NTFS - Glossary

Overview

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z

This is a glossary of all terms. Some entries refer to other entries, e.g. See also. Some entries have an entire page of their own, e.g. More... If your browser supports access keys, then you can jump around this document by using, for example, Alt-M for the M section.

. (See Dot, Root Directory)
Access Control Entry (ACE): An Access Control Entry is the smallest unit of security. It contains a SID (either a user or a group) and permissions information. The permission will be one of Access Allowed, Access Denied or System Audit. This object has flags to determine how the permissions should be inherited.
See also: SID, ACL and Auditing
Access Control List (ACL): This security structure contains a list of ACEs.
See also: $SECURITY_DESCRIPTOR, SID, ACL and Auditing
ACE (See Access Control Entry)
ACL (See Access Control List)
$AttrDef (More...): This metadata file contains the definitions of all the attributes that are allowed on an NTFS volume.
Attribute: on disk a file is stored as a set of attributes resident / non res
$ATTRIBUTE_LIST (More...): This attribute is used when a file's attributes won't fit in a single MFT File Record. It has a list of all the attributes and where they can be found. The $ATTRIBUTE_LIST is always stored in the Base FILE Record.
See also: File Record $MFT Base FILE Record
Audit, Auditing: As part of the security permissions of a file, any actions performed on the file can be recorded. For example a file could be required to log all the people who tried to read it, but didn't have the permissions to do so.

B+ Tree

A B+ tree is a variant of the binary tree. Instead of one data element per node, there are many. (In NTFS the actual number depends on the lengths of the names and the cluster size). The B+ tree retains the efficiency of a binary tree and also performs well with large numbers of data elements (because the tree tends to grow wide rather than deep).
See also: Binary Tree and Balanced Tree.

BAAD

During chkdsk, if NTFS finds a multi-sector item (MFT, INDEX BLOCK, etc) where the multi-sector header doesn't match the values at the end of the sector, it marks the item with the magic number 'BAAD', and fill it with zeroes (except for a short at the end of each sector...)

        FIXME
        "BAAD" == corrupt record
        "CHKD" == chkdsk ???
        "FILE" == mft entry
        "HOLE" == ??? (NTFS 3.0+?)
        "INDX" == index buffer
        RSTR & ???

See also: chkdsk and fsck.

$Bad

This is the named Data Stream representing bad clusters on a volume.
See also: $BadClus.

$BadClus (More...)

This metadata file lists all the unreadable clusters on the volume.

Balanced Tree

Often binary trees can become very uneven. By reorganising the data, the tree can be balanced such that no a node has similar numbers of children to it's left and right.
See also: B+ Tree and Binary Tree.

Base FILE Record

If the attributes don't fit into a single MFT record then the Base FILE Record holds enough information to locate the other records.
See also: $ATTRIBUTE_LIST, FILE Record and $MFT.

Binary

Maths carried out in base two. In this documentation, certain flags fields are represented in binary, for the sake of clarity. e.g. 00001000₂, 010000000₂.
See also: Decimal, Hex and Units.

Binary Tree

This is an efficient way of storing sorted data in order. Each node in the tree represents a data element. The left child node is a collection of all the elements that come before it. The right child node is a collection of all the elements that come after it.
See also: B+ Tree and Balanced Tree.

Bit

One binary digit, one or zero.
See also: Units,

$Bitmap (More...)

This metadata file keeps track of which clusters are in use on the volume.

$BITMAP (More...)

This attribute keeps track of which records are in use in an index.

Block

In Linux terminology, this is a cluster. Block device In Linux terminology, this is a storage unit. Cluster The minimum allocation unit. Clusters are a fixed power of 2 of the sector size (called the cluster factor), and their size can be between 512 bytes and 4 KB (Sometimes 64 KB, but 4 KB is the largest cluster size that the current NTFS compression engine can operate with. That limit may be related to the 4 KB page size used on the Intel i386 CPU). This size can be set with the Windows NT format utility, whose default is: Volume size Cluster size 1 to 512 MB Sector size 512 MB to 1 GB 1 KB 1 GB to 2 GB 2 KB more than 2 GB 4 KB

$Boot (More...)

This metadata file points at the boot sector of the volume. It contains information about the size of the volume, clusters and the MFT.

Byte (See Units)

chkdsk: This is a DOS and Windows utility to check and repair filesystems. Its name is an abbreviation of check disk.
See also: fsck.
Cluster: This is the smallest unit of disk that NTFS uses and it is a multiple of the sector size. It is determined when the volume is formatted and cannot be altered afterwards.
See also: Sector, $Boot and Volume.
Compression: NTFS supports file- and directory-level compression. The compression is performed transparently when the file is read or written. Any new files in a compressed directory will automatically be compressed.
See also: Compression Unit
Compression Unit: Each file marked to be compressed is divided into sixteen cluster blocks, known as compression units. If one of these blocks cannot be compressed into fifteen clusters or less it is left uncompressed. This division also helps accessing a file randomly, ie it isn't necessary to decompress the whole file.
See also:

$DATA (More...)

This attribute contains the actual data for a file. This stream may also have a name.

Data Runs (More...)

Non-resident attributes are stored in intervals of clusters called runs. Each run is represented by its starting cluster and its length. The runs map the VCNs of a file to the LCNs of a volume.
See also: Attribute, Cluster, LCN, VCN and Volume.

Decimal

Maths carried out in base ten. In this documentation, numbers that are neither in hex, nor binary, are in decimal, e.g. 16 (sixteen), 23 (twenty-three).
See also: Binary, Hex and Units.

Directory (More...)

An NTFS directory is an index attribute. NTFS uses index attributes to collate file names. A directory entry contains the name of the file and a copy of the file's standard information attribute (time stamp information). This approach provides a performance boost for directory browsing because NTFS does not need to read the files' MFT records to print directory information.

DOS File Permissions (see File Permissions)

Dot, Root Directory (More...)

Root directory of the disk

Drive (See Volume)

Dynamic Disk

        Dynamic disk SDS, win2k

$EA (More...): This attribute is used to implement the HPFS extended attribute under NTFS. It is only used for OS/2 compatibity.
$EA_INFORMATION (More...): This attribute is used to implement the HPFS extended attribute under NTFS. It is only used for OS/2 compatibity.
$EFS: $EFS is the named $LOGGED_UTILITY_STREAM of any encrypted file.
See also: $LOGGED_UTILITY_STREAM.
$Extend (More...): This metadata directory contains the metadata files: $ObjId, $Quota, $Reparse.

File (More...)

In the NTFS terminology, a file can be a normal file, directory (like in Linux) or a system file.

$FILE_NAME (More...)

This attribute represents the file's name. A file can have one or more names, which can be in any directory. This is the NTFS equivalent to Unix's hard links.

Filename Namespace (More...)

Not all characters are valid in DOS filenames. For compatibity NTFS stores which namespace the name belongs to.

File Permissions

NTFS supports the standard set of DOS file permissions, namely Archive, System, Hidden and Read Only. In addition, NTFS supports Compressed and Encrypted.
See also: $SECURITY_DESCRIPTOR and Compression

FILE Record

The $MFT is made up of FILE records, so named because of a magic number of FILE. Each record has a standard header and a list of attributes. If the attributes don't fit into a single record, then more records will be used and a $ATTRIBUTE_LIST attribute will be needed.
See also: Attribute, Attribute List, Magic Number and $MFT.

File Record Segment (FRS)

        FRS = MFT File Record

File Reference

Each file record has a unique number identifying it. The first 48 bits are a sequentially allocated number which is the offset in the $MFT. The last 16 bits are a sequence number. Every time the record is altered this number is incremented. The sequence number can help detect errors on the volume.
See also: File Record, $MFT and Volume.

File Runs (See Data Runs)

File Size

There are three file sizes that NTFS records. Each of them stores the number of bytes

R) Real. The number of bytes of data.
A) Allocated. The size taken up on disk.
I) Initialised. Size of compressed file.

If the file is compressed, the Initialised Size may be smaller than the Real Size.

Filesystem

The physical structure an operating system uses to store and organize files on a storage unit. A commonly used filesystem is FAT (used by DOS).

Fixup (See Update Sequence)

Fork (See Resource Fork)

Fragmented

(un)f file

FRS (See File Record Segment)

fsck

This is a utility to check and repair filesystems. Its name is an abbreviation of filesystem check.

GB (See Units)

GUID (See Units)

      The valid format for a GUID is {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}

      Globally Unique Identifier (GUID)

      GUID structures store globally unique identifiers (GUID). A GUID is a
      128-bit value consisting of one group of eight hexadecimal digits, followed
      by three groups of four hexadecimal digits each, followed by one group of
      twelve hexadecimal digits. GUIDs are Microsoft's implementation of the
      distributed computing environment (DCE) universally unique identifier (UUID).
      Example of a GUID:
              1F010768-5A73-BC91-0010A52216A7

      order stored on disk?

      01020304-0506-0708-090A0B0C0D0E0F010

      0x00  04030201
      0x04  0605
      0x06  0807
      0x08  090A0B0C0D0E0F010

Hex, Hexadecimal: Maths carried out in base sixteen. In this documentation, many numbers represented in hex, e.g. 0x02E0, 0xF100.
See also: Binary, Decimal and Units.
HFS (See Hierarchical File System)
Hierarchical File System (HFS): The MacOS filesystem.
High Performance File System (HPFS): The OS/2 filesystem. Remember: once upon a time, OS/2 had to be the operating system developed by both IBM and Microsoft. There was a break between the 2 giants. IBM continued to develop OS/2 (it became OS/2 Warp), and that explains why OS/2 knows how to execute Windows applications. Microsoft decided to make its own operating system: Windows NT. HPFS design influenced NTFS design, so the 2 filesystems share many features.
HPFS (See High Performance File System)

$I30: This is the named index used by directories. The name refers to attribute 0x30 ($FILE_NAME).
See also: Attribute, Directory, $FILE_NAME and Index
Index: (just the whole index idea)
$INDEX_ALLOCATION (More...): This attribute contains the location of the entries that make up an index.
$INDEX_ROOT (More...): This attribute is the root of an index. The index is stored as a balanced binary tree. The only attribute which is indexed is $FILE_NAME and the index is called $I30.
INDX Record (More...): Index records are used by directories, $Quota, $Reparse and $Secure. The contents depend on the type of index being kept. Directories store $FILE_NAME attributes.
See also: Directory, $I30, $Quota, $Reparse and $Secure.
Infinite Logging Area: Something contained in $LogFile. It consists of a sequence of 4KB log records.
See also: $LogFile
Inode: An inode is the filesystems representation of a file, directory, device, etc. In NTFS every inode it represented by an MFT FILE record.
See also: Directory, File, FILE Record and Filesystem

$J: $J is a named data stream of the Metadata File $UsnJrnl.
See also: $UsnJrnl
Junction Point: Microsoft term for a mount point, available in NT 5.0.

KB (See Units)

LCN (See Logical Cluster Number)
Log Record: One 4KB chunk of the infinite logging area. It starts with the magic number 'RCRD' and a fixup, then has undocumented variable length data. [The log record might be further subdivided - I cannot imagine they waste 4KB if they only have to log a few bytes. Custer mentions high level and low level 'records'. High level are: - allocate inode n, - make a directory entry foo in directory m low level are: - modify inode n with the new contents of <1KB>]
$LogFile (More...): This metadata file is used to guarantee data integrity in case of a system failure. It has two copies of the restart area and the infinite logging area. The log file is near the centre of the volume, just after the second cluster of the boot file. [Better say 'run' than cluster. The boot file usually extends over several clusters at the beginning of the disk, and then has a single run of just one cluster (the copy of the boot sector). Also, isn't it 'infinite'?] Transactional logging file
$LOGGED_UTILITY_STREAM (More...): This attribute is used by encrypted files.
Logical Cluster Number (LCN): A volume is divided into clusters. They are numbered sequentially, starting at zero.
See also: Cluster and Volume.
Logical Sequence Number (LSN): A serial number used to identify an NTFS log record.
LSN (See Logical Sequence Number)

Magic Number

Most of the on-disk structures in NTFS have a unique constant identifying them. This number is usually located at the beginning of the structure and can be used as a sanity check.

Master File Table (See $MFT)

$Max

$Max is a named Data Stream of $UsnJrnl.
See also: $UsnJrnl

MB (See Units)

Metadata

Data on the storage unit used by the filesystem only, as a frame to access user data. Metadata constitutes the structure of the filesystem). Metadata examples from various filesystems include FATs, inode tables, free block lists, free block bitmaps, logging areas, and the superblock.

        meta-data

        Data about data. In data processing, meta-data is definitional data
        that provides information about or documentation of other data managed
        within an application or environment.

        For example, meta data would document data about data elements or
        attributes, (name, size, data type, etc) and data about records or
        data structures (length, fields, columns, etc) and data about data
        (where it is located, how it is associated, ownership, etc.). Meta
        data may include descriptive information about the context, quality
        and condition, or characteristics of the data.

$MFT (More...)

This metadata file, the Master File Table, is an index of all the files on the volume. It contains the attributes of each file and the root of any indexes.

$MFTMirr (More...)

This metadata file stores a copy of the first four records of $MFT. It is a safety measure which probably only gets used when chkdsk is run.

$MountMgrDatabase

$MountMgrDatabase is a named Data Stream of dot (the root directory). It contains a list of mounted volumes.
See also: Dot, Root Directory.

MST (See Multi-Sector Transfer)

Multi-Sector Transfer

        multiple sectors, fixup, safety checks

Nibble: Half of a byte (4 bits).
NT Authority: The NT Authority defines the scope of the security identifier. Numbers 0 - 4 represent internal identifiers, e.g. World, Local. 5 represents the NT Authority.
See also: NT Sub Authority SID $SECURITY_DESCRIPTOR
NTFS (More...): NTFS is the file system of Windows NT, Windows 2000 and Windows XP.
See also: Filesystem
NT Sub Authority: The Sub Authority can contain any number of fields (five is usual). Sub Authorities beginning with 21 (0x15) denote a NT Domain identifier. NT Authority SID $SECURITY_DESCRIPTOR

$O: This is one of the named indexes belonging to $Quota and $ObjId.
See also: Index, $Q, $ObjId and $Quota.
$OBJECT_ID (More...): This attribute stores a mapping between a SID and a Security Hash.
$ObjId (More...): This attribute record's the unique identifiers given to files and directorys when using Distributed Link Tracking.

PAM

Pluggable Authentication Modules (PAM) are a set of libraries for validating security on Linux.

Partition (See Volume)

Partition Table

        partition table...
        SFS Win2K dynamic disk

Permissions

There are two mechanisms for storing permissions in NTFS. One is a superset of DOS File Permissions, which includes Read Only and Hidden. The other is based on ACEs and allows granting specific permissions to specific users.
See also: $ACE, File Permissions and $SECURITY_DESCRIPTOR

POSIX

An acronym (pronounced like positive) for Portable Operating System Interface, suggested by Richard M. Stallman. It is a set of international standards (ISO/IEC 9945-1:1996(E), ANSI/IEEE Std 1003.1 1996 Edition) to interface with Unix-like exploitation systems, e.g. Linux. NTFS does not support Unix-like device files.

$PROPERTY_SET

obsolete

$Q: This is one of the named indexes belonging to $Quota.
See also: Index, $O and $Quota.
$Quota (More...): This metadata file stores information about file quotas.

$R: This is the named index belonging to $Reparse.
See also: Index, $Reparse.
RCRD Record: This record is used in the $LogFile. Each represents an atomic transaction that is to be performed.
See also: $LogFile and Transaction
Record: There are several record types in NTFS. FILE Record are used in the $MFT, INDX Records in indexes, RCRD and RSTR Records in the $LogFile.
See also: FILE Record, INDX Record, RCRD Record and RSTR Record
Recursion (See Recursion)
Reference: file (are there any others?)
$Reparse (More...): This metadata file stores information about reparse points.
$REPARSE_POINT (More...): This attribute stores information about reparse points.
Resource Fork: In MacOS's filesystem, HFS, files are allowed to have multiple data streams. These are called resource forks.
See also: HFS and Stream.
Roll-back: When an NTFS volume is mounted, it is checked to see if it is in a consistant state. If it isn't then the $LogFile is consulted and transactions are undone until the disk returns to a consistant state. This does not guarantee data integrity, only disk integrity.
See also: $LogFile, Transaction and Volume.
Root Directory (See Dot, Root Directory)
RSTR Record: Two copies of this are in $LogFile. A restart area has the magic number 'RSTR' followed by a fixup and some other data, including three LSNs. A restart area has a pointer into the log area, such as the first and last log records written and the last checkpoint record written. (that is three - now which is which?)
Runs (See Data Runs)

$SDH: This is one of the named indexes belonging to $Secure.
See also: Index, $SII and $Secure.
$SDS: This is the named data stream belonging to $Secure.
See also: $Secure and Stream
Sector: Unit of data on the physical storage unit. The storage controller can only access data in multiples of this unit. A sector is usually 512 bytes, but can be 1 KB on certain Asian hard disks.
$Secure (More...): This metadata file stores a table of security descriptors used by the volume.
Security: There are two levels of security in NTFS. There are the DOS File Permissions, such as Read Only and Hidden and an ACL model which grants specific permissions to specific users.
See also: ACE, ACL, Permissions, $SECURITY_DESCRIPTOR and SID.
$SECURITY_DESCRIPTOR (More...): This attribute stores all the security information about a file or directory. It contains an ACL for auditing, an ACL for permissions and a SID to show the user and group of the owner.
See also: Attribute, ACL, ACE and SID.
Security Identifier (SID): This variable-length identifier uniquely identifies a user or a group on an NT domain. It is used in the security permissions.
See also: ACE, ACL and $SECURITY_DESCRIPTOR.
Sequence Array (See Update Sequence)
SID (See Security Identifier)
$SII: This is one of the named indexes belonging to $Secure.
See also: Index, $SDH and $Secure.
Sparse File: NTFS supports sparse files. If a file contains large, contiguous, blocks of zeros, then NTFS can choose to not waste any space storing these portions on disk. They are represented as data runs containing nothing. When read from disk, NTFS simply substitutes zeros.
See also: Data Runs.
$STANDARD_INFORMATION (More...): This attribute contains information about a file, such as its file permissions and when it was created.
Stream: All data on NTFS is stored in streams, which can have names. A file can have more than one data streams, but exactly one must have no name. The size of a file is the size of its unnamed data attribute.
$SYMBOLIC_LINK: This attribute This attribute, like $VOLUME_VERSION existed in NTFS v1.2, but wasn't used. It does not longer exist in NTFS v3.0+.

TB (See Units)

Time Stamp

NTFS stores four significant times referring to files and directories. They are: File creation time; Last modification time; Last modification of the MFT record; Last access time. NTFS stores dates as the number of 100ns units since Jan 1^st 1601. Unix, stores dates as the number of seconds since Jan 1^st 1970.

        standardise 4 time fields name & description concept page?
        refer to 4 times as:
          C creation
          A alter (modification)
          M mft (mft changed)
          R read (last access)

        FIXME:
        NOTE: There is conflicting information about the meaning of each of the time
        fields but the meaning as defined below has been verified to be
        correct by practical experimentation on Windows NT4 SP6a and is hence
        assumed to be the one and only correct interpretation.

        creation_time
        Time file was created. Updated when a filename is changed(?).

        last_data_change_time
        Time the data attribute was last modified.

        last_mft_change_time
        Time this mft record was last modified.

        last_access_time
        Approximate time when the file was last accessed (obviously this is not
        updated on read-only volumes). In Windows this is only updated when
        accessed if some time delta has passed since the last update.

        N.B. There is conflicting information about the meaning of each of the time
        fields but the meaning as defined below has been verified to be
        correct by practical experimentation on Windows NT4 SP6a and is hence
        assumed to be the one and only correct interpretation.

Abbr.	Name	Exactly	Approx.
KB	Kilobyte	2¹⁰	10³
MB	Megabyte	2²⁰	10⁶
GB	Gigabyte	2³⁰	10⁹
TB	Terabyte	2⁴⁰	10¹²