of the basic concepts used when working with NTFS is volume. It is also possible to create a fault-tolerant volume that spans several partitions, that is, using RAID technology. Like many other systems, NTFS divides all of the usable disk space on a volume into clusters — data blocks that are addressed as data units. NTFS supports cluster sizes from 512 bytes to 64 KB; the standard is considered to be a 2 or 4 KB cluster.

All disk space in NTFS is divided into two unequal parts. The first 12% of the disk is allocated for the so-called MFT-zone - the space that can grow in size, the main MFT service metafile.

No data can be written to this area. The MFT zone is always kept empty - this is done so that the most important service file (MFT) does not become fragmented as much as possible as it grows. The remaining 88% of the volume is regular file storage.

MFT (master file table) is a centralized directory of all other files on the disk, including itself. MFT is divided into records fixed size in 1 KB, and each record corresponds to some file (in general sense of this word). The first 16 files are of a service nature and are inaccessible to the operating system - they are called metafiles, and the very first metafile is the MFT itself. These first 16 elements of the MFT are the only part of the disc that has a strictly fixed position. A copy of these 16 records is kept in the middle of the volume for reliability, as they are very important. The rest of the MFT-file can be located, like any other file, in arbitrary places on the disk - you can restore its position with the help of itself, "hooked" on the very basis - on the first MFT element.

The mentioned first 16 NTFS files (metafiles) are of a service nature; each of them is responsible for some aspect of the system. The metafiles are located in the root directory of the NTFS volume. They all start with the name symbol "$", although get some information about them by standard means hard. The table lists the main known metafiles and their purpose.

Thus, you can find out, for example, how much the operating system spends on cataloging a volume by looking at the size of the $ MFT file.

So, all volume files are referenced in the MFT. This structure stores all information about the files, with the exception of the actual data. The file name, size, position on the disk of individual fragments, etc., are all stored in the corresponding record. If one MFT record is missing for information, then several records are used, and not necessarily consecutive ones. The files may not be very large, then the file data is stored directly in the MFT, in the place remaining from the main data within one MFT record. Files occupying hundreds of bytes usually do not have their "physical" incarnation in the main file area- all the data of such a file is stored in one place, in the MFT.

A file on an NTFS volume is identified by a so-called file link, which is represented as a 64-bit number. A file link consists of a file number, which corresponds to the position of its file record in the MFT, and a sequence number. The latter is incremented whenever a given position in the MFT is reused, which allows the NTFS file system to perform internal consistency checks.

Each file in NTFS is represented using streams, that is, it does not have "just data" as such, but there are "streams". For a correct understanding of the stream, it is enough to indicate that one of the streams has the usual meaning - file data. But most of the file attributes are also streams. Thus, it turns out that the file has only one base entity - the number in the MFT, and everything else, including its streams, is optional. This approach can be effectively used - for example, you can "stick" another stream to a file by writing any data to it. In Windows 2000, information about the author and content of the file is recorded in this way (one of the bookmarks in the file properties, viewed, for example, from Explorer). Interestingly, these additional streams are not visible with standard file management tools: the observed file size is just the size of the main stream, which contains traditional data. You can, for example, have a file of zero length, erasing which will free up 1 GB of free space - simply because some cunning program or technology has "stuck" an additional stream (alternative data) of such a large size to it. But in reality, streams are not used much at the moment, so be wary similar situations should not, although hypothetically they are possible. You just need to keep in mind that a file in NTFS is a deeper concept than you might imagine looking at the disk directories.

The standard attributes for files and directories on an NTFS volume have fixed names and type codes:

File attributes in MFT records are arranged in ascending order of numeric values ​​of type codes, and some types of attributes may occur more than once in a record: for example, if a file has multiple data attributes or multiple names. Required for every file on an NTFS volume is the attribute standard information, file name attribute, security descriptor attribute, and data attribute. The rest of the attributes can be found as needed.

A file name in NTFS, unlike FAT and HPFS file systems, can contain any characters, including the full set of national alphabets, since the data is represented in Unicode - a 16-bit representation that gives 65535 different characters. Maximum length file name in NTFS - 255 characters.

The organization of the directory makes a big contribution to the efficiency of the file system. A directory in NTFS is special file, which stores links to other files and directories, creating a hierarchical structure of data on disk. The catalog file is divided into blocks, each of which contains the file name, basic attributes and a link to the MFT element, which already provides complete information about the catalog element. The main disk directory - root - is no different from ordinary directories, except for a special link to it from the beginning of the MFT metafile.

The internal structure of the directory is a binary tree. The binary directory tree arranges the filenames so that the search for the file is performed using two-digit answers to questions about the location of the file. A binary tree is able to answer the question: in which group, relative to a given element, is the desired name - higher or lower? The search begins with such a question to the middle element, and each answer narrows the search area by an average of two. If we imagine that the files are sorted alphabetically, then the answer to the question is carried out in an obvious way - by comparing the initial letters. The search area, narrowed in half, begins to be explored in a similar way, starting again from the middle element. However, adding a file to a tree directory is not much more difficult than adding a file to a linear FAT directory. These are operations comparable in time. To add new file to the directory, you must first make sure that the file with that name is not there yet. Therefore, in a FAT system with a linear organization of directory entries, we have difficulties not only with finding a file. And this more than compensates for the very simplicity of adding a file to a directory.

Possibilities of the NTFS file system to restrict access to files and directories.

NTFS treats directories (folders) and files as heterogeneous objects and maintains separate (albeit overlapping) lists of access rights for each type. The following are NTFS permissions assigned to folders (the corresponding permissions for files are listed below):

no access (None);

full access(full control) (All) (All) (all) (all);

the right to read (read) (RX) (RX) (read) (read);

the right to add (add) (WX) (not specified) (write / execute not specified);

the right to add and read (add & read) (RWX) (RX) (read / write / execute) (read / execute);

view right (list) (RX) (not specified) (read / execute) (not specified);

change right (RWXD)) (RWXD) (read / write / execute / delete) (read / write / execute / delete).

In parenthesized expressions after the name, the permissions are: the first expression refers to the folder itself, and the second refers to all files that can be created inside it. For example, Full Control allows any action on a folder, but a user with Full Control on the folder will also have full access to all files created in it (unless the file's owner or administrator has changed the file's permissions). In other words, in NTFS, files and folders by default inherit the permissions set for their parent folder, but these permissions can be changed by anyone who is allowed to change the permissions on the corresponding NTFS objects.

Files in NTFS can have the following rights:

full control (All) (all);

no access (None);

change right (RWXD) (read / write / execute / delete);

the right to read (read) (RX) (read / execute).

For NTFS permissions, as for shared directory permissions, the takeover principle applies. An exception is the "no access" right, which overrides all other rights.

When users connect over a network, NTFS rights may conflict with shared directory rights. In such a situation, the access right with the most severe restrictions applies. Many people have problems understanding the restrictions imposed by network access. However, you can easily figure it out if you remember that when accessing directories and files located on NTFS volumes, two sequential mechanisms are used.

First, the files are accessed, which has been determined by the network mechanisms. These are the "no access" right, the "read" right, the "change" right, the "change" right, and "full control". After that, the restrictions on files and directories defined by the NTFS properties take effect. That is, the final rights to folders and files are determined by the maximum restrictions that were specified in each of the mechanisms.

In addition to the listed rights, there is also the so-called special access. If you select this access right, then in fact it becomes possible to select several rights at the same time from the following list:

full control (All);

reading (read) (R);

write (write) (W);

execute (X);

delete (delete) (D);

change permissions (P);

take ownership (O).

In principle, one could choose any combination of the listed permissions, but in practice this does not work. For example, you cannot specify the X (execute) right without the R (read) right, although other file management systems do provide this right. It allows you to execute a program whose file is marked with this attribute, but does not provide an opportunity to copy it. Many other combinations special permits also do not work properly and this must be borne in mind. It is better to use the regular rights to files and directories, which were listed above.

Now let's look at what happens to the rights to protected files in NTFS when they are moved. Higher-level folders in NTFS usually have the same rights as the files and folders they contain. For example, if you create a folder inside another folder for which Administrators have Full Control and Archive Operators have Read access, the new folder will inherit those rights. The same applies to files copied from another folder or moved from another NTFS partition.

If a folder or file is moved to a different folder on the same NTFS partition, the security attributes are not inherited from the new container object. For example, if a file is moved from a folder with read permissions for the everyone group to a folder on the same partition with full access for the same group, then the moved file will retain its original read permissions. The fact is that when files are moved within the boundaries of one NTFS partition, only the pointer to the location of the object changes, and all other attributes (including security attributes) remain unchanged.

The following three important rules will help you determine the state of access rights when moving or copying NTFS objects:

when moving files within the boundaries of an NTFS partition, the original access rights are preserved;

when performing other operations (creating or copying files, as well as moving them between NTFS partitions), the access rights of the parent folder are inherited;

all NTFS rights are lost when files are moved from an NTFS partition to a FAT partition.

NTFS, FAT or exFAT are completely different file systems that can be used to store data on different media. Both created in Microsoft and are mostly used for Windows, but there is support for them in the Linux kernel too.

Most often, NTFS is used to install the operating Windows systems or Windows partitions for files, while FAT is often used on flash drives or other external drives. Also FAT can often be used as the main file system for Android. In this article, we will look at FAT differences and NTFS, we will analyze in detail how they differ and why they are needed.

The file system sets the basic rules for how data will be organized when written to a medium, regardless of what it is - HDD or a flash drive. The file system describes how the folders will be organized.

A certain part of the data called a file is located in the required area of ​​the drive. The file system performs all the necessary calculations, and also determines the minimum indivisible size of the data block, maximum size file, monitors fragmentation. There are many different types file systems, for example, file systems for installing the OS, for external media, for optical discs, distributed file systems. But in this article, we will only perform a fat versus ntfs comparison.

What is the FAT file system?

The file systems fat32 and ntfs are very different. FAT stands for File Allocation Table. It is a very old file system in the history of computing systems. Her story began in 1977. Then the 8-bit file system was developed, which was used in the NCR 7200 based on the Intel 8080. It was an input terminal that worked with floppy disks. The file system was written a Microsoft employee, By Mark MacDonald after discussing her concept with Bill Gates.

Then the file FAT system began to be used in the MDOS operating system for the Z80 platform. Several years later, new versions were released such as FAT12, FAT16 and FAT32.

FAT32 has increased the maximum volume size to 16TB over FAT16. The file size has also been increased to 4 GB. File Allocation Table 32 bit was released in August 1995 for Windows 95. But this file system still cannot be used for heavy application installations or storage large files... Therefore, Microsoft has developed a new file system - NTFS, which is devoid of such disadvantages.

FAT32 is a great file system for external media if you need to transfer files no larger than 4GB. It is supported by many various devices such as cameras, cameras, music players... All Windows versions and Linux distributions fully support FAT32. Even Apple MacOS supports it.

What is NTFS File System?

Microsoft has developed a new file system for its new systems - New Technology File System or NTFS. It appeared in 1993, in Windows NT 3.1. NTFS has lifted many of the restrictions on file and disk sizes. Its development began back in 1980, as a result merging Microsoft and IBM to create a new file system with improved performance.

But the collaboration between the companies did not last long, and IBM released HPFS, which was used in OS / 2, and Microsoft created NTFS 1.0. The maximum size of a single file in NTFS can be up to 16 exabytes, which means that even the largest files can fit in it.

NTFS 3.1 was released for Windows XP and received many interesting improvements such as support for reducing the size of partitions, automatic recovery and symbolic links, and the maximum file system disk size has been increased to 256 TB. This is despite the maximum file size of 16 EB.

Other interesting features that were added later include lazy write to disk, support for defragmentation, configuring disk quotas, link tracking, and file-level encryption. With all this, NTFS maintains compatibility with previous versions.

Now it is a journaling file system, all actions with files are recorded in a special journal, with the help of which the file system can be very quickly restored in case of damage. NTFS is supported on Windows XP and later. If you compare fat or ntfs, then the latter is not fully supported in Linux, it is possible to write and recover in case of damage, and only read is supported on MacOS.

What is exFAT file system?

File exFAT system is another Microsoft project to improve the old file system. It can be striped where FAT32 does not fit. It is much easier for NTFS, but it supports files larger than 4 GB, and is also often used on flash drives and storage devices. With her Microsoft development used its own hash file name lookup technology, which greatly improves performance.

Most countries recognize US patent law, so any implementation of exFAT is not possible on any closed or open source systems. But Microsoft wants this file system to be freely distributed and used. Therefore, a FUSE-based version of exFAT was developed called fuse-exfat. It gives full read and write access. An implementation was also created at the level Linux kernels in Samsung, which is now also in the public domain.

This filesystem also has maximum limitation by a file size of 16 EB, but it is much lighter and does not have any additional features. If we talk about compatibility, then it is fully supported on Windows, macOS, Android and Linux.

Differences between FAT and Ntfs

Now let's look at the main differences between FAT and NTFS in the form of a brief summary of each of the file systems:

FAT32

• Compatibility: Windows, Mac, Linux, game consoles, almost all devices with a USB port;
• Pros: cross-platform, lightness;
• Minuses: maximum file size 4 GB and partition 16 GB, non-journaling;
• Usage: external media.

NTFS

• Compatibility: Windows, Linux, Xbox One, and read-only on Mac;
• Pros: journaled, large limits on the size of the partition and file, encryption, automatic recovery;
• Minuses: limited cross-platform;
• Usage: to install Windows.

exFAT

• Compatibility: Windows XP and higher, MacOS X 10.6.5, Linux (fuse), Android;
• Pros: large limit on the size of the partition and file, light compared to NTFS;
• Minuses: Microsoft restricts its use by a license agreement;
• Usage: for external media and external hard disks.

conclusions

In this article, we have performed a comparison between fat and ntfs. These are very different file systems. But it is difficult to understand which file system is better than fat or ntfs, on the one hand NTFS has much more capabilities, but FAT is lighter and is supported wherever possible. For Linux data partitions that need to be accessible on Windows, it is better to use FAT rather than NTFS as it is better supported. What do you think is better fat or ntfs for Linux?

The operating system, in addition to all other tasks, fulfills its main purpose - it organizes work with data according to a certain structure. The file system is used for these purposes. What is FS and what it can be, as well as other information about it will be presented below.

general description

The file system is a part of the operating system that is responsible for placing, storing, deleting information on media, providing users and applications with this information, as well as providing it safe use... In addition, it is she who helps in data recovery in the event of a hardware or software failure. This is why the file system is so important. What is FS and what can it be? There are several types:

For hard drives, that is, random access devices;

For magnetic tapes, that is, devices with sequential access;

For optical media;

Virtual systems;

Networked systems.5

A file serves as a logical unit of data storage in a file system, that is, an ordered collection of data that has a specific name. All data used by the operating system is presented in the form of files: programs, images, texts, music, video, as well as drivers, libraries, etc. Each such element has a name, type, extension, attributes, and size. So, now you know, the File system is a collection of such elements, as well as ways to work with them. Depending on the form in which it is used and what principles are applicable to it, several main types of FS can be distinguished.

Programmatic approach

So, if the file system is considered (what is it and how to work with it), then it should be noted that this is a multi-level structure, on its upper level there is a filesystem switch that provides an interface between the system and a specific application. It converts requests for files into a format that is perceived by the next layer - drivers. They, in turn, refer to specific device drivers that store the necessary information.

Have client-server applications FS performance requirements are quite high. Modern systems are designed to provide efficient access, support for large storage media, protect data from unauthorized access, and maintain the integrity of information.

FAT file system

This type was developed back in 1977 by Bill Gates and Mark MacDonald. It was originally used in OS 86-DOS. If we talk about what the FAT file system is, then it is worth noting that initially it was not able to support hard drives, but only worked with flexible media up to 1 megabyte. Now this limitation is no longer relevant, and this FS was used by Microsoft for MS-DOS 1.0 and subsequent versions. FAT uses certain conventions for naming files:

At the beginning of the name there must be a letter or number, and in it itself can be any ASCII character, in addition to the space and special elements;

The length of the name should be no more than 8 characters, after it a period is put, and then the extension is indicated, which consists of three letters;

Any case can be used in file names; it is indistinguishable and not preserved.

Since FAT was originally designed for a single-user DOS operating system, it did not provide for storing information about the owner or access rights. On the this moment this file system is the most widespread, to one degree or another it is supported by the majority. Its versatility makes it possible to use it on volumes with which different operating systems work. This is a simple file system that is not able to prevent the corruption of files due to an incorrect shutdown of the computer. Operating systems based on it include special utilities that check the structure and correct file inconsistencies.

File system NTFS

This file system is the most preferable for working with Windows NT, as it was developed specifically for it. The OS includes a convert utility that converts FAT and HPFS volumes to NTFS volumes. If we talk about what a file NTFS system, it is worth noting that it significantly expanded the ability to control access to certain directories and files, introduced many attributes, implemented dynamic file compression tools, fault tolerance, and supported the POSIX standard requirements. In this FS, you can use names up to 255 characters long, while short name it is generated in the same way as in VFAT. Understanding what the NTFS file system is, it is worth noting that in the event of an operating system failure, it is able to recover itself, so the disk volume will remain accessible, and the directory structure will not suffer.

Features of NTFS

On an NTFS volume, each file is represented by an entry in the MFT. The first 16 records of the table are reserved by the file system itself for storage special information... The very first entry describes the file table itself. When the first record is destroyed, the second is read to find a mirrored MFT file, where the first record is identical to the main table. A copy of the file is placed at the logical center of the disk bootstrap... The third record of the table contains the log file that is used for data recovery. In the seventeenth and subsequent entries file table contains information about the files and directories that are on the hard disk.

The transaction log contains a full set of operations that change the structure of a volume, including operations to create files, as well as any commands that affect the directory structure. The transaction log is for NTFS recovery as a result of a system failure. The entry for the root directory contains a list of directories and files that are in the root directory.

EFS features

The Encrypting File System (EFS) is a Windows component that can store information on your hard drive in an encrypted format. Encryption has become the most strong protection that only this operating system has to offer. V in this case encryption for the user is pretty simple action, for this you only need to check the box in the properties of the folder or file. You can specify who can read such files. Encryption occurs when files are closed, and when they are opened, they are automatically ready for use.

Features RAW

Data storage devices are the most vulnerable components, which are most often prone to damage not only physically, but also logically. Certain hardware problems can be fatal, while others have solutions. Sometimes users have a question: "What is a RAW file system?"

As you know, in order to record any information on a hard disk or flash drive, the drive must have a file system. The most common are FAT and NTFS. And RAW is not even the file system that we usually imagine. In fact, this is a logical error already installed system, that is, its actual absence for Windows. Most often, RAW is associated with the destruction of the structure of the file system. After that, the OS does not just access data, but also does not display technical information by equipment.

Features of UDF

Universal disk format(UDF) is designed to replace CDFS and add support for DVD-ROM devices. If we talk about what it is, then this is a new implementation. old version for which meets the requirements It is characterized by certain features:

File names can be up to 255 characters long;

The name can be uppercase or lowercase;

The maximum path length is 1023 characters.

Starting with Windows XP, this file system supports reading and writing.

This FS is used for flash drives that are supposed to be used when working with different computers running different operating systems, in particular Windows and Linux. It was EXFAT that became the "bridge" between them, since it is able to work with data received from the OS, each of which has its own file system. What is and how it works, it will be clear already in practice.

conclusions

As is clear from the discussion above, each operating system uses specific file systems. They are intended for storing ordered data structures on physical media information. If you suddenly, when using a computer, have a question about what the final file system is, then it is quite possible that when you try to copy specific file on the media in front of you there was a message about exceeding the allowed size. That is why you need to know in which file system what file size is considered acceptable, so that you do not encounter problems when transferring information.

NTFS (eng. New Technology File System- "file system new technology") Is the standard file system for the OS family Microsoft Windows NT.

NTFS replaced the FAT file systems previously used in Microsoft Windows and MS-DOS. NTFS supports the metadata system, and also uses specialized data structures to store information about files to improve performance, reliability, and disk space efficiency. NTFS has built-in capabilities that allow you to differentiate access to data for different groups users and individual users (ACL - access control lists), assign quotas (restrictions on the maximum amount of disk space occupied by this or that user). In order to improve reliability, NTFS uses a journaling system.

The NTFS file system was developed on the basis of the HPFS (High Performance File System), which was jointly created by IBM and Microsoft for the OS / 2 operating system. However, with the acquisition of very useful innovations, such as journaling, quoting, auditing and access control, NTFS has lost the inherent HPFS high productivity file operations. At the time of its creation, NTFS included all the most modern technological advances, such as:

Ability to work with large disks. The NTFS cluster size is 512 bytes, but it can vary up to 64K. Much more important quality NTFS - theoretical capacity to handle volumes of 16,777,216 terabytes. Theoretical only because such hard disks have not yet been created.

Stability. NTFS contains two copies of the FAT analog, called MFT (Master File Table). MFT differs from FAT MSDOS in that it looks more like a database table. In case of damage to the original MFT due to a hardware error (for example, the appearance of a bad sector), when next boot the system uses a copy of the MFT, automatically creating new original, taking into account all damage. But this is not the main advantage either. The main thing is that NTFS uses the transaction system when writing files to disk. This system came from a DBMS, where special attention is paid to protecting data integrity, which can already say a lot about its effectiveness. This system ensures the absolute safety of data when copying, moving and deleting files or directories. If changes are made to the file, the changes that were in the controller's cache or memory at the time of the failure and were not written to disk will be lost.

Security. In NTFS, files are treated as objects. And each file object has its own properties like creation date, name, archive status, security descriptor and date last update... The file object also contains a set of methods that allow you to work with it, such as write, read, close, and open. Users, including network users, call these methods to access the file, and the Security Reference Monitor determines whether the user has the necessary permissions to call one of these methods. In addition, files can be encrypted, but this should be done with caution. If you reinstall the system, you will not be able to read encrypted files without ERD.

Data compression. Unlike DriveSpace, in which drives could only be compressed as a whole, NTFS allows you to compress separate files and catalogs. This allows you to save disk space, for example, on the fly compress text files or large graphic files BMP format, and all this will be transparent to the user.

Support ISO format Unicode. Unlike the format ASCII which used 7 or 8bit to encode each character, Unicode uses 16bit. This will allow an ordinary user to name files in absolutely any language, and the system will support this, without the requirement to change the code page, as did W9x and DOS.

There are several versions of NTFS. Windows NT 4.0 and Windows NT 3.51 use v1.2, with Windows 2000 v3.0 comes with Windows Server 2003 and Windows XP - v3.1. Some latest versions are designated v4.0, v5.0, that is, in full accordance with Windows versions NT they come with.

Windows NT has NTFS 4.0 file system, Windows 2000 / XP - NTFS 5. When you connect a 2000 / XP disk with NTFS 4.0, it is automatically converted by the operating system to NTFS 5.0.

The file system specifications are closed. This presents some difficulty for its support by third-party products that are not owned by Microsoft. For example, developers of drivers for free operating systems are forced to reverse engineer the system.

Operating Microsoft systems Windows family NT cannot be imagined without the NTFS file system - one of the most complex and successful file systems in existence at the moment. This article will tell you what are the features and disadvantages of this system, on what principles the organization of information is based, and how to maintain the system in a stable state, what capabilities NTFS offers and how they can be used by a common user.

Part 1. Physical structure of NTFS

Let's start with general facts. An NTFS partition can, in theory, be almost any size you want. Of course, there is a limit, but I will not even indicate it, since it will be enough for the next hundred years of development. computing technology- at any rate of growth. What is the situation with this in practice? Almost the same. The maximum size of an NTFS partition is currently limited only by the size of hard drives. NT4, however, will experience problems when attempting to install on a partition if any part of it is more than 8 GB away from the physical disk start, but this problem only affects the boot partition.

Lyrical digression. The method of installing NT4.0 on a blank disk is quite original and may lead to misconceptions about the capabilities of NTFS. If you tell the installer that you want to format the drive to NTFS, the maximum size it will offer you is only 4 GB. Why is it so small when the size of an NTFS partition is actually practically unlimited? The fact is that the installation section simply does not know this file system :) The installer formats this disk into a regular FAT, the maximum size of which in NT is 4 GB (using a not quite standard huge 64 KB cluster), and installs NT on this FAT ... But already during the first boot of the operating system itself (even in the installation phase), the partition is quickly converted to NTFS; so that the user does not notice anything, except for the strange \ "restriction \" on NTFS size when installing. :)

Section structure - general view

Like any other system, NTFS divides all the useful space into clusters - blocks of data that are used at a time. NTFS supports almost any cluster size - from 512 bytes to 64 KB, while a 4 KB cluster is considered a certain standard. No anomalies cluster structure NTFS does not, so there is nothing special to say about this, in general, rather banal topic.

An NTFS disk is conventionally divided into two parts. The first 12% of the disk is allocated for the so-called MFT zone - the space into which the MFT metafile grows (more on this below). No data can be written to this area. The MFT zone is always kept empty - this is done so that the most important service file (MFT) does not become fragmented as it grows. The remaining 88% of the drive is conventional file storage.

Free disk space, however, includes all physically free space - empty pieces of the MFT zone are also included there. The mechanism for using the MFT zone is as follows: when files can no longer be written to the usual space, the MFT zone is simply reduced (in current versions of operating systems, exactly twice), thus freeing up space for writing files. If space is freed up in the normal MFT area, the area may expand again. At the same time, a situation is not excluded when ordinary files remain in this zone: there is no anomaly here. Well, the system tried to keep it free, but nothing worked. Life goes on ... The MFT metafile can still become fragmented, even though this would be undesirable.

MFT and its structure

The NTFS file system represents an outstanding achievement in structuring: every element of the system is a file - even service information... Most main file on NTFS it is called MFT, or Master File Table - a general table of files. It is he who is located in the MFT zone and is a centralized directory of all the other files on the disk, and, paradoxically, himself. The MFT is divided into records of a fixed size (usually 1 KB), and each record corresponds to a file (in the general sense of the word). The first 16 files are of a service nature and are inaccessible to the operating system - they are called metafiles, and the very first metafile is the MFT itself. These first 16 elements of the MFT are the only part of the disc that has a fixed position. Interestingly, the second copy of the first three records, for reliability - they are very important - is stored exactly in the middle of the disk. The rest of the MFT file can be located, like any other file, in arbitrary places on the disk - you can restore its position with the help of itself, \ "hooked \" to the very base - to the first MFT element.

Metafiles

The first 16 NTFS files (metafiles) are of a service nature. Each of them is responsible for some aspect of the system. The advantage of such a modular approach is amazing flexibility - for example, on FAT, physical damage in the FAT area itself is fatal for the functioning of the entire disk, and NTFS can shift, even fragment across the disk, all of its service areas, bypassing any surface faults - except for the first 16 MFT elements.

Metafiles are in the root directory NTFS disk- they begin with the name symbol \ "$ \", although it is difficult to get any information about them by standard means. It is curious that for these files it is specified quite well real size- you can find out, for example, how much the operating system spends on cataloging your entire disk by looking at the size of the $ MFT file. The following table lists the currently used metafiles and their purpose.

Files and streams

So, the system has files - and nothing but files. What does this concept include on NTFS?

First of all, an obligatory element is an entry in the MFT, because, as mentioned earlier, all disk files are mentioned in the MFT. This place stores all information about the file, with the exception of the actual data. File name, size, position on disk of individual fragments, etc. If one MFT record is missing for information, then several are used, and not necessarily in a row.

Optional element - file data streams. It may seem strange to define \ "optional \", but, nevertheless, there is nothing strange here. First, the file may have no data - in this case, it does not consume free space on the disk itself. Secondly, the file may not have very big size... Then a rather good solution comes into play: the file data is stored directly in the MFT, in the place remaining from the main data within one MFT record. Files occupying hundreds of bytes usually do not have their "physical" incarnation in the main file area - all the data of such a file is stored in one place - in the MFT.

The situation with file data is also quite interesting. Each file on NTFS, in general, has a somewhat abstract structure - it does not have data as such, but there are streams. One of the streams has the usual meaning - file data. But most of the file attributes are streams too! Thus, it turns out that the file has only one base entity - the number in the MFT, and everything else is optional. This abstraction can be used to create quite convenient things - for example, you can \ "stick \" another stream to a file by writing any data to it - for example, information about the author and content of the file, as is done in Windows 2000 (the rightmost tab in the properties file viewed from Explorer). Interestingly, these additional streams are not visible by standard means: the observed file size is just the size of the main stream, which contains traditional data. You can, for example, have a file of zero length, erasing which will free up 1 GB of free space - simply because some cunning program or technology has stuck in it an additional stream (alternative data) of a gigabyte size. But in fact, at the moment, streams are practically not used, so one should not be afraid of such situations, although hypothetically they are possible. Just keep in mind that the file on NTFS is deeper and global concept than one might imagine by simply browsing the catalogs of the disk. And finally: the file name can contain any characters, including a complete set of national alphabets, since the data is represented in Unicode - a 16-bit representation that gives 65535 different characters. The maximum length for a file name is 255 characters.

Catalogs

An NTFS directory is a specific file that stores links to other files and directories, creating a hierarchical structure of data on disk. The catalog file is divided into blocks, each of which contains the file name, basic attributes and a link to the MFT element, which already provides complete information about the catalog element. The internal structure of the directory is a binary tree. This is what it means: to find a file with a given name in a linear directory, such as that of a FAT, the operating system has to go through all the directory entries until it finds the one it needs. The binary tree arranges the names of files in such a way that the search for the file is carried out in a faster way - by obtaining two-digit answers to questions about the location of the file. The question that a binary tree is able to answer is: in which group, with respect to of this element, is the name you are looking for - above or below? We start with a question like this for the middle item, and each answer narrows the search area in half on average. The files are, say, just sorted alphabetically and the answer to the question is done in an obvious way- comparison of initial letters. The search area, narrowed in half, begins to be explored the same way starting again from the middle element.