Concept - Directory

Overview

Under NTFS every object on the volume is a file, even directories. A directory is an index of filenames.

Attributes

Index Root

This attribute, which is always resident, holds several index entries. It forms the root of the index tree.

Index Allocation

A set of data runs telling where the other index nodes are.

Index Bitmap

Each bit tells whether that Index Record is in use.

A directory can even have a named data stream

Definition

From an human's point of view, a directory is a particular kind of file that can contain other files. It is a file folder, used in a nested way to create a logical file hierarchy on a volume.

Properties

From NTFS' point of view, a directory is an index of file names, or more accurately a sequence of index entries containing a filename attribute. An index entry is created for each file name attribute of each file contained in the folder. This kind of index entries can be compared together using the alphabetical order on their upper-cased (thanks to $UpCase) file name attribute.

A directory has no data attribute. But, as an index, it has instead three other file attributes: index root, index allocation, and bitmap. The index is stored in the nodes of a B+ tree in the following manner:

• Each node of the tree contains one or several index entries. Within a node, index entries are sorted in increasing order
• Each index entry may point to another (sub-)node containing only lower index entries
• The root node is in the stream of the index root attribute, the other (sub-)nodes are index buffers.

Interest

When an application reads a directory, NTFS returns a list of file names which is already sorted.

The B+ tree structure (which is used in HPFS too), when built in a balanced way, is far more efficient than a linear structure to perform a file name lookup in a folder containing a large number of files.

Although the duplication of the stream of the indexed attribute in an index entry can cost some time, it is worthy because you can browse an index without actually opening all the indexed files (FAT and HPFS do that, too).

In a directory, the three file attributes: index root, index allocation, and bitmap are named "$I30", and a directory is just an Index of file attributes whose type is 30. But NTFS has been thought as a database filesystem, and it can actually create indexes based on any file attribute that is always resident. E.g., you could create a new file attribute labeled "author name", and sort your files according to that criteria.