Home
Files
Attributes
Concepts
 Glossary

Home - Layout

Previous Next

Overview

A freshly formatted NTFS volume will look like:

B
O
O
T		 M
F
T
Free Space
 More
Meta
data
Free Space

Notes

Other information

Everything is a file in NTFS. The index to these files is the Master File Table (MFT). The MFT lists the Boot Sector file ($Boot), located at the beginning of the disk. $Boot also lists where to find the MFT. The MFT also lists itself.

Located in the centre of the disk, we find some more Metadata files. The interesting ones are: $MFTMirr and $LogFile. The MFT Mirror is an exact copy of the first 4 records of the MFT. If the MFT is damaged, then the volume could be recovered by finding the mirror. The LogFile is journal of all the events waiting to be written to disk. If the machine crashes, then the LogFile is used to return the disk to a sensible state.

Hidden at the end of the volume, is a copy of the boot sector (cluster 0). The only Metadata file that makes reference to it is $Bitmap, and that only says that the cluster is in use.

MFT Zone

To prevent the MFT becoming fragmented, Windows maintains a buffer around it. No new files will be created in this buffer region until the other disk space is used up. The buffer size is configurable and can be 12.5%, 25%, 37.5% or 50% of the disk. Each time the rest of the disk becomes full, the buffer size is halved. 

    MFT Zone Reservation IS NOT STORED ON DISK
    MFT Zone (reserved space for MFT)
      1 = 12.5%
      2 = 25.0%
      3 = 37.5%
      4 = 50.0%
      Where is this stored on disk?
      volume?  mft?  boot?
      This is the 'system files' space at
      the beginning of the disk.
      NtfsMftZoneReservation

    link in to mft and bitmap

Copyright ©