| Glossary |
In NTFS, everything on disk is a file. Even the metadata is stored as a set of files. The Master File Table (MFT) is an index of every file on the volume. For each file, the MFT keeps a set of records called attributes and each attribute stores a different type of information.
| Type | Description | Name |
|---|---|---|
| 0x10 | $STANDARD_INFORMATION | |
| 0x30 | $FILE_NAME | $MFT |
| 0x80 | $DATA | [Unnamed] |
| 0xB0 | $BITMAP | [Unnamed] |
The description of each file is packed into FILE records. If one record is not large enough (this is unusual), then an $ATTRIBUTE_LIST attribute is needed.
The first 24 FILE records are reserved for the system files. For a full list see the Files page.
| Inode | Filename | Description |
|---|---|---|
| 0 | $MFT | Master File Table - An index of every file |
| 1 | $MFTMirr | A backup copy of the first 4 records of the MFT |
| 2 | $LogFile | Transactional logging file |
| 3 | $Volume | Serial number, creation time, dirty flag |
| ... | ... | ... |
To prevent the MFT becoming fragmented, Windows maintains a buffer around it. No new files will be created in this buffer region until the other disk space is used up. The buffer size is configurable and can be 12.5%, 25%, 37.5% or 50% of the disk. Each time the rest of the disk becomes full, the buffer size is halved.
The MFT is self-referencing.
The MFT has some space reserved for future expansion. MFT records 12 - 15 are marked as in use, but are empty. MFT records 16 - 23 are marked as not in use, however they are never used.
Under Windows, the MFT cannot shrink whilst the system is running.