Какая версия ntfs в windows 10

Windows 10 поддерживает несколько файловых систем из коробки. Некоторые из них являются наследием и существуют в основном для обратной совместимости, другие современные и имеют широкое применение. В этой статье описаны различные способы, которые вы можете использовать, чтобы посмотреть, с помощью какой файловой системы отформатированы ваши диски.

Файловая система — это особый способ хранения и организации вашей информации на разных носителях, включая жесткие диски, твердотельные диски, USB-накопители и другие устройства. Она позволяет хранить, изменять, читать файлы и папки для приложений и операционной системы, установленных на вашем компьютере.

При форматировании внутреннего диска или флеш-накопителя вы готовите его для использования в качестве носителя для хранения данных в вашей операционной системе. Во время этого процесса создается файловая система.  Во время форматирования вся информация, хранящаяся на диске или разделе, будет удалена.

Windows 10 поддерживает файловые системы FAT, FAT32, exFAT, NTFS и ReFS без использования дополнительного программного обеспечения.

У них разные функции и свойства. Например, FAT и FAT32 являются устаревшими файловыми системами. FAT поддерживает максимальный объем 4 ГБ, FAT32 поддерживает 32 ГБ. Файловые системы FAT также имеют ограничения на максимальный размер файла. NTFS — единственная файловая система, которая поддерживает сжатие и шифрование файлов и имеет расширенные функции.

Существует несколько способов, которые вы можете применить для поиска файловой системы, используемой на ваших дисках.

Чтобы узнать файловую систему на дисках в Windows 10, выполните следующие действия.

1. Откройте «Проводник» и перейдите в папку «Этот компьютер».

1. Кликните правой кнопкой мыши диск и выберите в контекстном меню «Свойства».

1. В окне «Свойства» на вкладке «Общие», вы увидите файловую систему вашего диска.

Этот способ, является самым простым и быстрым.

Кроме того, вы можете использовать инструмент Diskpart, Управление дисками или PowerShell.

Посмотреть файловую систему диска с помощью Diskpart

1. Нажмите сочетание клавиш Win + R.

1. В поле «Выполнить» введите «diskpart» и нажмите Enter.

1. В Diskpart введите команду list volume.

После выполнения команды  вы увидите файловую систему для каждого диска, подключенного к вашему компьютеру.

Показать файловую систему диска с помощью «Управление дисками».

1. Нажмите Win + X или кликните правой кнопкой мыши на кнопку «Пуск».

1. В меню WinX выберите «Управление дисками».

1.  См. Значения в столбце Файловая система.

Наконец, существует еще один способ определения файловой системы для каждого диска, подключенного к вашему компьютеру, с использованием языка сценариев PowerShell.

Определить  файловую систему с помощью PowerShell.

1. Откройте PowerShell  от имени администратора.

1. Введите:  get-volume и нажмите клавишу Enter.

1. На выходе см. Значения в столбце FileSystemType.

Теперь вы знаете, что, очень легко определить файловую систему для ваших дисков. Вы можете использовать любой способ, который вам нравится больше.

Вот и все.

New Technology File System^[1]

Developer(s)	Microsoft
Full name	NT File System[2]
Introduced	July 1993; 29 years ago with Windows NT 3.1
Partition identifier	0x07 (MBR) EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (GPT)
Structures
Directory contents	B-tree variant[3][4]
File allocation	Bitmap
Bad blocks	$BadClus (MFT Record)
Limits
Max. volume size	264 clusters − 1 cluster (format); 256 TB[a] − 64 KB[a] (Windows 10 version 1703, Windows Server 2016 or earlier implementation)[5] 8 PB − 2 MB[a] (Windows 10 version 1709, Windows Server 2019 or later implementation)[6]
Max. file size	16 EB[a] − 1 KB (format); 16 TB − 64 KB (Windows 7, Windows Server 2008 R2 or earlier implementation)[5] 256 TB − 64 KB (Windows 8, Windows Server 2012 or later implementation)[7] 8 PB − 2 MB (Windows 10 version 1709, Windows Server 2019 or later implementation)[6]
Max. number of files	4,294,967,295 (232−1)[5]
Max. filename length	255 UTF-16 code units[8]
Allowed characters in filenames	In Win32 namespace: any UTF-16 code unit (case-insensitive) except /:*"?<>| as well as NUL[8] In POSIX namespace: any UTF-16 code unit (case-sensitive) except / as well as NUL Trailing spaces are not allowed and will be removed[9]
Features
Dates recorded	Creation, modification, POSIX change, access
Date range	1 January 1601 – 28 May 60056 (File times are 63-bit numbers counting 100-nanosecond intervals (ten million per second) since 1601, which is 29,227 years)
Date resolution	100 ns
Forks	Yes (see § Alternate data stream (ADS) below)
Attributes	Read-only, hidden, system, archive, not content indexed, off-line, temporary, compressed, encrypted
File system permissions	ACLs
Transparent compression	Per-file, LZ77 (Windows NT 3.51 onward)
Transparent encryption	Per-file, DESX (Windows 2000 onward), Triple DES (Windows XP onward), AES (Windows XP Service Pack 1, Windows Server 2003 onward)
Data deduplication	Yes (Windows Server 2012)[10]
Other
Supported operating systems	Windows NT 3.1 and later Mac OS X 10.3 and later (read-only) Linux kernel version 2.6 and later Linux kernel versions 2.2-2.4 (read-only) FreeBSD NetBSD OpenBSD (read-only) ChromeOS Solaris ReactOS (read-only)

New Technology File System (NTFS) is a proprietary journaling file system developed by Microsoft.^[2][1] Starting with Windows NT 3.1, it is the default file system of the Windows NT family.^[11] It superseded File Allocation Table (FAT) as the preferred filesystem on Windows and is supported in Linux and BSD as well. NTFS reading and writing support is provided using a free and open-source kernel implementation known as NTFS3 in Linux and the NTFS-3G driver in BSD.^[12][13] By using the convert command, Windows can convert FAT32/16/12 into NTFS without the need to rewrite all files.^[14] NTFS uses several files typically hidden from the user to store metadata about other files stored on the drive which can help improve speed and performance when reading data.^[1] Unlike FAT and High Performance File System (HPFS), NTFS supports access control lists (ACLs), filesystem encryption, transparent compression, sparse files and file system journaling. NTFS also supports shadow copy to allow backups of a system while it is running, but the functionality of the shadow copies varies between different versions of Windows.^[15]

History[edit]

In the mid-1980s, Microsoft and IBM formed a joint project to create the next generation of graphical operating system; the result was OS/2 and HPFS. Because Microsoft disagreed with IBM on many important issues, they eventually separated; OS/2 remained an IBM project and Microsoft worked to develop Windows NT and NTFS.

The HPFS file system for OS/2 contained several important new features. When Microsoft created their new operating system, they «borrowed» many of these concepts for NTFS.^[16] The original NTFS developers were Tom Miller, Gary Kimura, Brian Andrew, and David Goebel.^[17]

Probably as a result of this common ancestry, HPFS and NTFS use the same disk partition identification type code (07). Using the same Partition ID Record Number is highly unusual, since there were dozens of unused code numbers available, and other major file systems have their own codes. For example, FAT has more than nine (one each for FAT12, FAT16, FAT32, etc.). Algorithms identifying the file system in a partition type 07 must perform additional checks to distinguish between HPFS and NTFS.

Versions[edit]

Microsoft has released five versions of NTFS:

NTFS version number	First operating system	Release date	New features	Remarks
1.0	Windows NT 3.1	1993[11]	Initial version	NTFS 1.0 is incompatible with 1.1 and newer: volumes written by Windows NT 3.5x cannot be read by Windows NT 3.1 until an update (available on the NT 3.5x installation media) is installed.[18]
1.1	Windows NT 3.51	1995	Compressed files, named streams, and access control lists[19]
1.2	Windows NT 4.0	1996	Security descriptors	Commonly called NTFS 4.0 after the OS release
3.0	Windows 2000	2000	Disk quotas, file-level encryption in a form of Encrypting File System, sparse files, reparse points, update sequence number (USN) journaling, distributed link tracking, the $Extend folder and its files	Compatibility was also made available for Windows NT 4.0 with the Service Pack 4 update. Commonly called NTFS 5.0 after the OS release.[20]
3.1	Windows XP	October 2001	Expanded the Master File Table (MFT) entries with redundant MFT record number (useful for recovering damaged MFT files)	Commonly called NTFS 5.1 after the OS release. LFS version 1.1 was replaced by version 2.0 as of Windows 8 to improve performance.

The NTFS.sys version number (e.g. v5.0 in Windows 2000) is based on the operating system version; it should not be confused with the NTFS version number (v3.1 since Windows XP).^[21]

Although subsequent versions of Windows added new file system-related features, they did not change NTFS itself. For example, Windows Vista implemented NTFS symbolic links, Transactional NTFS, partition shrinking, and self-healing.^[22] NTFS symbolic links are a new feature in the file system; all the others are new operating system features that make use of NTFS features already in place.

Scalability[edit]

NTFS is optimized for 4 KB^[a] clusters, but supports a maximum cluster size of 2 MB^[a]. (Earlier implementations support up to 64 KB)^[6] The maximum NTFS volume size that the specification can support is 2⁶⁴ − 1 clusters, but not all implementations achieve this theoretical maximum, as discussed below.

The maximum NTFS volume size implemented in Windows XP Professional is 2³² − 1 clusters, partly due to partition table limitations. For example, using 64 KB clusters, the maximum size Windows XP NTFS volume is 256 TB minus 64 KB. Using the default cluster size of 4 KB, the maximum NTFS volume size is 16 TB minus 4 KB. Both of these are vastly higher than the 128 GB^[a] limit in Windows XP SP1. Because partition tables on master boot record (MBR) disks support only partition sizes up to 2 TB, multiple GUID Partition Table (GPT or «dynamic») volumes must be combined to create a single NTFS volume larger than 2 TB. Booting from a GPT volume to a Windows environment in a Microsoft supported way requires a system with Unified Extensible Firmware Interface (UEFI) and 64-bit support.^[23]

The NTFS maximum theoretical limit on the size of individual files is 16 EB^[a][24] (16 × 1024⁶ or 2⁶⁴ bytes) minus 1 KB, which totals 18,446,744,073,709,550,592 bytes. With Windows 10 version 1709 and Windows Server 2019, the maximum implemented file size is 8 PB^[a] minus 2 MB or 9,007,199,252,643,840 bytes.^[6]

Interoperability[edit]

Windows[edit]

While the different NTFS versions are for the most part fully forward- and backward-compatible, there are technical considerations for mounting newer NTFS volumes in older versions of Microsoft Windows. This affects dual-booting, and external portable hard drives. For example, attempting to use an NTFS partition with «Previous Versions» (Volume Shadow Copy) on an operating system that does not support it will result in the contents of those previous versions being lost.^[15] A Windows command-line utility called convert.exe can convert supporting file systems to NTFS, including HPFS (only on Windows NT 3.1, 3.5, and 3.51), FAT16 and FAT32 (on Windows 2000 and later).^[25][26]

FreeBSD[edit]

FreeBSD 3.2 released in May 1999 included read-only NTFS support written by Semen Ustimenko.^[27][28] This implementation was ported to NetBSD by Christos Zoulas and Jaromir Dolecek and released with NetBSD 1.5 in December 2000.^[29] The FreeBSD implementation of NTFS was also ported to OpenBSD by Julien Bordet and offers native read-only NTFS support by default on i386 and amd64 platforms as of version 4.9 released 1 May 2011.^[30][28]

Linux[edit]

Linux kernel versions 2.1.74 and later include a driver written by Martin von Löwis which has the ability to read NTFS partitions;^[31] kernel versions 2.5.11 and later contain a new driver written by Anton Altaparmakov (University of Cambridge) and Richard Russon which supports file read.^[32][33][31] The ability to write to files was introduced with kernel version 2.6.15 in 2006 which allows users to write to existing files but does not allow the creation of new ones.^[34] Paragon’s NTFS driver (see below) has been merged into kernel version 5.15, and it supports read/write on normal, compressed and sparse files, as well as journal replaying.^[35]

NTFS-3G is a free GPL-licensed FUSE implementation of NTFS that was initially developed as a Linux kernel driver by Szabolcs Szakacsits. It was re-written as a FUSE program to work on other systems that FUSE supports like macOS, FreeBSD, NetBSD, OpenBSD,^[36] Solaris, QNX, and Haiku^[37] and allows reading and writing to NTFS partitions. A performance enhanced commercial version of NTFS-3G, called «Tuxera NTFS for Mac», is also available from the NTFS-3G developers.^[38]

Captive NTFS, a ‘wrapping’ driver that uses Windows’ own driver ntfs.sys, exists for Linux. It was built as a Filesystem in Userspace (FUSE) program and released under the GPL but work on Captive NTFS ceased in 2006.^[39]

Linux kernel versions 5.15 onwards carry NTFS3, a fully functional NTFS Read-Write driver which works on NTFS versions up to 3.1 and is maintained primarily by the Paragon Software Group with the source code found here.

Mac OS[edit]

Mac OS X 10.3 included Ustimenko’s read-only implementation of NTFS from FreeBSD. Then in 2006 Apple hired Anton Altaparmakov to write a new NTFS implementation for Mac OS X 10.6.^[40] Native NTFS write support is included in 10.6 and later, but is not activated by default, although workarounds do exist to enable the functionality. However, user reports indicate the functionality is unstable and tends to cause kernel panics.^[41]

Paragon Software Group sells a read-write driver named NTFS for Mac OS X,^[42] which is also included on some models of Seagate hard drives.^[43]

OS/2[edit]

The NetDrive package for OS/2 (and derivatives such as eComStation and ArcaOS) supports a plugin which allows read and write access to NTFS volumes.^[44][45]

DOS[edit]

There is a free-for-personal-use read/write driver for MS-DOS by Avira called «NTFS4DOS».^[46][47]

Ahead Software developed a «NTFSREAD» driver (version 1.200) for DR-DOS 7.0x between 2002 and 2004. It was part of their Nero Burning ROM software.

Security[edit]

NTFS uses access control lists and user-level encryption to help secure user data.

Access control lists (ACLs)[edit]

In NTFS, each file or folder is assigned a security descriptor that defines its owner and contains two access control lists (ACLs). The first ACL, called discretionary access control list (DACL), defines exactly what type of interactions (e.g. reading, writing, executing or deleting) are allowed or forbidden by which user or groups of users. For example, files in the C:Program Files folder may be read and executed by all users but modified only by a user holding administrative privileges.^[48] Windows Vista adds mandatory access control info to DACLs. DACLs are the primary focus of User Account Control in Windows Vista and later.

The second ACL, called system access control list (SACL), defines which interactions with the file or folder are to be audited and whether they should be logged when the activity is successful, failed or both. For example, auditing can be enabled on sensitive files of a company, so that its managers get to know when someone tries to delete them or make a copy of them, and whether he or she succeeds.^[48]

Encryption[edit]

Encrypting File System (EFS) provides user-transparent encryption of any file or folder on an NTFS volume.^[49] EFS works in conjunction with the EFS service, Microsoft’s CryptoAPI and the EFS File System Run-Time Library (FSRTL). EFS works by encrypting a file with a bulk symmetric key (also known as the File Encryption Key, or FEK), which is used because it takes a relatively small amount of time to encrypt and decrypt large amounts of data than if an asymmetric key cipher is used. The symmetric key that is used to encrypt the file is then encrypted with a public key that is associated with the user who encrypted the file, and this encrypted data is stored in an alternate data stream of the encrypted file. To decrypt the file, the file system uses the private key of the user to decrypt the symmetric key that is stored in the data stream. It then uses the symmetric key to decrypt the file. Because this is done at the file system level, it is transparent to the user.^[50] Also, in case of a user losing access to their key, support for additional decryption keys has been built into the EFS system, so that a recovery agent can still access the files if needed. NTFS-provided encryption and NTFS-provided compression are mutually exclusive; however, NTFS can be used for one and a third-party tool for the other.

The support of EFS is not available in Basic, Home, and MediaCenter versions of Windows, and must be activated after installation of Professional, Ultimate, and Server versions of Windows or by using enterprise deployment tools within Windows domains.

Features[edit]

Journaling[edit]

NTFS is a journaling file system and uses the NTFS Log ($LogFile) to record metadata changes to the volume. It is a feature that FAT does not provide and critical for NTFS to ensure that its complex internal data structures will remain consistent in case of system crashes or data moves performed by the defragmentation API, and allow easy rollback of uncommitted changes to these critical data structures when the volume is remounted. Notably affected structures are the volume allocation bitmap, modifications to MFT records such as moves of some variable-length attributes stored in MFT records and attribute lists, and indices for directories and security descriptors.

The ($LogFile) format has evolved through several versions:

Windows Version	$LogFile format version
Windows NT 4.0	1.1
Windows 2000
Windows XP
Windows Vista
Windows 7
Windows 8	2.0
Windows 8.1
Windows 10

The incompatibility of the $LogFile versions implemented by Windows 8, Windows 10, Windows 11 prevents Windows 7 (and earlier versions of Windows) from recognizing version 2.0 of the $LogFile. Backward compatibility is provided by downgrading the $LogFile to version 1.1 when an NTFS volume is cleanly dismounted. It is again upgraded to version 2.0 when mounting on a compatible version of Windows. However, when hibernating to disk in the logoff state (a.k.a. Hybrid Boot or Fast Boot, which is enabled by default), mounted file systems are not dismounted, and thus the $LogFiles of any active file systems are not downgraded to version 1.1. The inability to process version 2.0 of the $LogFile by versions of Windows older than 8.0 results in an unnecessary invocation of the CHKDSK disk repair utility. This is particularly a concern in a multi-boot scenario involving pre- and post-8.0 versions of Windows, or when frequently moving a storage device between older and newer versions. A Windows Registry setting exists to prevent the automatic upgrade of the $LogFile to the newer version. The problem can also be dealt with by disabling Hybrid Boot.^[51]

The USN Journal (Update Sequence Number Journal) is a system management feature that records (in $Extend$UsnJrnl) changes to files, streams and directories on the volume, as well as their various attributes and security settings. The journal is made available for applications to track changes to the volume.^[52] This journal can be enabled or disabled on non-system volumes.^[53]

Hard links[edit]

The hard link feature allows different file names to directly refer to the same file contents. Hard links may link only to files in the same volume, because each volume has its own MFT.
Hard links were originally included to support the POSIX subsystem in Windows NT.^[54]

Although Hard links use the same MFT record (inode) which records file metadata such as file size, modification date, and attributes, NTFS also caches this data in the directory entry as a performance enhancement. This means that when listing the contents of a directory using FindFirstFile/FindNextFile family of APIs, (equivalent to the POSIX opendir/readdir APIs) you will also receive this cached information, in addition to the name and inode. However, you may not see up-to-date information, as this information is only guaranteed to be updated when a file is closed, and then only for the directory from which the file was opened.^[55] This means where a file has multiple names via hard links, updating a file via one name does not update the cached data associated with the other name. You can always obtain up-to-date data using GetFileInformationByHandle (which is the true equivalent of POSIX stat function). This can be done using a handle which has no access to the file itself (passing zero to CreateFile for dwDesiredAccess), and closing this handle has the incidental effect of updating the cached information.

Windows uses hard links to support short (8.3) filenames in NTFS. Operating system support is needed because there are legacy applications that can work only with 8.3 filenames, but support can be disabled. In this case, an additional filename record and directory entry is added, but both 8.3 and long file name are linked and updated together, unlike a regular hard link.

The NTFS file system has a limit of 1024 hard links on a file.^[56]

Alternate data stream (ADS)[edit]

Alternate data streams allow more than one data stream to be associated with a filename (a fork), using the format «filename:streamname» (e.g., «text.txt:extrastream»).

NTFS Streams were introduced in Windows NT 3.1, to enable Services for Macintosh (SFM) to store resource forks. Although current versions of Windows Server no longer include SFM, third-party Apple Filing Protocol (AFP) products (such as GroupLogic’s ExtremeZ-IP) still use this feature of the file system. Very small ADSs (named «Zone.Identifier») are added by Internet Explorer and recently^[when?] by other browsers to mark files downloaded from external sites as possibly unsafe to run; the local shell would then require user confirmation before opening them.^[57] When the user indicates that they no longer want this confirmation dialog, this ADS is deleted.

Alternate streams are not listed in Windows Explorer, and their size is not included in the file’s size. When the file is copied or moved to another file system without ADS support the user is warned that alternate data streams cannot be preserved. No such warning is typically provided if the file is attached to an e-mail, or uploaded to a website. Thus, using alternate streams for critical data may cause problems. Microsoft provides a tool called Streams^[58] to view streams on a selected volume. Starting with Windows PowerShell 3.0, it is possible to manage ADS natively with six cmdlets: Add-Content, Clear-Content, Get-Content, Get-Item, Remove-Item, Set-Content.^[59]

Malware has used alternate data streams to hide code.^[60] As a result, malware scanners and other special tools now check for alternate data streams.

File compression[edit]

Compression is enabled on a per-folder or per-file basis by setting the ‘compressed’ attribute. When compression is enabled on a folder, any files moved or saved to that folder will be automatically compressed using LZNT1 algorithm (a variant of LZ77).^[61] The compression algorithm is designed to support cluster sizes of up to 4 KB; when the cluster size is greater than 4 KB on an NTFS volume, NTFS compression is not available.^[62] Data is compressed in 16-cluster chunks (up to 64 KB in size); if the compression reduces 64 KB of data to 60 KB or less, NTFS treats the unneeded 4 KB pages like empty sparse file clusters—they are not written. This allows for reasonable random-access times as the OS merely has to follow the chain of fragments.

Compression works best with files that have repetitive content, are seldom written, are usually accessed sequentially, and are not themselves compressed. Single-user systems with limited hard disk space can benefit from NTFS compression for small files, from 4 KB to 64 KB or more, depending on compressibility. Files smaller than approximately 900 bytes are stored within the directory entry of the MFT.^[63]

Advantages[edit]

Users of fast multi-core processors will find improvements in application speed by compressing their applications and data as well as a reduction in space used. Even when SSD controllers already compress data, there is still a reduction in I/Os since less data is transferred.^[64]

According to research by Microsoft’s NTFS Development team, 50–60 GB is a reasonable maximum size for a compressed file on an NTFS volume with a 4 KB (default) cluster (block) size. This reasonable maximum size decreases sharply for volumes with smaller cluster sizes.^[65]

Disadvantages[edit]

Large compressible files become highly fragmented since every chunk smaller than 64 KB becomes a fragment.^[65][66] Flash memory, such as SSD drives do not have the head movement delays and high access time of mechanical hard disk drives, so fragmentation has only a smaller penalty.

If system files that are needed at boot time (such as drivers, NTLDR, winload.exe, or BOOTMGR) are compressed, the system may fail to boot correctly, because decompression filters are not yet loaded.^{[67][failed verification]} Later editions of Windows^[which?] do not allow important system files to be compressed.

System compression[edit]

Since Windows 10, Microsoft has introduced new file compression scheme based on the XPRESS algorithm with 4K/8K/16K block size^[68] and the LZX algorithm;^[69] both are variants of LZ77 updated with Huffman entropy coding and range coding, which LZNT1 lacked. These compression algorithms were taken from Windows Imaging Format (WIM file).

The new compression scheme is used by CompactOS feature, which reduces disk usage by compressing Windows system files.^[70] CompactOS is not an extension of NTFS file compression and does not use the ‘compressed’ attribute; instead, it sets a reparse point on each compressed file with a WOF (Windows Overlay Filter) tag,^[71] but the actual data is stored in an alternate data stream named «WofCompressedData», which is decompressed on-the-fly by a WOF filesystem filter driver, and the main file is an empty sparse file.^[71] This design is meant purely for read-only access, so any writes to compressed files result in an automatic decompression.^[71][72][73]

CompactOS compression is intended for OEMs who prepare OS images with the /compact flag of the DISM tool in Windows ADK,^[74] but it can also be manually turned on per file with the /exe flag of the compact command.^[75] CompactOS algorithm avoids file fragmentation by writing compressed data in contiguously allocated chunks, unlike core NTFS compression.^{[citation needed]}

CompactOS file compression is an improved version of WIMBoot feature introduced in Windows 8.1. WIMBoot reduces Windows disk usage by keeping system files in a compressed WIM image on a separate hidden disk partition.^[76] Similarly to CompactOS, Windows system directories only contain sparse files marked by a reparse point with a WOF tag, and Windows Overlay Filter driver decompresses file contents on-the-fly from the WIM image. WIMBoot is less effective than CompactOS though, as new updated versions of system files need to be written to the system partition, consuming disk space.^[71]

Sparse files[edit]

Sparse files are files interspersed with empty segments for which no actual storage space is used. To the applications, the file looks like an ordinary file with empty regions seen as regions filled with zeros; the file system maintains an internal list of such regions for each sparse file.^[77] A sparse file does not necessarily include sparse zeros areas; the «sparse file» attribute just means that the file is allowed to have them.

Database applications, for instance, may use sparse files.^[78] As with compressed files, the actual sizes of sparse files are not taken into account when determining quota limits.^[79]

Volume Shadow Copy[edit]

The Volume Shadow Copy Service (VSS) keeps historical versions of files and folders on NTFS volumes by copying old, newly overwritten data to shadow copy via copy-on-write technique. The user may later request an earlier version to be recovered. This also allows data backup programs to archive files currently in use by the file system.

Windows Vista also introduced persistent shadow copies for use with System Restore and Previous Versions features. Persistent shadow copies, however, are deleted when an older operating system mounts that NTFS volume. This happens because the older operating system does not understand the newer format of persistent shadow copies.^[80]

Transactions[edit]

As of Windows Vista, applications can use Transactional NTFS (TxF) to group multiple changes to files together into a single transaction. The transaction will guarantee that either all of the changes happen, or none of them do, and that no application outside the transaction will see the changes until they are committed.^[81]

It uses similar techniques as those used for Volume Shadow Copies (i.e. copy-on-write) to ensure that overwritten data can be safely rolled back, and a CLFS log to mark the transactions that have still not been committed, or those that have been committed but still not fully applied (in case of system crash during a commit by one of the participants).

Transactional NTFS does not restrict transactions to just the local NTFS volume, but also includes other transactional data or operations in other locations such as data stored in separate volumes, the local registry, or SQL databases, or the current states of system services or remote services. These transactions are coordinated network-wide with all participants using a specific service, the DTC, to ensure that all participants will receive same commit state, and to transport the changes that have been validated by any participant (so that the others can invalidate their local caches for old data or rollback their ongoing uncommitted changes). Transactional NTFS allows, for example, the creation of network-wide consistent distributed file systems, including with their local live or offline caches.

Microsoft now advises against using TxF: «Microsoft strongly recommends developers utilize alternative means» since «TxF may not be available in future versions of Microsoft Windows».^[82]

Quotas[edit]

Disk quotas were introduced in NTFS v3. They allow the administrator of a computer that runs a version of Windows that supports NTFS to set a threshold of disk space that users may use. It also allows administrators to keep track of how much disk space each user is using. An administrator may specify a certain level of disk space that a user may use before they receive a warning, and then deny access to the user once they hit their upper limit of space. Disk quotas do not take into account NTFS’s transparent file-compression, should this be enabled. Applications that query the amount of free space will also see the amount of free space left to the user who has a quota applied to them.

Reparse points[edit]

Introduced in NTFS v3, NTFS reparse points are used by associating a reparse tag in the user space attribute of a file or directory. Microsoft includes several default tags including symbolic links, directory junction points and volume mount points. When the Object Manager parses a file system name lookup and encounters a reparse attribute, it will reparse the name lookup, passing the user controlled reparse data to every file system filter driver that is loaded into Windows. Each filter driver examines the reparse data to see whether it is associated with that reparse point, and if that filter driver determines a match, then it intercepts the file system request and performs its special functionality.

Limitations[edit]

Resizing[edit]

Starting with Windows Vista Microsoft added the built-in ability to shrink or expand a partition. However, this ability does not relocate page file fragments or files that have been marked as unmovable, so shrinking a volume will often require relocating or disabling any page file, the index of Windows Search, and any Shadow Copy used by System Restore. Various third-party tools are capable of resizing NTFS partitions.

OneDrive[edit]

Since 2017, Microsoft requires the OneDrive file structure to reside on an NTFS disk.^[83] This is because OneDrive Files On-Demand feature uses NTFS reparse points to link files and folders that are stored in OneDrive to the local filesystem, making the file or folder unusable with any previous version of Windows, with any other NTFS file system driver, or any file system and backup utilities not updated to support it.^[84]

Structure[edit]

NTFS is made up of several components including: a partition boot sector (PBS) that holds boot information; the master file table that stores a record of all files and folders in the filesystem; a series of meta files that help structure meta data more efficiently; data streams and locking mechanisms.

Internally, NTFS uses B-trees to index file system data. A file system journal is used to guarantee the integrity of the file system metadata but not individual files’ content. Systems using NTFS are known to have improved reliability compared to FAT file systems.^[85]

NTFS allows any sequence of 16-bit values for name encoding (e.g. file names, stream names or index names) except 0x0000. This means UTF-16 code units are supported, but the file system does not check whether a sequence is valid UTF-16 (it allows any sequence of short values, not restricted to those in the Unicode standard). In Win32 namespace, any UTF-16 code units are case insensitive whereas in POSIX namespace they are case sensitive. File names are limited to 255 UTF-16 code units. Certain names are reserved in the volume root directory and cannot be used for files. These are $MFT, $MFTMirr, $LogFile, $Volume, $AttrDef, . (dot), $Bitmap, $Boot, $BadClus, $Secure, $UpCase, and $Extend.^[5] . (dot) and $Extend are both directories; the others are files. The NT kernel limits full paths to 32,767 UTF-16 code units. There are some additional restrictions on code points and file names.^[86]

Partition Boot Sector (PBS)[edit]

This boot partition format is roughly based upon the earlier FAT filesystem, but the fields are in different locations. Some of these fields, especially the «sectors per track», «number of heads» and «hidden sectors» fields may contain dummy values on drives where they either do not make sense or are not determinable.

The OS first looks at the 8 bytes at 0x30 to find the cluster number of the $MFT, then multiplies that number by the number of sectors per cluster (1 byte found at 0x0D). This value is the sector offset (LBA) to the $MFT, which is described below.

Master File Table[edit]

In NTFS, all file, directory and metafile data—file name, creation date, access permissions (by the use of access control lists), and size—are stored as metadata in the Master File Table (MFT). This abstract approach allowed easy addition of file system features during Windows NT’s development—an example is the addition of fields for indexing used by the Active Directory and the Windows Search. This also enables fast file search software to locate named local files and folders included in the MFT very quickly, without requiring any other index.

The MFT structure supports algorithms which minimize disk fragmentation.^[89] A directory entry consists of a filename and a «file ID» (analogous to the inode number), which is the record number representing the file in the Master File Table. The file ID also contains a reuse count to detect stale references. While this strongly resembles the W_FID of Files-11, other NTFS structures radically differ.

A partial copy of the MFT, called the MFT mirror, is stored to be used in case of corruption.^[90] If the first record of the MFT is corrupted, NTFS reads the second record to find the MFT mirror file. Locations for both files are stored in the boot sector.^[91]

Metafiles[edit]

NTFS contains several files that define and organize the file system. In all respects, most of these files are structured like any other user file ($Volume being the most peculiar), but are not of direct interest to file system clients.^[92] These metafiles define files, back up critical file system data, buffer file system changes, manage free space allocation, satisfy BIOS expectations, track bad allocation units, and store security and disk space usage information. All content is in an unnamed data stream, unless otherwise indicated.

These metafiles are treated specially by Windows, handled directly by the NTFS.SYS driver and are difficult to directly view: special purpose-built tools are needed.^[93] As of Windows 7, the NTFS driver completely prohibits user access, resulting in a BSoD whenever an attempt to execute a metadata file is made. One such tool is the nfi.exe («NTFS File Sector Information Utility») that is freely distributed as part of the Microsoft «OEM Support Tools». For example, to obtain information on the «$MFT»-Master File Table Segment the following command is used: nfi.exe c:$MFT^[94] Another way to bypass the restriction is to use 7-Zip’s file manager and go to the low-level NTFS path \.X: (where X: resembles any drive/partition). Here, 3 new folders will appear: $EXTEND, [DELETED] (a pseudo-folder that 7-Zip uses to attach files deleted from the file system to view), and [SYSTEM] (another pseudo-folder that contains all the NTFS metadata files). This trick can be used from removable devices (USB flash drives, external hard drives, SD Cards, etc.) inside Windows, but doing this on the active partition requires offline access (namely WinRE).

Attribute lists, attributes, and streams[edit]

For each file (or directory) described in the MFT record, there is a linear repository of stream descriptors (also named attributes), packed together in one or more MFT records (containing the so-called attributes list), with extra padding to fill the fixed 1 KB size of every MFT record, and that fully describes the effective streams associated with that file.

Each attribute has an attribute type (a fixed-size integer mapping to an attribute definition in file $AttrDef), an optional attribute name (for example, used as the name for an alternate data stream), and a value, represented in a sequence of bytes. For NTFS, the standard data of files, the alternate data streams, or the index data for directories are stored as attributes.

According to $AttrDef, some attributes can be either resident or non-resident. The $DATA attribute, which contains file data, is such an example. When the attribute is resident (which is represented by a flag), its value is stored directly in the MFT record. Otherwise, clusters are allocated for the data, and the cluster location information is stored as data runs in the attribute.

• For each file in the MFT, the attributes identified by attribute type, attribute name must be unique. Additionally, NTFS has some ordering constraints for these attributes.
• There is a predefined null attribute type, used to indicate the end of the list of attributes in one MFT record. It must be present as the last attribute in the record (all other storage space available after it will be ignored and just consists of padding bytes to match the record size in the MFT).
• Some attribute types are required and must be present in each MFT record, except unused records that are just indicated by null attribute types.
  • This is the case for the $STANDARD_INFORMATION attribute that is stored as a fixed-size record and contains the timestamps and other basic single-bit attributes (compatible with those managed by FAT in DOS or Windows 9x).
• Some attribute types cannot have a name and must remain anonymous.
  • This is the case for the standard attributes, or for the preferred NTFS «filename» attribute type, or the «short filename» attribute type, when it is also present (for compatibility with DOS-like applications, see below). It is also possible for a file to contain only a short filename, in which case it will be the preferred one, as listed in the Windows Explorer.
  • The filename attributes stored in the attribute list do not make the file immediately accessible through the hierarchical file system. In fact, all the filenames must be indexed separately in at least one other directory on the same volume. There it must have its own MFT record and its own security descriptors and attributes that reference the MFT record number for this file. This allows the same file or directory to be «hardlinked» several times from several containers on the same volume, possibly with distinct filenames.
• The default data stream of a regular file is a stream of type $DATA but with an anonymous name, and the ADSs are similar but must be named.
• On the other hand, the default data stream of directories has a distinct type, but are not anonymous: they have an attribute name («$I30» in NTFS 3+) that reflects its indexing format.

All attributes of a given file may be displayed by using the nfi.exe («NTFS File Sector Information Utility») that is freely distributed as part of the Microsoft «OEM Support Tools».^[94]

Windows system calls may handle alternate data streams.^[5] Depending on the operating system, utility and remote file system, a file transfer might silently strip data streams.^[5] A safe way of copying or moving files is to use the BackupRead and BackupWrite system calls, which allow programs to enumerate streams, to verify whether each stream should be written to the destination volume and to knowingly skip unwanted streams.^[5]

Resident vs. non-resident attributes[edit]

To optimize the storage and reduce the I/O overhead for the very common case of attributes with very small associated value, NTFS prefers to place the value within the attribute itself (if the size of the attribute does not then exceed the maximum size of an MFT record), instead of using the MFT record space to list clusters containing the data; in that case, the attribute will not store the data directly but will just store an allocation map (in the form of data runs) pointing to the actual data stored elsewhere on the volume.^[95] When the value can be accessed directly from within the attribute, it is called «resident data» (by computer forensics workers). The amount of data that fits is highly dependent on the file’s characteristics, but 700 to 800 bytes is common in single-stream files with non-lengthy filenames and no ACLs.

• Some attributes (such as the preferred filename, the basic file attributes) cannot be made non-resident. For non-resident attributes, their allocation map must fit within MFT records.
• Encrypted-by-NTFS, sparse data streams, or compressed data streams cannot be made resident.
• The format of the allocation map for non-resident attributes depends on its capability of supporting sparse data storage. In the current implementation of NTFS, once a non-resident data stream has been marked and converted as sparse, it cannot be changed back to non-sparse data, so it cannot become resident again, unless this data is fully truncated, discarding the sparse allocation map completely.
• When a non-resident attribute is so fragmented, that its effective allocation map cannot fit entirely within one MFT record, NTFS stores the attribute in multiple records. The first one among them is called the base record, while the others are called extension records. NTFS creates a special attribute $ATTRIBUTE_LIST to store information mapping different parts of the long attribute to the MFT records, which means the allocation map may be split into multiple records. The $ATTRIBUTE_LIST itself can also be non-resident, but its own allocation map must fit within one MFT record.
• When there are too many attributes for a file (including ADS’s, extended attributes, or security descriptors), so that they cannot fit all within the MFT record, extension records may also be used to store the other attributes, using the same format as the one used in the base MFT record, but without the space constraints of one MFT record.

The allocation map is stored in a form of data runs with compressed encoding. Each data run represents a contiguous group of clusters that store the attribute value. For files on a multi-GB volume, each entry can be encoded as 5 to 7 bytes, which means a 1 KB MFT record can store about 100 such data runs. However, as the $ATTRIBUTE_LIST also has a size limit, it is dangerous to have more than 1 million fragments of a single file on an NTFS volume, which also implies that it is in general not a good idea to use NTFS compression on a file larger than 10 GB.^[96]

The NTFS file system driver will sometimes attempt to relocate the data of some of the attributes that can be made non-resident into the clusters, and will also attempt to relocate the data stored in clusters back to the attribute inside the MFT record, based on priority and preferred ordering rules, and size constraints.

Since resident files do not directly occupy clusters («allocation units»), it is possible for an NTFS volume to contain more files on a volume than there are clusters. For example, a 74.5 GB partition NTFS formats with 19,543,064 clusters of 4 KB. Subtracting system files (a 64 MB log file, a 2,442,888-byte Bitmap file, and about 25 clusters of fixed overhead) leaves 19,526,158 clusters free for files and indices. Since there are four MFT records per cluster, this volume theoretically could hold almost 4 × 19,526,158 = 78,104,632 resident files.

Opportunistic locks[edit]

Opportunistic file locks (oplocks) allow clients to alter their buffering strategy for a given file or stream in order to increase performance and reduce network use.^[97] Oplocks apply to the given open stream of a file and do not affect oplocks on a different stream.

Oplocks can be used to transparently access files in the background. A network client may avoid writing information into a file on a remote server if no other process is accessing the data, or it may buffer read-ahead data if no other process is writing data.

Windows supports four different types of oplocks:

• Level 2 (or shared) oplock: multiple readers, no writers (i.e. read caching).
• Level 1 (or exclusive) oplock: exclusive access with arbitrary buffering (i.e. read and write caching).
• Batch oplock (also exclusive): a stream is opened on the server, but closed on the client machine (i.e. read, write and handle caching).
• Filter oplock (also exclusive): applications and file system filters can «back out» when others try to access the same stream (i.e. read and write caching) (since Windows 2000)

Opportunistic locks have been enhanced in Windows 7 and Windows Server 2008 R2 with per-client oplock keys.^[98]

Time[edit]

Windows NT and its descendants keep internal timestamps as UTC and make the appropriate conversions for display purposes; all NTFS timestamps are in UTC.^{[citation needed]}

For historical reasons, the versions of Windows that do not support NTFS all keep time internally as local zone time, and therefore so do all file systems – other than NTFS – that are supported by current versions of Windows. This means that when files are copied or moved between NTFS and non-NTFS partitions, the OS needs to convert timestamps on the fly. But if some files are moved when daylight saving time (DST) is in effect, and other files are moved when standard time is in effect, there can be some ambiguities in the conversions. As a result, especially shortly after one of the days on which local zone time changes, users may observe that some files have timestamps that are incorrect by one hour. Due to the differences in implementation of DST in different jurisdictions, this can result in a potential timestamp error of up to 4 hours in any given 12 months.^[99]

See also[edit]

• Comparison of file systems
• NTFSDOS
• ntfsresize
• WinFS (a canceled Microsoft filesystem)
• ReFS, a newer Microsoft filesystem

Notes[edit]

References[edit]

Further reading[edit]

New Technology File System^[1]

Developer(s)	Microsoft
Full name	NT File System[2]
Introduced	July 1993; 29 years ago with Windows NT 3.1
Partition identifier	0x07 (MBR) EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (GPT)
Structures
Directory contents	B-tree variant[3][4]
File allocation	Bitmap
Bad blocks	$BadClus (MFT Record)
Limits
Max. volume size	264 clusters − 1 cluster (format); 256 TB[a] − 64 KB[a] (Windows 10 version 1703, Windows Server 2016 or earlier implementation)[5] 8 PB − 2 MB[a] (Windows 10 version 1709, Windows Server 2019 or later implementation)[6]
Max. file size	16 EB[a] − 1 KB (format); 16 TB − 64 KB (Windows 7, Windows Server 2008 R2 or earlier implementation)[5] 256 TB − 64 KB (Windows 8, Windows Server 2012 or later implementation)[7] 8 PB − 2 MB (Windows 10 version 1709, Windows Server 2019 or later implementation)[6]
Max. number of files	4,294,967,295 (232−1)[5]
Max. filename length	255 UTF-16 code units[8]
Allowed characters in filenames	In Win32 namespace: any UTF-16 code unit (case-insensitive) except /:*"?<>| as well as NUL[8] In POSIX namespace: any UTF-16 code unit (case-sensitive) except / as well as NUL Trailing spaces are not allowed and will be removed[9]
Features
Dates recorded	Creation, modification, POSIX change, access
Date range	1 January 1601 – 28 May 60056 (File times are 63-bit numbers counting 100-nanosecond intervals (ten million per second) since 1601, which is 29,227 years)
Date resolution	100 ns
Forks	Yes (see § Alternate data stream (ADS) below)
Attributes	Read-only, hidden, system, archive, not content indexed, off-line, temporary, compressed, encrypted
File system permissions	ACLs
Transparent compression	Per-file, LZ77 (Windows NT 3.51 onward)
Transparent encryption	Per-file, DESX (Windows 2000 onward), Triple DES (Windows XP onward), AES (Windows XP Service Pack 1, Windows Server 2003 onward)
Data deduplication	Yes (Windows Server 2012)[10]
Other
Supported operating systems	Windows NT 3.1 and later Mac OS X 10.3 and later (read-only) Linux kernel version 2.6 and later Linux kernel versions 2.2-2.4 (read-only) FreeBSD NetBSD OpenBSD (read-only) ChromeOS Solaris ReactOS (read-only)

New Technology File System (NTFS) is a proprietary journaling file system developed by Microsoft.^[2][1] Starting with Windows NT 3.1, it is the default file system of the Windows NT family.^[11] It superseded File Allocation Table (FAT) as the preferred filesystem on Windows and is supported in Linux and BSD as well. NTFS reading and writing support is provided using a free and open-source kernel implementation known as NTFS3 in Linux and the NTFS-3G driver in BSD.^[12][13] By using the convert command, Windows can convert FAT32/16/12 into NTFS without the need to rewrite all files.^[14] NTFS uses several files typically hidden from the user to store metadata about other files stored on the drive which can help improve speed and performance when reading data.^[1] Unlike FAT and High Performance File System (HPFS), NTFS supports access control lists (ACLs), filesystem encryption, transparent compression, sparse files and file system journaling. NTFS also supports shadow copy to allow backups of a system while it is running, but the functionality of the shadow copies varies between different versions of Windows.^[15]

History[edit]

In the mid-1980s, Microsoft and IBM formed a joint project to create the next generation of graphical operating system; the result was OS/2 and HPFS. Because Microsoft disagreed with IBM on many important issues, they eventually separated; OS/2 remained an IBM project and Microsoft worked to develop Windows NT and NTFS.

The HPFS file system for OS/2 contained several important new features. When Microsoft created their new operating system, they «borrowed» many of these concepts for NTFS.^[16] The original NTFS developers were Tom Miller, Gary Kimura, Brian Andrew, and David Goebel.^[17]

Probably as a result of this common ancestry, HPFS and NTFS use the same disk partition identification type code (07). Using the same Partition ID Record Number is highly unusual, since there were dozens of unused code numbers available, and other major file systems have their own codes. For example, FAT has more than nine (one each for FAT12, FAT16, FAT32, etc.). Algorithms identifying the file system in a partition type 07 must perform additional checks to distinguish between HPFS and NTFS.

Versions[edit]

Microsoft has released five versions of NTFS:

NTFS version number	First operating system	Release date	New features	Remarks
1.0	Windows NT 3.1	1993[11]	Initial version	NTFS 1.0 is incompatible with 1.1 and newer: volumes written by Windows NT 3.5x cannot be read by Windows NT 3.1 until an update (available on the NT 3.5x installation media) is installed.[18]
1.1	Windows NT 3.51	1995	Compressed files, named streams, and access control lists[19]
1.2	Windows NT 4.0	1996	Security descriptors	Commonly called NTFS 4.0 after the OS release
3.0	Windows 2000	2000	Disk quotas, file-level encryption in a form of Encrypting File System, sparse files, reparse points, update sequence number (USN) journaling, distributed link tracking, the $Extend folder and its files	Compatibility was also made available for Windows NT 4.0 with the Service Pack 4 update. Commonly called NTFS 5.0 after the OS release.[20]
3.1	Windows XP	October 2001	Expanded the Master File Table (MFT) entries with redundant MFT record number (useful for recovering damaged MFT files)	Commonly called NTFS 5.1 after the OS release. LFS version 1.1 was replaced by version 2.0 as of Windows 8 to improve performance.

The NTFS.sys version number (e.g. v5.0 in Windows 2000) is based on the operating system version; it should not be confused with the NTFS version number (v3.1 since Windows XP).^[21]

Although subsequent versions of Windows added new file system-related features, they did not change NTFS itself. For example, Windows Vista implemented NTFS symbolic links, Transactional NTFS, partition shrinking, and self-healing.^[22] NTFS symbolic links are a new feature in the file system; all the others are new operating system features that make use of NTFS features already in place.

Scalability[edit]

NTFS is optimized for 4 KB^[a] clusters, but supports a maximum cluster size of 2 MB^[a]. (Earlier implementations support up to 64 KB)^[6] The maximum NTFS volume size that the specification can support is 2⁶⁴ − 1 clusters, but not all implementations achieve this theoretical maximum, as discussed below.

The maximum NTFS volume size implemented in Windows XP Professional is 2³² − 1 clusters, partly due to partition table limitations. For example, using 64 KB clusters, the maximum size Windows XP NTFS volume is 256 TB minus 64 KB. Using the default cluster size of 4 KB, the maximum NTFS volume size is 16 TB minus 4 KB. Both of these are vastly higher than the 128 GB^[a] limit in Windows XP SP1. Because partition tables on master boot record (MBR) disks support only partition sizes up to 2 TB, multiple GUID Partition Table (GPT or «dynamic») volumes must be combined to create a single NTFS volume larger than 2 TB. Booting from a GPT volume to a Windows environment in a Microsoft supported way requires a system with Unified Extensible Firmware Interface (UEFI) and 64-bit support.^[23]

The NTFS maximum theoretical limit on the size of individual files is 16 EB^[a][24] (16 × 1024⁶ or 2⁶⁴ bytes) minus 1 KB, which totals 18,446,744,073,709,550,592 bytes. With Windows 10 version 1709 and Windows Server 2019, the maximum implemented file size is 8 PB^[a] minus 2 MB or 9,007,199,252,643,840 bytes.^[6]

Interoperability[edit]

Windows[edit]

While the different NTFS versions are for the most part fully forward- and backward-compatible, there are technical considerations for mounting newer NTFS volumes in older versions of Microsoft Windows. This affects dual-booting, and external portable hard drives. For example, attempting to use an NTFS partition with «Previous Versions» (Volume Shadow Copy) on an operating system that does not support it will result in the contents of those previous versions being lost.^[15] A Windows command-line utility called convert.exe can convert supporting file systems to NTFS, including HPFS (only on Windows NT 3.1, 3.5, and 3.51), FAT16 and FAT32 (on Windows 2000 and later).^[25][26]

FreeBSD[edit]

FreeBSD 3.2 released in May 1999 included read-only NTFS support written by Semen Ustimenko.^[27][28] This implementation was ported to NetBSD by Christos Zoulas and Jaromir Dolecek and released with NetBSD 1.5 in December 2000.^[29] The FreeBSD implementation of NTFS was also ported to OpenBSD by Julien Bordet and offers native read-only NTFS support by default on i386 and amd64 platforms as of version 4.9 released 1 May 2011.^[30][28]

Linux[edit]

Linux kernel versions 2.1.74 and later include a driver written by Martin von Löwis which has the ability to read NTFS partitions;^[31] kernel versions 2.5.11 and later contain a new driver written by Anton Altaparmakov (University of Cambridge) and Richard Russon which supports file read.^[32][33][31] The ability to write to files was introduced with kernel version 2.6.15 in 2006 which allows users to write to existing files but does not allow the creation of new ones.^[34] Paragon’s NTFS driver (see below) has been merged into kernel version 5.15, and it supports read/write on normal, compressed and sparse files, as well as journal replaying.^[35]

NTFS-3G is a free GPL-licensed FUSE implementation of NTFS that was initially developed as a Linux kernel driver by Szabolcs Szakacsits. It was re-written as a FUSE program to work on other systems that FUSE supports like macOS, FreeBSD, NetBSD, OpenBSD,^[36] Solaris, QNX, and Haiku^[37] and allows reading and writing to NTFS partitions. A performance enhanced commercial version of NTFS-3G, called «Tuxera NTFS for Mac», is also available from the NTFS-3G developers.^[38]

Captive NTFS, a ‘wrapping’ driver that uses Windows’ own driver ntfs.sys, exists for Linux. It was built as a Filesystem in Userspace (FUSE) program and released under the GPL but work on Captive NTFS ceased in 2006.^[39]

Linux kernel versions 5.15 onwards carry NTFS3, a fully functional NTFS Read-Write driver which works on NTFS versions up to 3.1 and is maintained primarily by the Paragon Software Group with the source code found here.

Mac OS[edit]

Mac OS X 10.3 included Ustimenko’s read-only implementation of NTFS from FreeBSD. Then in 2006 Apple hired Anton Altaparmakov to write a new NTFS implementation for Mac OS X 10.6.^[40] Native NTFS write support is included in 10.6 and later, but is not activated by default, although workarounds do exist to enable the functionality. However, user reports indicate the functionality is unstable and tends to cause kernel panics.^[41]

Paragon Software Group sells a read-write driver named NTFS for Mac OS X,^[42] which is also included on some models of Seagate hard drives.^[43]

OS/2[edit]

The NetDrive package for OS/2 (and derivatives such as eComStation and ArcaOS) supports a plugin which allows read and write access to NTFS volumes.^[44][45]

DOS[edit]

There is a free-for-personal-use read/write driver for MS-DOS by Avira called «NTFS4DOS».^[46][47]

Ahead Software developed a «NTFSREAD» driver (version 1.200) for DR-DOS 7.0x between 2002 and 2004. It was part of their Nero Burning ROM software.

Security[edit]

NTFS uses access control lists and user-level encryption to help secure user data.

Access control lists (ACLs)[edit]

In NTFS, each file or folder is assigned a security descriptor that defines its owner and contains two access control lists (ACLs). The first ACL, called discretionary access control list (DACL), defines exactly what type of interactions (e.g. reading, writing, executing or deleting) are allowed or forbidden by which user or groups of users. For example, files in the C:Program Files folder may be read and executed by all users but modified only by a user holding administrative privileges.^[48] Windows Vista adds mandatory access control info to DACLs. DACLs are the primary focus of User Account Control in Windows Vista and later.

The second ACL, called system access control list (SACL), defines which interactions with the file or folder are to be audited and whether they should be logged when the activity is successful, failed or both. For example, auditing can be enabled on sensitive files of a company, so that its managers get to know when someone tries to delete them or make a copy of them, and whether he or she succeeds.^[48]

Encryption[edit]

Encrypting File System (EFS) provides user-transparent encryption of any file or folder on an NTFS volume.^[49] EFS works in conjunction with the EFS service, Microsoft’s CryptoAPI and the EFS File System Run-Time Library (FSRTL). EFS works by encrypting a file with a bulk symmetric key (also known as the File Encryption Key, or FEK), which is used because it takes a relatively small amount of time to encrypt and decrypt large amounts of data than if an asymmetric key cipher is used. The symmetric key that is used to encrypt the file is then encrypted with a public key that is associated with the user who encrypted the file, and this encrypted data is stored in an alternate data stream of the encrypted file. To decrypt the file, the file system uses the private key of the user to decrypt the symmetric key that is stored in the data stream. It then uses the symmetric key to decrypt the file. Because this is done at the file system level, it is transparent to the user.^[50] Also, in case of a user losing access to their key, support for additional decryption keys has been built into the EFS system, so that a recovery agent can still access the files if needed. NTFS-provided encryption and NTFS-provided compression are mutually exclusive; however, NTFS can be used for one and a third-party tool for the other.

The support of EFS is not available in Basic, Home, and MediaCenter versions of Windows, and must be activated after installation of Professional, Ultimate, and Server versions of Windows or by using enterprise deployment tools within Windows domains.

Features[edit]

Journaling[edit]

NTFS is a journaling file system and uses the NTFS Log ($LogFile) to record metadata changes to the volume. It is a feature that FAT does not provide and critical for NTFS to ensure that its complex internal data structures will remain consistent in case of system crashes or data moves performed by the defragmentation API, and allow easy rollback of uncommitted changes to these critical data structures when the volume is remounted. Notably affected structures are the volume allocation bitmap, modifications to MFT records such as moves of some variable-length attributes stored in MFT records and attribute lists, and indices for directories and security descriptors.

The ($LogFile) format has evolved through several versions:

Windows Version	$LogFile format version
Windows NT 4.0	1.1
Windows 2000
Windows XP
Windows Vista
Windows 7
Windows 8	2.0
Windows 8.1
Windows 10

The incompatibility of the $LogFile versions implemented by Windows 8, Windows 10, Windows 11 prevents Windows 7 (and earlier versions of Windows) from recognizing version 2.0 of the $LogFile. Backward compatibility is provided by downgrading the $LogFile to version 1.1 when an NTFS volume is cleanly dismounted. It is again upgraded to version 2.0 when mounting on a compatible version of Windows. However, when hibernating to disk in the logoff state (a.k.a. Hybrid Boot or Fast Boot, which is enabled by default), mounted file systems are not dismounted, and thus the $LogFiles of any active file systems are not downgraded to version 1.1. The inability to process version 2.0 of the $LogFile by versions of Windows older than 8.0 results in an unnecessary invocation of the CHKDSK disk repair utility. This is particularly a concern in a multi-boot scenario involving pre- and post-8.0 versions of Windows, or when frequently moving a storage device between older and newer versions. A Windows Registry setting exists to prevent the automatic upgrade of the $LogFile to the newer version. The problem can also be dealt with by disabling Hybrid Boot.^[51]

The USN Journal (Update Sequence Number Journal) is a system management feature that records (in $Extend$UsnJrnl) changes to files, streams and directories on the volume, as well as their various attributes and security settings. The journal is made available for applications to track changes to the volume.^[52] This journal can be enabled or disabled on non-system volumes.^[53]

Hard links[edit]

The hard link feature allows different file names to directly refer to the same file contents. Hard links may link only to files in the same volume, because each volume has its own MFT.
Hard links were originally included to support the POSIX subsystem in Windows NT.^[54]

Although Hard links use the same MFT record (inode) which records file metadata such as file size, modification date, and attributes, NTFS also caches this data in the directory entry as a performance enhancement. This means that when listing the contents of a directory using FindFirstFile/FindNextFile family of APIs, (equivalent to the POSIX opendir/readdir APIs) you will also receive this cached information, in addition to the name and inode. However, you may not see up-to-date information, as this information is only guaranteed to be updated when a file is closed, and then only for the directory from which the file was opened.^[55] This means where a file has multiple names via hard links, updating a file via one name does not update the cached data associated with the other name. You can always obtain up-to-date data using GetFileInformationByHandle (which is the true equivalent of POSIX stat function). This can be done using a handle which has no access to the file itself (passing zero to CreateFile for dwDesiredAccess), and closing this handle has the incidental effect of updating the cached information.

Windows uses hard links to support short (8.3) filenames in NTFS. Operating system support is needed because there are legacy applications that can work only with 8.3 filenames, but support can be disabled. In this case, an additional filename record and directory entry is added, but both 8.3 and long file name are linked and updated together, unlike a regular hard link.

The NTFS file system has a limit of 1024 hard links on a file.^[56]

Alternate data stream (ADS)[edit]

Alternate data streams allow more than one data stream to be associated with a filename (a fork), using the format «filename:streamname» (e.g., «text.txt:extrastream»).

NTFS Streams were introduced in Windows NT 3.1, to enable Services for Macintosh (SFM) to store resource forks. Although current versions of Windows Server no longer include SFM, third-party Apple Filing Protocol (AFP) products (such as GroupLogic’s ExtremeZ-IP) still use this feature of the file system. Very small ADSs (named «Zone.Identifier») are added by Internet Explorer and recently^[when?] by other browsers to mark files downloaded from external sites as possibly unsafe to run; the local shell would then require user confirmation before opening them.^[57] When the user indicates that they no longer want this confirmation dialog, this ADS is deleted.

Alternate streams are not listed in Windows Explorer, and their size is not included in the file’s size. When the file is copied or moved to another file system without ADS support the user is warned that alternate data streams cannot be preserved. No such warning is typically provided if the file is attached to an e-mail, or uploaded to a website. Thus, using alternate streams for critical data may cause problems. Microsoft provides a tool called Streams^[58] to view streams on a selected volume. Starting with Windows PowerShell 3.0, it is possible to manage ADS natively with six cmdlets: Add-Content, Clear-Content, Get-Content, Get-Item, Remove-Item, Set-Content.^[59]

Malware has used alternate data streams to hide code.^[60] As a result, malware scanners and other special tools now check for alternate data streams.

File compression[edit]

Compression is enabled on a per-folder or per-file basis by setting the ‘compressed’ attribute. When compression is enabled on a folder, any files moved or saved to that folder will be automatically compressed using LZNT1 algorithm (a variant of LZ77).^[61] The compression algorithm is designed to support cluster sizes of up to 4 KB; when the cluster size is greater than 4 KB on an NTFS volume, NTFS compression is not available.^[62] Data is compressed in 16-cluster chunks (up to 64 KB in size); if the compression reduces 64 KB of data to 60 KB or less, NTFS treats the unneeded 4 KB pages like empty sparse file clusters—they are not written. This allows for reasonable random-access times as the OS merely has to follow the chain of fragments.

Compression works best with files that have repetitive content, are seldom written, are usually accessed sequentially, and are not themselves compressed. Single-user systems with limited hard disk space can benefit from NTFS compression for small files, from 4 KB to 64 KB or more, depending on compressibility. Files smaller than approximately 900 bytes are stored within the directory entry of the MFT.^[63]

Advantages[edit]

Users of fast multi-core processors will find improvements in application speed by compressing their applications and data as well as a reduction in space used. Even when SSD controllers already compress data, there is still a reduction in I/Os since less data is transferred.^[64]

According to research by Microsoft’s NTFS Development team, 50–60 GB is a reasonable maximum size for a compressed file on an NTFS volume with a 4 KB (default) cluster (block) size. This reasonable maximum size decreases sharply for volumes with smaller cluster sizes.^[65]

Disadvantages[edit]

Large compressible files become highly fragmented since every chunk smaller than 64 KB becomes a fragment.^[65][66] Flash memory, such as SSD drives do not have the head movement delays and high access time of mechanical hard disk drives, so fragmentation has only a smaller penalty.

If system files that are needed at boot time (such as drivers, NTLDR, winload.exe, or BOOTMGR) are compressed, the system may fail to boot correctly, because decompression filters are not yet loaded.^{[67][failed verification]} Later editions of Windows^[which?] do not allow important system files to be compressed.

System compression[edit]

Since Windows 10, Microsoft has introduced new file compression scheme based on the XPRESS algorithm with 4K/8K/16K block size^[68] and the LZX algorithm;^[69] both are variants of LZ77 updated with Huffman entropy coding and range coding, which LZNT1 lacked. These compression algorithms were taken from Windows Imaging Format (WIM file).

The new compression scheme is used by CompactOS feature, which reduces disk usage by compressing Windows system files.^[70] CompactOS is not an extension of NTFS file compression and does not use the ‘compressed’ attribute; instead, it sets a reparse point on each compressed file with a WOF (Windows Overlay Filter) tag,^[71] but the actual data is stored in an alternate data stream named «WofCompressedData», which is decompressed on-the-fly by a WOF filesystem filter driver, and the main file is an empty sparse file.^[71] This design is meant purely for read-only access, so any writes to compressed files result in an automatic decompression.^[71][72][73]

CompactOS compression is intended for OEMs who prepare OS images with the /compact flag of the DISM tool in Windows ADK,^[74] but it can also be manually turned on per file with the /exe flag of the compact command.^[75] CompactOS algorithm avoids file fragmentation by writing compressed data in contiguously allocated chunks, unlike core NTFS compression.^{[citation needed]}

CompactOS file compression is an improved version of WIMBoot feature introduced in Windows 8.1. WIMBoot reduces Windows disk usage by keeping system files in a compressed WIM image on a separate hidden disk partition.^[76] Similarly to CompactOS, Windows system directories only contain sparse files marked by a reparse point with a WOF tag, and Windows Overlay Filter driver decompresses file contents on-the-fly from the WIM image. WIMBoot is less effective than CompactOS though, as new updated versions of system files need to be written to the system partition, consuming disk space.^[71]

Sparse files[edit]

Sparse files are files interspersed with empty segments for which no actual storage space is used. To the applications, the file looks like an ordinary file with empty regions seen as regions filled with zeros; the file system maintains an internal list of such regions for each sparse file.^[77] A sparse file does not necessarily include sparse zeros areas; the «sparse file» attribute just means that the file is allowed to have them.

Database applications, for instance, may use sparse files.^[78] As with compressed files, the actual sizes of sparse files are not taken into account when determining quota limits.^[79]

Volume Shadow Copy[edit]

The Volume Shadow Copy Service (VSS) keeps historical versions of files and folders on NTFS volumes by copying old, newly overwritten data to shadow copy via copy-on-write technique. The user may later request an earlier version to be recovered. This also allows data backup programs to archive files currently in use by the file system.

Windows Vista also introduced persistent shadow copies for use with System Restore and Previous Versions features. Persistent shadow copies, however, are deleted when an older operating system mounts that NTFS volume. This happens because the older operating system does not understand the newer format of persistent shadow copies.^[80]

Transactions[edit]

As of Windows Vista, applications can use Transactional NTFS (TxF) to group multiple changes to files together into a single transaction. The transaction will guarantee that either all of the changes happen, or none of them do, and that no application outside the transaction will see the changes until they are committed.^[81]

It uses similar techniques as those used for Volume Shadow Copies (i.e. copy-on-write) to ensure that overwritten data can be safely rolled back, and a CLFS log to mark the transactions that have still not been committed, or those that have been committed but still not fully applied (in case of system crash during a commit by one of the participants).

Transactional NTFS does not restrict transactions to just the local NTFS volume, but also includes other transactional data or operations in other locations such as data stored in separate volumes, the local registry, or SQL databases, or the current states of system services or remote services. These transactions are coordinated network-wide with all participants using a specific service, the DTC, to ensure that all participants will receive same commit state, and to transport the changes that have been validated by any participant (so that the others can invalidate their local caches for old data or rollback their ongoing uncommitted changes). Transactional NTFS allows, for example, the creation of network-wide consistent distributed file systems, including with their local live or offline caches.

Microsoft now advises against using TxF: «Microsoft strongly recommends developers utilize alternative means» since «TxF may not be available in future versions of Microsoft Windows».^[82]

Quotas[edit]

Disk quotas were introduced in NTFS v3. They allow the administrator of a computer that runs a version of Windows that supports NTFS to set a threshold of disk space that users may use. It also allows administrators to keep track of how much disk space each user is using. An administrator may specify a certain level of disk space that a user may use before they receive a warning, and then deny access to the user once they hit their upper limit of space. Disk quotas do not take into account NTFS’s transparent file-compression, should this be enabled. Applications that query the amount of free space will also see the amount of free space left to the user who has a quota applied to them.

Reparse points[edit]

Introduced in NTFS v3, NTFS reparse points are used by associating a reparse tag in the user space attribute of a file or directory. Microsoft includes several default tags including symbolic links, directory junction points and volume mount points. When the Object Manager parses a file system name lookup and encounters a reparse attribute, it will reparse the name lookup, passing the user controlled reparse data to every file system filter driver that is loaded into Windows. Each filter driver examines the reparse data to see whether it is associated with that reparse point, and if that filter driver determines a match, then it intercepts the file system request and performs its special functionality.

Limitations[edit]

Resizing[edit]

Starting with Windows Vista Microsoft added the built-in ability to shrink or expand a partition. However, this ability does not relocate page file fragments or files that have been marked as unmovable, so shrinking a volume will often require relocating or disabling any page file, the index of Windows Search, and any Shadow Copy used by System Restore. Various third-party tools are capable of resizing NTFS partitions.

OneDrive[edit]

Since 2017, Microsoft requires the OneDrive file structure to reside on an NTFS disk.^[83] This is because OneDrive Files On-Demand feature uses NTFS reparse points to link files and folders that are stored in OneDrive to the local filesystem, making the file or folder unusable with any previous version of Windows, with any other NTFS file system driver, or any file system and backup utilities not updated to support it.^[84]

Structure[edit]

NTFS is made up of several components including: a partition boot sector (PBS) that holds boot information; the master file table that stores a record of all files and folders in the filesystem; a series of meta files that help structure meta data more efficiently; data streams and locking mechanisms.

Internally, NTFS uses B-trees to index file system data. A file system journal is used to guarantee the integrity of the file system metadata but not individual files’ content. Systems using NTFS are known to have improved reliability compared to FAT file systems.^[85]

NTFS allows any sequence of 16-bit values for name encoding (e.g. file names, stream names or index names) except 0x0000. This means UTF-16 code units are supported, but the file system does not check whether a sequence is valid UTF-16 (it allows any sequence of short values, not restricted to those in the Unicode standard). In Win32 namespace, any UTF-16 code units are case insensitive whereas in POSIX namespace they are case sensitive. File names are limited to 255 UTF-16 code units. Certain names are reserved in the volume root directory and cannot be used for files. These are $MFT, $MFTMirr, $LogFile, $Volume, $AttrDef, . (dot), $Bitmap, $Boot, $BadClus, $Secure, $UpCase, and $Extend.^[5] . (dot) and $Extend are both directories; the others are files. The NT kernel limits full paths to 32,767 UTF-16 code units. There are some additional restrictions on code points and file names.^[86]

Partition Boot Sector (PBS)[edit]

This boot partition format is roughly based upon the earlier FAT filesystem, but the fields are in different locations. Some of these fields, especially the «sectors per track», «number of heads» and «hidden sectors» fields may contain dummy values on drives where they either do not make sense or are not determinable.

The OS first looks at the 8 bytes at 0x30 to find the cluster number of the $MFT, then multiplies that number by the number of sectors per cluster (1 byte found at 0x0D). This value is the sector offset (LBA) to the $MFT, which is described below.

Master File Table[edit]

In NTFS, all file, directory and metafile data—file name, creation date, access permissions (by the use of access control lists), and size—are stored as metadata in the Master File Table (MFT). This abstract approach allowed easy addition of file system features during Windows NT’s development—an example is the addition of fields for indexing used by the Active Directory and the Windows Search. This also enables fast file search software to locate named local files and folders included in the MFT very quickly, without requiring any other index.

The MFT structure supports algorithms which minimize disk fragmentation.^[89] A directory entry consists of a filename and a «file ID» (analogous to the inode number), which is the record number representing the file in the Master File Table. The file ID also contains a reuse count to detect stale references. While this strongly resembles the W_FID of Files-11, other NTFS structures radically differ.

A partial copy of the MFT, called the MFT mirror, is stored to be used in case of corruption.^[90] If the first record of the MFT is corrupted, NTFS reads the second record to find the MFT mirror file. Locations for both files are stored in the boot sector.^[91]

Metafiles[edit]

NTFS contains several files that define and organize the file system. In all respects, most of these files are structured like any other user file ($Volume being the most peculiar), but are not of direct interest to file system clients.^[92] These metafiles define files, back up critical file system data, buffer file system changes, manage free space allocation, satisfy BIOS expectations, track bad allocation units, and store security and disk space usage information. All content is in an unnamed data stream, unless otherwise indicated.

These metafiles are treated specially by Windows, handled directly by the NTFS.SYS driver and are difficult to directly view: special purpose-built tools are needed.^[93] As of Windows 7, the NTFS driver completely prohibits user access, resulting in a BSoD whenever an attempt to execute a metadata file is made. One such tool is the nfi.exe («NTFS File Sector Information Utility») that is freely distributed as part of the Microsoft «OEM Support Tools». For example, to obtain information on the «$MFT»-Master File Table Segment the following command is used: nfi.exe c:$MFT^[94] Another way to bypass the restriction is to use 7-Zip’s file manager and go to the low-level NTFS path \.X: (where X: resembles any drive/partition). Here, 3 new folders will appear: $EXTEND, [DELETED] (a pseudo-folder that 7-Zip uses to attach files deleted from the file system to view), and [SYSTEM] (another pseudo-folder that contains all the NTFS metadata files). This trick can be used from removable devices (USB flash drives, external hard drives, SD Cards, etc.) inside Windows, but doing this on the active partition requires offline access (namely WinRE).

Attribute lists, attributes, and streams[edit]

For each file (or directory) described in the MFT record, there is a linear repository of stream descriptors (also named attributes), packed together in one or more MFT records (containing the so-called attributes list), with extra padding to fill the fixed 1 KB size of every MFT record, and that fully describes the effective streams associated with that file.

Each attribute has an attribute type (a fixed-size integer mapping to an attribute definition in file $AttrDef), an optional attribute name (for example, used as the name for an alternate data stream), and a value, represented in a sequence of bytes. For NTFS, the standard data of files, the alternate data streams, or the index data for directories are stored as attributes.

According to $AttrDef, some attributes can be either resident or non-resident. The $DATA attribute, which contains file data, is such an example. When the attribute is resident (which is represented by a flag), its value is stored directly in the MFT record. Otherwise, clusters are allocated for the data, and the cluster location information is stored as data runs in the attribute.

• For each file in the MFT, the attributes identified by attribute type, attribute name must be unique. Additionally, NTFS has some ordering constraints for these attributes.
• There is a predefined null attribute type, used to indicate the end of the list of attributes in one MFT record. It must be present as the last attribute in the record (all other storage space available after it will be ignored and just consists of padding bytes to match the record size in the MFT).
• Some attribute types are required and must be present in each MFT record, except unused records that are just indicated by null attribute types.
  • This is the case for the $STANDARD_INFORMATION attribute that is stored as a fixed-size record and contains the timestamps and other basic single-bit attributes (compatible with those managed by FAT in DOS or Windows 9x).
• Some attribute types cannot have a name and must remain anonymous.
  • This is the case for the standard attributes, or for the preferred NTFS «filename» attribute type, or the «short filename» attribute type, when it is also present (for compatibility with DOS-like applications, see below). It is also possible for a file to contain only a short filename, in which case it will be the preferred one, as listed in the Windows Explorer.
  • The filename attributes stored in the attribute list do not make the file immediately accessible through the hierarchical file system. In fact, all the filenames must be indexed separately in at least one other directory on the same volume. There it must have its own MFT record and its own security descriptors and attributes that reference the MFT record number for this file. This allows the same file or directory to be «hardlinked» several times from several containers on the same volume, possibly with distinct filenames.
• The default data stream of a regular file is a stream of type $DATA but with an anonymous name, and the ADSs are similar but must be named.
• On the other hand, the default data stream of directories has a distinct type, but are not anonymous: they have an attribute name («$I30» in NTFS 3+) that reflects its indexing format.

All attributes of a given file may be displayed by using the nfi.exe («NTFS File Sector Information Utility») that is freely distributed as part of the Microsoft «OEM Support Tools».^[94]

Windows system calls may handle alternate data streams.^[5] Depending on the operating system, utility and remote file system, a file transfer might silently strip data streams.^[5] A safe way of copying or moving files is to use the BackupRead and BackupWrite system calls, which allow programs to enumerate streams, to verify whether each stream should be written to the destination volume and to knowingly skip unwanted streams.^[5]

Resident vs. non-resident attributes[edit]

To optimize the storage and reduce the I/O overhead for the very common case of attributes with very small associated value, NTFS prefers to place the value within the attribute itself (if the size of the attribute does not then exceed the maximum size of an MFT record), instead of using the MFT record space to list clusters containing the data; in that case, the attribute will not store the data directly but will just store an allocation map (in the form of data runs) pointing to the actual data stored elsewhere on the volume.^[95] When the value can be accessed directly from within the attribute, it is called «resident data» (by computer forensics workers). The amount of data that fits is highly dependent on the file’s characteristics, but 700 to 800 bytes is common in single-stream files with non-lengthy filenames and no ACLs.

• Some attributes (such as the preferred filename, the basic file attributes) cannot be made non-resident. For non-resident attributes, their allocation map must fit within MFT records.
• Encrypted-by-NTFS, sparse data streams, or compressed data streams cannot be made resident.
• The format of the allocation map for non-resident attributes depends on its capability of supporting sparse data storage. In the current implementation of NTFS, once a non-resident data stream has been marked and converted as sparse, it cannot be changed back to non-sparse data, so it cannot become resident again, unless this data is fully truncated, discarding the sparse allocation map completely.
• When a non-resident attribute is so fragmented, that its effective allocation map cannot fit entirely within one MFT record, NTFS stores the attribute in multiple records. The first one among them is called the base record, while the others are called extension records. NTFS creates a special attribute $ATTRIBUTE_LIST to store information mapping different parts of the long attribute to the MFT records, which means the allocation map may be split into multiple records. The $ATTRIBUTE_LIST itself can also be non-resident, but its own allocation map must fit within one MFT record.
• When there are too many attributes for a file (including ADS’s, extended attributes, or security descriptors), so that they cannot fit all within the MFT record, extension records may also be used to store the other attributes, using the same format as the one used in the base MFT record, but without the space constraints of one MFT record.

The allocation map is stored in a form of data runs with compressed encoding. Each data run represents a contiguous group of clusters that store the attribute value. For files on a multi-GB volume, each entry can be encoded as 5 to 7 bytes, which means a 1 KB MFT record can store about 100 such data runs. However, as the $ATTRIBUTE_LIST also has a size limit, it is dangerous to have more than 1 million fragments of a single file on an NTFS volume, which also implies that it is in general not a good idea to use NTFS compression on a file larger than 10 GB.^[96]

The NTFS file system driver will sometimes attempt to relocate the data of some of the attributes that can be made non-resident into the clusters, and will also attempt to relocate the data stored in clusters back to the attribute inside the MFT record, based on priority and preferred ordering rules, and size constraints.

Since resident files do not directly occupy clusters («allocation units»), it is possible for an NTFS volume to contain more files on a volume than there are clusters. For example, a 74.5 GB partition NTFS formats with 19,543,064 clusters of 4 KB. Subtracting system files (a 64 MB log file, a 2,442,888-byte Bitmap file, and about 25 clusters of fixed overhead) leaves 19,526,158 clusters free for files and indices. Since there are four MFT records per cluster, this volume theoretically could hold almost 4 × 19,526,158 = 78,104,632 resident files.

Opportunistic locks[edit]

Opportunistic file locks (oplocks) allow clients to alter their buffering strategy for a given file or stream in order to increase performance and reduce network use.^[97] Oplocks apply to the given open stream of a file and do not affect oplocks on a different stream.

Oplocks can be used to transparently access files in the background. A network client may avoid writing information into a file on a remote server if no other process is accessing the data, or it may buffer read-ahead data if no other process is writing data.

Windows supports four different types of oplocks:

• Level 2 (or shared) oplock: multiple readers, no writers (i.e. read caching).
• Level 1 (or exclusive) oplock: exclusive access with arbitrary buffering (i.e. read and write caching).
• Batch oplock (also exclusive): a stream is opened on the server, but closed on the client machine (i.e. read, write and handle caching).
• Filter oplock (also exclusive): applications and file system filters can «back out» when others try to access the same stream (i.e. read and write caching) (since Windows 2000)

Opportunistic locks have been enhanced in Windows 7 and Windows Server 2008 R2 with per-client oplock keys.^[98]

Time[edit]

Windows NT and its descendants keep internal timestamps as UTC and make the appropriate conversions for display purposes; all NTFS timestamps are in UTC.^{[citation needed]}

For historical reasons, the versions of Windows that do not support NTFS all keep time internally as local zone time, and therefore so do all file systems – other than NTFS – that are supported by current versions of Windows. This means that when files are copied or moved between NTFS and non-NTFS partitions, the OS needs to convert timestamps on the fly. But if some files are moved when daylight saving time (DST) is in effect, and other files are moved when standard time is in effect, there can be some ambiguities in the conversions. As a result, especially shortly after one of the days on which local zone time changes, users may observe that some files have timestamps that are incorrect by one hour. Due to the differences in implementation of DST in different jurisdictions, this can result in a potential timestamp error of up to 4 hours in any given 12 months.^[99]

See also[edit]

• Comparison of file systems
• NTFSDOS
• ntfsresize
• WinFS (a canceled Microsoft filesystem)
• ReFS, a newer Microsoft filesystem

Notes[edit]

References[edit]

Further reading[edit]

NTFS и FAT32 — не единственные файловые системы, которые способна видеть и читать Windows 10. Она также поддерживает работу с устаревшей FAT, расширенной exFAT, новой ReFS, виртуальной CDFS, а также частично с используемыми в Linux EXT2 и EXT3. При работе с дисками, в том числе съёмными, у вас может возникнуть необходимость определить текущую файловую систему носителя или логического раздела. В Windows 10 сделать это можно разными способами.

Самый простой — это открыть свойства диска и посмотреть, что указано в параметре «Файловая система».

Однако подходит этот способ только для тех дисков, которые имеют букву и явно «родную» файловую систему, если же носитель или раздел будет отформатирован в EXT3 или вследствие сбоя определится как RAW, в Проводнике он будет недоступен. В этом случае для определения файловой системы следует использовать оснастку «Управление дисками» или консольную утилиту Diskpart.

Нажатием Win + X откройте меню кнопки Пуск, запустите оснастку «Управление дисками» и посмотрите содержимое колонки «Файловая система».

В оснастке будут отображаться даже те диски и разделы, которые не имеют буквы. Другой способ посмотреть ФС носителя это воспользоваться утилитой Diskpart. Откройте командную строку и выполните в ней две таких команды:

diskpart
list volume

Первая команда запускает утилиту, вторая выводит список всех логических разделов. Нужную вам информацию найдёте в колонке ФС. Альтернатива Diskpart — консоль PowerShell. Чтобы узнать тип файловой системы для всех дисков, запустите её от имени администратора и выполните команду get-volume. Искомые значения будут перечислены в колонке FileSystemType.

Увы, у всех описанных выше способов есть общий недостаток, а именно некорректное распознавание линуксовых файловых систем CDFS и EXT2/3/4.

Так, в нашем примере PowerShell определил CDFS как Unknown (неизвестный). Diskpart и оснастка управления дисками определили CDFS правильно, но не смогли распознать EXT3, определив её как RAW, то есть как отсутствие файловой системы. Правильные результаты штатные инструменты стали показывать только после установки Ext2Fsd — утилиты и драйвера для обеспечения доступа к носителям EXT2/3/4 из-под Windows.

И раз уж речь зашла об EXT2/3/4, заодно стоит также упомянуть о файловых системах HFS или HFS+, используемых в маках. Будучи подключёнными к компьютеру с Windows, они также не будут определяться и, чтобы иметь возможность с ними работать, необходимо установить драйвер Paragon HFS+ либо MacDrive.

Наконец, для определения файловой системы можно воспользоваться любым более или менее продвинутым дисковым менеджером — Acronis Disk Director, EaseUS Partition Master, AOMEI Partition Assistant Standard и другими им подобными, хотя и в этом случае результат может оказаться неоднозначным.

Ext2Fsd: www.ext2fsd.com

Windows 10 постепенно вытесняет ранние версии операционных систем, поэтому не удивительно, что новые пользователи перед установкой «десятки» интересуются ее системными требованиями.

Что подразумевают под системными требованиями?

Под системными требованиями подразумевается возможность компьютера (ноутбука, смартфона) стабильно, уверенно быстро работать на под управлением операционной системы.

На стабильность и быстроту работы ПК влияют:

1. Объем выделенной оперативной памяти и ее тип;
2. Процессор, его тактовая частота, количество ядер;
3. Жесткий диск, его объем для загрузки фалов операционной системы и обновлений, выделенное место под файл подкачки, технология (HDD или SSD), скорость вращения шпинделя, к примеру 5400 или 7200 оборотов в минуту (для HDD);
4. Видеокарта, объем выделенной ОЗУ, тип, частота работы графического процессора, поддержка DirectX нужной версии;
5. Дисплей, поддержка разрешения, тип устройства, другие функции.

Как понятно из вышесказанного под системными требованиями подразумевается соответствие характеристик железа установлено в компьютере к требованиям операционной системы для ее стабильной работы.

Но в нашем случае не все вышеописанные требования необходимо учитывать, к примеру размера файла подкачки, или скорость вращения шпинделя жесткого диска.

Так вот, минимальные системные требования Windows 10, по заявлению Microsoft такие:

1. Минимально допустимый объем оперативной памяти – 1Гб для версии х32 и 2Гб для х64;
2. Видеокарта с поддержкой не ниже DirectX 9 с драйвером WDDM 1.0.;
3. Процессор с частотой работы не менее 1ГГц или SoC;
4. Жесткий диск размером не менее 16 Гб для версии ОС х32 и 20 Гб для х64;
5. Монитор с разрешением не менее 800х600.

Основную конфигурацию железа можно посмотреть в Панели управления-Все элементы панели управления – Система.

Подробную информацию можно получить, установив программу Аida64.

Как видно Windows 10 не такая уж и требовательна к аппаратному обеспечению и уверенно сможет работать на компьютерах даже десятилетней давности, к примеру, работающих на процессоре Pentium D, двух гигабайтной ОЗУ типа DDR2.

Требования во время перехода на Windows 10

Дело в том, что можно обновиться до самой последней версии операционной системы, но сделать это можно, если на компьютере установлены самые свежие версии Windows 7 SP1 или ОС 8.1 с последними обновлениями.

Загружаемый файл дистрибутива десятой версии занимает около 3Гб, а при распаковке и установки может достигать от 16 до 20 Гб в зависимости от разрядности устанавливаемой ОС.

Поэтому Microsoft рекомендует при установке Windows 10 учитывать данные особенности и иметь свободного пространства на жестком диске не менее 32 Гб.

Эти же данные необходимо учитывать при установке чистого дистрибутива «десятки» с DVD диска или флеш накопителя.

Разрядность систем

Многие задаются вопросом, какую версию Windows 10 устанавливать 32 – х битную (работающую на платформе x86) или 64 битную. Первая обозначается х32, вторая х64.

Сразу скажем, лучше установить 64 битную версию, так как это скажется на увеличении производительности ПК и его стабильной работе.

Но перед установкой убедитесь, что «железо» компьютера, особенно процессор, поддерживает работу с х64 версиями ОС.

Как правило все современные процессоры поддерживают платформу х64, но убедитесь, что они поддерживают технологии CMPXCHG16b, PrefetchW и LAHF/SAHF, причем три сразу, иначе система не встанет.

На старых компьютерах скорее всего придется довольствоваться 32-х битной версией ОС.

Что теряет пользователь на х32 оперативной системе:

1. В объеме оперативной памяти – больше 4 Гб такая ОС не видит, а как правило приходится довольствоваться 3,5 Гб ОЗУ;
2. ОС 10 х64 может видеть до 192 Гб ОЗУ, поэтому если на ноутбуке или ПК стоит 8 Гб оперативки, то тут выбор очевиден.

Файловые системы 

Какую файловую систему на Windows 10 лучше использовать FAT32, NTFS или ReFS?

Мы рекомендуем в нашем случае использовать NTFS, хотя и относительно FAT32 ничего против не имеем. ReFS относительно новая файловая система, являющаяся продолжением NTFS, но пока еще не получившая широкого распространения.

Многое зависит от того, какой объем информации хранится на вашем диске.

Дело в том, что NTFS отлично справляется с большими массивами данных, а FAT32 лучше с небольшими объемами информации.

Но так как сейчас трудно себе представить компьютер с парой гигабайт данных, обычно это 100 Гб и больше, то FAT32 уходит на второй план.

На NTFS, в таком случае, компьютер под управлением Windows 10 будет работать быстрее и стабильнее, также восстановить случайно удаленные файлы в данной файловой системе будет легче.

Дополнительные возможности Windows 10 и системные требования под них

Не стоит забывать, что Windows 10, в зависимости от версии (Home, Pro, Enterprise и так далее) обладает множеством дополнительных функций, которые могут забирать у компьютера не только много ресурсов, но и требовать для себя наличия определенного оборудования (устройств).

Стоит заметить, что данные функции в большей мере являются специализированными и доступ к ним возможен не из всех версий Windows 10.

Возьмете для примера Cortana (голосовой помощник). Использовать данного помощника возможно только в некоторых странах Европы, Англии, Китае и США.

Чтобы Cortana четко распознавала команды понадобиться высококачественный микрофон.

Для использования быстрого доступа к устройству с помощью персонализации через отпечаток пальцев или лицо (служба Hello) помимо встроенного сенсора отпечатка пальцев понадобится инфракрасная камера способная анализировать радужную оболочку глаза.

Монитор или экран с поддержкой функции мультитач позволит легко переходить в планшетный режим и обратно, при условии, что они у вас есть.

Для доступа к некоторым возможностям операционной системы придется заводить учетную запись Microsoft, это можно сделать непосредственно из Windows 10.

А чтобы осуществлять безопасные загрузки придется установить софт с поддержкой UEFI v2.3.1 Errata B, а также загрузить сертификат центра Microsoft.

Чтобы использовать полное шифрование диска (технология BitLocker) к системным требованиям можно будет отнести наличие достоверного модуля TPM-версии 1.2 или 2.0 и устройства USB.

Если вы заходите пользоваться системной аппаратной виртуализации (Hyper-V), то сможете это сделать только на версии ОС x64, а системные требования к ней выше, чем к версии х32. При этом обязательно должна быть возможность преобразования адресов SLAT (второй уровень).

Чтобы передавать данные со смартфонов, планшетов или компьютеров на дисплей без использования традиционных HDMI кабелей, компанией Microsoft была разработана технология Miracast.

Для реализации беспроводной взаимосвязи между гаджетами необходимо иметь адаптер беспроводной связи с поддержкой Wi-Fi Direct, видеокарту с поддержкой WDDM-драйвера.

Аналогичные системные требования и для Wi-Fi-печати документов.

От наличия режима ожидания подключения будет зависеть работа InstantGo (режим ожидания, чем-то схожий на режимы сна или гибернации, но при этом остается работа программ в фоновом режиме, скачивание файлов, получение сообщений в Skype, используется от Windows 8.1 и выше).

Поэтому не все, даже современные устройства поддерживают InstantGo.

В чем ошибка многих

Многие пользователи думают, что системные требования ОС Windows 7, 8, 10 одинаковые, мол ОС являются логическим продолжением друг друга.

Безусловно, системные требования у них чем-то схожи, но не более.

Схожесть в основном заключается в использовании железной конфигурации компьютера. Как правило, если ПК или ноутбук уверенно работает на семерке, то также, а если не лучше, будет работать на восьмерке и десятке.

Но нужно понимать, что Windows 10, более совершенная система, обладающая огромными срытыми возможностями и дополнительными функциями, которые отсутствуют в ранних версиях ОС.

Соответственно и системные требования, в плане конфигурации некоторых подключенных устройств, у десятки будут выше.

Другое дело, нужны ли большинству пользователей дополнительные функции Windows 10, и как часто их будут использовать.

Итоги – что говорит опыт

Подводя итоги можно с уверенностью сказать, что системные требования у Windows 10 минимальны, на большинство устройств, особенно 32-х разрядных, она встанет без проблем и будет стабильно работать.

Это касается десктопный и мобильной версий, но при условии, что вы не претендуете на использование в ней всех доступных и скрытых возможностей, которые требовательны к характеристикам и параметрам устройств с помощью которых данные возможности реализуются.

С опыта можно сказать, что Windows 10 уверенно работает на следующей конфигурации ПК:

1. Системная плата Asus P5LD2 Deluxe (2005 год);
2. Тип ЦП — DualCore Intel Pentium D 930, 3000 MHz (15 x 200) (2004 год);
3. Системная память — 3072 МБ (DDR2-667 DDR2 SDRAM);
4. MAXTOR STM3160811AS ATA Device -120 Гб.
5. Видеоадаптер — nVIDIA GeForce GT 720.

А как система работает на вашем устройстве? Пишите в комментариях.

Последнее обновление 09.10.2020

Операционная система Windows 8, Windows 8.1 поддерживает несколько файловых систем: NTFS, FAT и FAT32. Но работать может только на NTFS, то есть установлена может быть только на раздел жесткого дис­ка, отформатированного в данной файловой системе.

Обусловлено это теми особенностями и инструментами безопасности, которые преду­смотрены в NTFS, но отсутствуют в файловых системах Windows предыдущего поколения: FAT16 и FAT32.

Далее мы остановим­ся на всей линейке файловых систем для Windows, чтобы понять, какую роль они играют в работе системы и как они развивались в про­цессе становления Windows плоть до Windows 8.

Общие сведения о файловых системах

Преимущества NTFS касаются практически всего: производительности, надежности и эффективности работы с данными (файлами) на диске. Так, одной из основных целей создания NTFS было обеспечение ско­ростного выполнения операций над файлами (копирование, чтение, удаление, запись), а также предоставление дополнительных возможно­стей: сжатие данных, восстановление поврежденных файлов системы на больших дисках и т.д.

Другой основной целью создания NTFS была реализация повышенных требований безопасности, так как файловые системы FAT, FAT32 в этом отношении вообще никуда не годились. Именно в NTFS можно разрешить или запретить доступ к какому-либо файлу или папке (разграничить права доступа).

Сначала рассмотрим сравнительные характеристики файловых систем, а потом остановимся на каждой из них поподробнее. Сравнение, для большей наглядности, приведены в табличной форме.

Файловая система FAT для современных жест­ких дисков просто не подходит (ввиду ее ограниченных возможностей). Что касается FAT32, то ее еще можно использовать, но уже с натяжкой.

Если купить жесткий диск на 1000 ГБ, то вам придется разбивать его как минимум на несколько разделов. А если вы собираетесь заниматься видеомонтажом, то вам будет очень мешать ограничение в 4 Гб как максимально возможный размер файла.

Всех перечисленных недостатков лишена файловая система NTFS. Так что, даже не вдаваясь в детали и специальные возможности файловой системы NTFS, можно сделать выбор в ее пользу.

Файловая система	Параметры
Размеры тома	Максимальныйразмерфайла
FAT	От 1.44 МБ до 4 ГБ	2ГБ
FAT32	Теоретически возможен размер тома от 512 МБ до 2 Тбайт. Сжатие не поддерживается на уровне файловой системы	4ГБ
NTFS	Минимальный рекомендуемый размер составляет 1,44 МБ, а максимальный — 2 Тбайт. Поддержка сжатия на уровне файловой системы для файлов, каталогов и томов.	Максимальный размер ограничен лишь размером тома (Теоретически — 264 байт минус 1 килобайт. Практически — 244 байт минус 64 килобайта)

Вообще использование FAT32 может быть оправдано лишь в тех случаях, когда у вас на компьютере установлено несколько операционных систем, а какая-либо из них не поддерживает NTFS. Но на сегодняшний день таких практически нет. Разве что вы захотите установить у себя антиквариат типа Windows 98.

Файловая система FAT

Файловая система FAT (обычно под ней понимается FAT 16) была разработана достаточно давно и предназначалась для работы с небольшими дисковыми и файловыми объемами, простой структурой каталогов. Аббревиатура FAT расшифровывается как File Allocation Table (с англ. таблица размещения файлов). Эта таблица размещается в начале тома, причем хранятся две ее копии (в целях обеспечения большей устойчивости).

Данная таблица используется операционной системой для поиска файла и определения его физического расположения на жестком диске. В случае повреждения таблицы (и ее копии) чтение файлов операционной системой становится невозможно. Она просто не может определить, где какой файл, где он начинается и где заканчивается. В таких случаях говорят, что файловая система «упала».

Файловая система FAT изначально разрабатывалась компанией Microsoft для дискет. Только потом они стали ее применять для жестких дисков. Сначала это была FAT12 (для дискет и жестких дисков до 16 МБ), а потом она переросла в FAT16, которая была введена в эксплуатацию с операционной системой MS-DOS 3.0.

Далее она поддерживается в Windows 3.x, Windows 95, Windows 98, Windows NT/2000 и т.д.

Файловая система FAT32

Начиная с Windows 95 OSR2, компания Microsoft начинает активно ис­пользовать в своих операционных системах FAT32 — тридцатидвухраз­рядную версию FAT. Что поделать, технический прогресс не стоит на месте и возможностей FAT 16 стало явно недостаточно.

По сравнению с ней FAT32 стала обеспечивать более оптимальный до­ступ к дискам, более высокую скорость выполнения операций ввода/вывода, а также поддержку больших файловых объемов (объем диска до 2 Тбайт).

В FAT32 реализовано более эффективное расходование дискового пространства (путем использования более мелких кластеров). Выгода по сравнению с FAT16 составляет порядка 10.15%. То есть при использовании FAT32 на один и тот же диск может быть записано информации на 10. 15% больше, чем при использовании FAT16.

Кроме того, необходимо отметить, что FAT32 обеспечивает более вы­сокую надежность работы и более высокую скорость запуска программ.

Обусловлено это двумя существенными нововведениями:

1. Возможностью перемещения корневого каталога и резервной копии FAT (если основная копия получила повреждения)
2. Возможностью хранения резервной копии системных данных.

Файловая система NTFS

Ни одна из версий FAT не обеспечивает хоть сколько-нибудь приемле­мого уровня безопасности. Это, а также необходимость в добавочных файловых механизмах (сжатия, шифрования) привело к необходимости создания принципиально новой файловой системы. И ею стала фай­ловая система NT (NTFS)

NTFS — от англ. New Technology File System, файловая система новой технологии. Как уже упоминалось, основным ее достоинством является защищен­ность: для файлов и папок NTFS могут быть назначены права доступа (на чтение, на запись и т.д.). Благодаря этому существенно повысилась безопасность данных и устойчивость работы системы.

Назначение прав доступа позволяет запретить/разрешить каким-либо пользователям и программам проделывать какие-либо операции над файлами. Например, не обладая достаточными правами, посторонний пользователь не сможет изменить какой-либо файл. Или не обладая достаточными правами, вирус не сможет испортить файл.

Кроме того, NTFS, как было сказано выше, обеспечивает лучшую про­изводительность и возможность работы с большими объемами данных.

Начиная с Windows 2000, используется версия NTFS 5.0, которая, помимо стандартных, позволяет реализовывать следующие возможности:

• Шифрование данных — эта возможность реализуется специальной надстройкой NTFS, которая называется Encrypting File System(EFS) — шифрующая файловая система. Благодаря этому механизму шифрованные данные могут быть прочитаны только на компьютере, на котором произошла шифровка.
• Дисковые квоты — стало возможно назначать пользователям определенный (ограниченный) размер на диске, который они могут использовать.
• Хранение разреженных файлов. Встречаются файлы, в которых содержится большое количество последовательных пустых байтов. Файловая система NTFS позволяет оптимизировать их хранение.
• Использование журнала изменений — позволяет регистрировать все операции доступа к файлам и томам.

И еще одно нововведение NTFS — точки монтирования. С помощью точек монтирования можно определить различные не связанные между собой папки и даже диски в системе, как один диск или папка. Это имеет большую важность для сбора в одном месте разнородной информации, находящейся в системе.

Напоследок необходимо иметь в виду, что если для файла под NTFS были установлены определенные права доступа, а потом вы его скопировали на раздел FAT, то все его права доступа и другие уникальные атрибуты, присущие NTFS, будут утеряны. Так что будьте бдительны.

Устройство NTFS. Главная таблица файлов MFT

Как и любая другая файловая система, NTFS делит все полезное место на кластеры — минимальные блоки данных, на которые разбиваются файлы. NTFS поддерживает почти любые размеры кластеров — от 512 байт до 64 Кбайт. Однако общепринятым стандартом считается кластер размером 4 Кбайт. Именно он используется по умолчанию. Принцип существования кластеров можно проиллюстрировать следующим при­мером.

Если у вас размер кластера составляет 4 Кбайт (что скорее всего), а нужно сохранить файл, размером 5 Кбайт, то реально под него будет вы­делено 8 Кбайт, так как в один кластер он не помещается, а под файл дисковое пространство выделяется только кластерами.

Для каждого NTFS-диска имеется специальный файл — MFT (Master Allocation Table — главная таблица файлов). В этом файле содержится централизованный каталог всех имеющихся на диске файлов. При создании файла NTFS создает и заполняет в MFT соответствующую запись, в которой содержится информация об атрибутах файла, содержимом файла, имя файла и т.п.

Помимо MFT, имеется еще 15 специальных файлов (вместе с MFT — 16), которые недоступны операционной системе и называются метафайлами. Имена всех метафайлов начинаются с символа $, но стандартными средствами операционной системы просмотреть их и вообще увидеть не представляется возможным. Далее для примера представлены основные метафайлы:

• SMFT — сам MFT.
• $MFTmirr — копия первых 16 записей MFT, размещенная посе­редине диска (зеркало).
• $LogFile — файл поддержки журналирования.
• $Volume — служебная информация: метка тома, версия файловой системы, и т.д.
• $AttrDef — список стандартных атрибутов файлов на томе.
• $ — корневой каталог.
• $Bitmap — карта свободного места тома.
• $Boot — загрузочный сектор (если раздел загрузочный).
• $Quota — файл, в котором записаны права пользователей на ис­пользование дискового пространства.
• $Upcase — файл-таблица соответствия заглавных и прописных букв в именах файлов на текущем томе.

Нужен в основном потому, что в NTFS имена файлов записываются в кодировке Unicode, которую составляют 65 тысяч различных символов, искать большие и малые эквиваленты которых очень нетривиально.

Что касается принципа организации данных на диске NTFS, то он условно делится на две части. Первые 12% диска отводятся под так называемую MFT-зону — пространство, в которое растет метафайл MFT.

Запись каких-либо пользовательских данных в эту область невозможна. MFT-зона всегда держится пустой. Это делается для того, чтобы самый главный служебный файл (MFT) не фрагментировался при своем росте. Остальные 88% диска представляют собой обычное пространство для хранения файлов.

Однако при нехватке дискового пространства MFT-зона может сама уменьшаться (если это возможно), так что никакого дискомфорта вы замечать не будете. При этом новые данные уже будут записываться в бывшую MFT-зону.

В случае последующего высвобождения дискового пространства MFT-зона снова будет увеличиваться, однако в дефрагментированном виде (то есть не единым блоком, а несколькими частями на диске). В этом нет ничего страшного, просто считается, что система более надежна, когда MFT-файл не дефрагментирован.

Кроме того, при не дефрагментированном MFT-файле вся файловая система работает быстрее. Соответственно чем более дефрагментированным является MFT-файл, тем медленней работает файловая система.

Что касается размера MFT-файла, то он примерно вычисляется, исходя из 1 МБ на 1000 файлов.

Конвертирование разделов FAT32 в NTFS без потери данных. Утилита convert

Вы можете без особого труда конвертировать существующий FAT32-раздел в NTFS. Для этого в Windows 8, Windows 8.1 предусмотрена утилита командной строки convert.

Параметры ее работы показаны на скриншоте.

Таким образом, чтобы конвертировать в NTFS диск D:, в командную строку следует ввести следующую команду:

convert d: /fs:ntfs /v

После этого от вас попросят ввести метку тома, если такая есть (метка тома указывается рядом с именем диска в окне Мой компьютер. Она служит для более подробного обозначения дисков и может использоваться, а может не использоваться. Например, это может быть Files Storage (D:).

Здесь Files Storage — это метка тома d:.

Для конвертации флешки команда выглядит так:

convert e: /fs:ntfs /nosecurity /x

где e – это буква вашей флешки.