Microsoft Windows NT File System (NTFS).ppt

Microsoft Windows NT File System (NTFS) “Providing a false sense of file security for Windows users since 1993” Just the Facts of NTFS 5.0 NTFS 5.0 is more advanced than the Win9x/DOS File Allocation Table (FAT) System. It natively provides file and directory object security, compress, encryption, logging, and user quota capabilities, all of which FAT did not have the capabilities of providing (must use second or third level utilities such as STACKER or DriveSpace). NTFS 5.0 can address much larger partitions than FAT16 (2GB) and equivalent partition sizes as FAT32 (2TB) File names can consist of any UNICODE (multi-national) characters, while FAT only consists of ASCII (English/American) File sizes are limited only by volume size, and not 4GB (FAT32) and 2GB (FAT16) Despite popular rumor, NTFS, like FAT, gets fragmented over time. Basic Implementation Fundamental Data Structure of NTFS is the Metafile. The Metafiles: NTFS Security Features Availability and Integrity $LOGFILE $MFTMIRR $BADCLUS Confidentiality $MFT Encrypting File System (added in NTFS 5.0) Authenticity $MFT CREATOR_OWNER Availability and Integrity $LOGFILE At the same time files are modified, certain information about the changes are written in two different record types to $LOGFILE. Redo records are written with information about the modification that must be redone if a modify or delete process is interrupted. An undo record is written in order to facilitate the rollback of an append if the process fails between the time the file is extended and the data is actually written in the new free space created. Example: CHKDSK uses the information in $LOGFILE to ensure data integrity and availability if a system is powered down without flushing the disk buffers. Availability and Integrity $MTFMIRR Metafile that is stored “in the middle” of the disk as a backup-copy of $MFT. Used in case MFT is corrupted. $BOOT (which can be stored at either the first or last sector of the disk) holds pointers to