|
System Files
Unlike fixed data block FAT/FAT32 partition layout, NTFS volumes all data files stored in a manner, including boot records and catalogs volumes of important data (important data in the block is called NTFS volume system files), so it allows you to store important data volumes anywhere volumes (in addition to the boot record), and for all the important data has a standard way to manipulate it. This feature makes any change in the volume size is very convenient (in the volume bitmap file plus or minus the change in the sector of information on the line), but also can be easily avoided FAT/FAT32 volume FAT table section has physical damage the problem is most of the space will be used for the volume.
Corresponds to the kind of important data, NTFS file system partition there were 16, they are:
|
Record number
|
Name
|
OS
|
Description
|
|
0
|
$MFT
|
|
Master File Tab Master File Table. The document records the volume all the files (including $ MFT own) a description of the information through the $ MFT file can access all the information volume. $ MFT file record by a number of files (FRS) components. Description of each file occupies one or more documented. For each file, $ MFT is called a set of attributes (Attributes) records to save their information. $ MFT file information in the first 12 were recorded information 12 system files, from No. 12-23 records retention, records from the 24th to record information from other files.
|
|
1
|
$MFTMirr
|
|
Mirror of $ MFT $ MFT file before 4 files ($ MFT, $ MFTMirr, $ LogFile, $ Volume) description of the backup. This document is mainly used to restore the volume when the volume of data corruption.
|
|
2
|
$LogFile
|
|
Transaction log file volumes of information.
|
|
3
|
$Volume
|
|
Volume basic information, including volume name, serial number and other information.
|
|
4
|
$AttrDef
|
|
Attribute definition, which defines the attribute types available in this volume.
|
|
5
|
.(Root Directory)
|
|
Root directory NTFS volumes.
|
|
6
|
$Bitmap
|
|
Record the volume of all the use of the distribution unit. The data file corresponds to each cluster Bit.
|
|
7
|
$Boot
|
|
Boot record to boot from an NTFS volume through the file system code. This document is the only one NTFS volume fixed position file must be placed in the first sector of the volume.
|
|
8
|
$BadClus
|
|
Record volume of bad clusters information, this document is a sparse file that contains only the bad cluster information.
|
|
9
|
$Qutoa
|
NT
|
|
|
9
|
$Secure
|
2K
|
The security descriptor record volumes of information used in character.
|
|
10
|
$UpCase
|
|
The records of all Unicode character encoding uppercase code under the, for comparing and sorting the file name.
|
|
11
|
$Extend
|
2K
|
This file is a directory, extended metadata catalog ,which records the GUID, and volume quotas and other information objects. $ ObjId, $ Quota, $ Reparse, $ UsnJrnl
|
|
12
|
$Extend\$Reparse
|
2K
|
Reparse point file 11 to 15 marked for use
|
|
13
|
$Extend\$UsnJrnl
|
2K
|
Change log file
|
|
14
|
$Extend\$Quota
|
2K
|
Quota Management Document
|
|
15
|
$Extend\$ObjId
|
2K
|
Object ID documents
|
|
16~23
|
|
|
|
Reserved, marked as unused
|
|
|
>24
|
A File
|
|
General Files
|
|
>24
|
A Dir
|
|
General Catalog
|
|
…
|
…
|
|
|
File contains at least $ STANDARD_INFORMATION, $ FILE_NAME attribute
$MFT
MFT record set in the properties file
|
Type
|
Description
|
Name
|
|
0x10
|
$STANDARD_INFORMATION
|
|
|
0x30
|
$FILE_NAME
|
$MFT
|
|
0x80
|
$DATA
|
[Unnamed]
|
|
0xB0
|
$BITMAP
|
[Unnamed]
|
Unnamed data stream format
|
Inode
|
Filename
|
Description
|
|
0
|
$MFT
|
Master File Table -An index of every file
|
|
1
|
$MFTMirr
|
A backup copy of the first 4 records of the MFT
|
|
2
|
$LogFile
|
Transactional logging file
|
|
3
|
$Volume
|
Serial number, creation time, dirty flag
|
|
...
|
...
|
...
|
The file is $ MFT backup file, holds the $ MFT in the first four months documentation files. The role of the $ MFT file is that when restoring data volumes when the file is damaged.
In the MFT file record set properties
|
Type
|
Description
|
Name
|
|
0x10
|
$STANDARD_INFORMATION
|
|
|
0x30
|
$FILE_NAME
|
$MFTMirr
|
|
0x80
|
$DATA
|
[Unnamed]
|
|
Inode
|
Filename
|
Description
|
|
0
|
$MFT
|
Master File Table -An index of every file
|
|
1
|
$MFTMirr
|
A backup copy of the first 4 records of the MFT
|
|
2
|
$Logfile
|
Transactional logging file
|
|
3
|
$Volume
|
Serial number, creation time, dirty flag
|
|
4
|
...
|
If present, further FILE records from the MFT (see $MFT)
|
$LogFile
In the MFT file record set properties
|
Type
|
Description
|
Name
|
|
0x10
|
$STANDARD_INFORMATION
|
|
|
0x30
|
$FILE_NAME
|
$LogFile
|
|
0x80
|
$DATA
|
[Unnamed]
|
In the MFT file record set properties
|
Type
|
Description
|
Name
|
|
0x10
|
$STANDARD_INFORMATION
|
|
|
0x30
|
$FILE_NAME
|
$Volume
|
|
0x50
|
$SECURITY_DESCRIPTOR
|
|
|
0x60
|
$VOLUME_NAME
|
|
|
0x70
|
$VOLUME_INFORMATION
|
|
|
0x80
|
$DATA
|
[Unnamed]
|
Unnamed data stream format
0 bytes long
In the MFT file record set properties
|
Type
|
Description
|
Name
|
|
0x10
|
$STANDARD_INFORMATION
|
|
|
0x30
|
$FILE_NAME
|
$AttrDef
|
|
0x50
|
$SECURITY_DESCRIPTOR
|
|
|
0x80
|
$DATA
|
[Unnamed]
|
|
Offset
|
Size
|
Description
|
|
0x00
|
128
|
Label in Unicode
|
|
0x80
|
4
|
Type
|
|
0x84
|
4
|
Display rule
|
|
0x88
|
4
|
Collation rule
|
|
0x8C
|
4
|
Flags
|
|
0x90
|
8
|
Minimum size
|
|
0x98
|
8
|
Maximum size
|
|
Flag
|
Description
|
|
0x00
|
Binary
|
|
0x01
|
Filename
|
|
0x02
|
Unicode String
|
|
0x10
|
Unsigned Long
|
|
0x11
|
SID
|
|
0x12
|
Security Hash
|
|
0x13
|
Multiple Unsigned Longs
|
|
