Concept - Directory

Previous Next


Under NTFS every object on the volume is a file, even directories. A directory is an index of filenames.


Type Description Name
0x30 $FILE_NAME dirname
0x90 $INDEX_ROOT $I30
0xB0 $BITMAP $I30

Index Root

This attribute, which is always resident, holds several index entries. It forms the root of the index tree.

Index Allocation

A set of data runs telling where the other index nodes are.

Index Bitmap

Each bit tells whether that Index Record is in use.

A directory can even have a named data stream


From an human's point of view, a directory is a particular kind of file that can contain other files. It is a file folder, used in a nested way to create a logical file hierarchy on a volume.


From NTFS' point of view, a directory is an index of file names, or more accurately a sequence of index entries containing a filename attribute. An index entry is created for each file name attribute of each file contained in the folder. This kind of index entries can be compared together using the alphabetical order on their upper-cased (thanks to $UpCase) file name attribute.

A directory has no data attribute. But, as an index, it has instead three other file attributes: index root, index allocation, and bitmap. The index is stored in the nodes of a B+ tree in the following manner:


When an application reads a directory, NTFS returns a list of file names which is already sorted.

The B+ tree structure (which is used in HPFS too), when built in a balanced way, is far more efficient than a linear structure to perform a file name lookup in a folder containing a large number of files.

Although the duplication of the stream of the indexed attribute in an index entry can cost some time, it is worthy because you can browse an index without actually opening all the indexed files (FAT and HPFS do that, too).

In a directory, the three file attributes: index root, index allocation, and bitmap are named "$I30", and a directory is just an Index of file attributes whose type is 30. But NTFS has been thought as a database filesystem, and it can actually create indexes based on any file attribute that is always resident. E.g., you could create a new file attribute labeled "author name", and sort your files according to that criteria.

Copyright ©