CS 537 Notes, Section #26: Windows (NT) File System

Chapter 22, Section 22.5 in Operating Systems Concepts.
Not covered in OSTEP.


The Windows file system is called NTFS, and was introduced with Windows NT 4.0 and is the standard file system on Windows 2000 and later systems, such as Windows XP. Its goal was to solve the size, performance, reliability, and flexibility limitations in the DOS (aka "FAT" file system).

It has a general similarity to the FAT file system in that all files are described in a single table, called the Master File Table (MFT). However, it has more modern characteristics in that all components are files, including:
  • Master File Table
  • data files
  • directories
  • free list (bit map)
  • boot images
  • recovery logs

The file system also has features to support redundancy and transactions, which we will not discuss. A great reference for details is the book: Inside the Windows NT File System by Helen Custer, published by (not surprisingly) Microsoft Press.

Disk Layout

Disks are divide in fixed size regions:

Master File Table (MFT)

Clusters are the key element to allocation:

The MFT is the major, and in some ways, the only data structure on disk:

Master File Table Overview

MFT Entries

As stated previously, each row or entry in the MFT (called a record) describes a file and logically contains the file. In the case of small files, the entry actually contains the contents of the file.

Each entry is consists of (attribute, value) pairs. While the conceptual design of NTFS is such that this set of pairs is extensible to include user-defined attributes, current version of NTFS has a fixed set. The main attributes are:

Simplified View of MFT Entry

Very interesting fact: For small files, this design is extremely efficient. By looking no further than the MFT entry, you have the complete contents of the file.

However, the Data field gets more complicated in the common case where the data contained in the file is larger than an MFT entry. When dealing with large data, the Data attribute contains pointers to the data, rather than the data itself.

MFT Entry with Extents


As with other modern file systems, a directory in NTFS is a file whose data contains a collection of name/file mappings.

NTFS Directory, Simple Version

If the directory is larger, then the top part of (the B+ tree of) the directory is in the MFT entry, which points to extents that contain the rest of the name/file mappings.

NTFS Directory, with B+ tree extents

Copyright © 2013, 2018, 2020 Barton P. Miller
Non-University of Wisconsin students and teachers are welcome to print these notes their personal use. Further reproduction requires permission of the author.