What is NTFS?

NTFS is a high-performance and self-healing file system proprietary to Windows XP Vista 2003 2000 & NT, which supports file-level security, compression and auditing. It also supports large volumes and powerful storage solutions such as RAID.

NTFS follows the FAT file system as the preferred file system for Microsoft’s “Windows”-branded operating systems. NTFS has several improvements such as improved support for metadata and the use of advanced data structures to improve performance, reliability, and disk space utilization, plus additional extensions such as security access control lists (ACL) and file system journaling. The exact file system specification is a trade secret, although (since NTFS v3.00) it can be licensed commercially from Microsoft through their Intellectual Property Licensing program.

NTFS history

In the early 1990s Microsoft and IBM formed a joint project to create the next generation graphical operating system. The result of the project was OS/2, but eventually Microsoft and IBM disagreed on many important issues and separated. OS/2 remained an IBM project. Microsoft started to work on Windows NT. The OS/2 filesystem HPFS contained several important features. When Microsoft created their new operating system, they borrowed many of these concepts for NTFS. Perhaps as a result of this, HPFS and NTFS share the same disk partition identification type code (07). This is unusual since the other major file systems have their own code; FAT has more than nine (one each for FAT12, FAT16, FAT32, etc.). To identify the type of file system in a partition type 07, additional checks are needed.

NTFS versions

NTFS has five released versions: (the alternate names are due to the fact that the OS version is sometimes set in line with the NTFS version)

• v1.0 with NT 3.1, released mid-1993
• v1.1 with NT 3.5, released autumn 1994
• v1.2 written by NT 3.51 (mid-1995) and NT 4 (mid-1996) (occasionally referred to as "NTFS 4.0", because OS version is 4.0)
• v3.0 from Windows 2000 (occasionally "NTFS V5.0")
• v3.1 from Windows XP (autumn 2001; occasionally "NTFS V5.1"), Windows Server 2003 (spring 2003; occasionally "NTFS V5.2"),Windows Vista (mid-2005) (occasionally "NTFS V6.0") and Windows Server 2008

V1.0 and V1.2 are incompatible: that is, volumes written by NT 3.5x cannot be read by NT 3.1 until an update on the NT 3.5x CD is applied to NT 3.1, which also adds FAT long file name support. V1.2 supported compressed files, named streams, ACL-based security, etc. V3.0 added disk quotas, encryption, sparse files, reparse points, update sequence number (USN) journaling, the $Extend folder and its files, and reorganized security descriptors so that multiple files which use the same security setting can share the same descriptor. V3.1 expanded the Master File Table (MFT) entries with redundant MFT record number (useful for recovering damaged MFT files).

Windows Vista introduced Transactional NTFS, NTFS symbolic links, and self-healing functionality though those owe more to additional functionality of the operating system than the filesystem itself. Yet the NTFS version number has not been raised.

How NTFS works

When a hard disk is formatted (initialized), it is divided into partitions or major divisions of the total physical hard disk space. Within each partition, the operating system keeps track of all the files that are stored by that operating system. Each file is actually stored on the hard disk in one or more clusters or disk spaces of a predefined uniform size. Using NTFS, the sizes of clusters range from 512 bytes to 64 kilobytes. Windows NT provides a recommended default cluster size for any given drive size. For example, for a 4 GB (gigabyte) drive, the default cluster size is 4 KB (kilobytes). Note that clusters are indivisible. Even the smallest file takes up one cluster and a 4.1 KB file takes up two clusters (or 8 KB) on a 4 KB cluster system.

The selection of the cluster size is a trade-off between efficient use of disk space and the number of disk accesses required to access a file. In general, using NTFS, the larger the hard disk the larger the default cluster size, since it's assumed that a system user will prefer to increase performance (fewer disk accesses) at the expense of some amount of space inefficiency.

When a file is created using NTFS, a record about the file is created in a special file, the Master File Table (MFT). The record is used to locate a file's possibly scattered clusters. NTFS tries to find contiguous storage space that will hold the entire file (all of its clusters).

Each file contains, along with its data content, a description of its attributes (its metadata).

NTFS and UFSD

UFSD technology provides full access to partitions independently of their support by the current OS (via physical device addressing). With UFSD technology it is possible to mount, for example, NTFS partitions under Linux, Mac OS X, DOS, etc to gain access to their contents. As a result, Paragon UFSD solutions are very popular and in high demand: such as our NTFS for Linux and NTFS for Mac OS X solutions within the Linux and Mac communities. Learn more information about UFSD here.