Everything About NTFS: Features, Differences, and How to Use NTFS

Coco Lin updated on Jul 27, 2022 to Knowledge Center

Summary: What is NTFS? In this article, we we'll go over the Microsoft NTFS basics in detail, including NTFS' operating system compatibility, the pros and cons of the NTFS file system, and the differences between FAT and NTFS.

Quick navigation:

What is NTFS

NTFS (New Technology File System) is a disk format supported by a series of operating systems of the Windows NT kernel. It is a disk format specially designed for management security features such as network and disk quotas and file encryption. It provides long file names, data protection, and recovery and can be and file permissions for security and support for spanning partitions.

The NTFS file system first appeared in the Windows NT operating system in 1993, and its appearance significantly improved the performance of Microsoft's original FAT file system.

NTFS is a journaling file system, which means that in addition to writing information to disk, the file system keeps a journal of all changes that occur. This feature makes the NTFS file system easier to recover if an error (such as a system crash or power outage) and makes the system more robust. In these cases, NTFS can quickly return to normal without any data loss. In the rare event that something goes wrong, Microsoft says the odds of you needing to run the CHKDSK fix for maintenance on the disk volume are extremely low, less than 1%.

Learn More: What is HFS+; APFS(Apple File System)

NTFS function

The NTFS file system has three functions: error warning function, disk self-repair function, and log function.

Error warning function: In the NTFS partition, if the disk sector where the MFT is located happens to be damaged, the NTFS file system will intelligently change the MFT to other sectors of the hard disk and keep the data reading and writing smooth. However, the FAT of FAT16 and FAT32 can only be fixed behind the boot sector of the partition. Once the sector is damaged, the entire file system will be paralyzed.

Disk self-repair function: NTFS can automatically detect and repair logical and physical errors on the hard disk. Every read or write checks whether the sector is correct or not. When an error is found when reading, NTFS will report the error; when an error is found when writing a file to disk, NTFS will store the data in a good location.

Journaling function: In the NTFS file system, any operation can be regarded as an "event." The event log keeps watch over the entire operation, and when it finds a complete file at the destination, it will mark it as "completed." If a power outage occurs in the middle of the replication, "completed" will not be recorded in the event log, and NTFS can redo the unfinished events after powering up.

Features of NTFS

1. Security

The NTFS file system can easily specify the permissions for users to access a file or directory and operate. NTFS can encrypt a file with a randomly generated key. Only the owner and administrator of the file have the decryption key. Even if others can log in to the system, there is no way to read it. NTFS uses user authorization to operate files. This is the essential requirement of network operating systems that users can access specified files with given permissions. NTFS also supports Encrypting File System (EFS) to prevent unauthorized users from accessing files.

2. Fault tolerance

NTFS uses a technique called transaction logging to track modifications to the disk. So NTFS can recover from errors in seconds.

3. Stability

Files of the NTFS file system are less susceptible to viruses and system crashes. This anti-interference ability is directly derived from the high-security performance of the Windows NT operating system. The NTFS file system can only be recognized by Windows NT and Windows 2000/XP and above systems with NT as the kernel. Even if the FAT and NTFS file systems coexist on a disk, NTFS uses a different method from FAT to locate file images, overcoming the shortcomings of the FAT file system that there are many free sector spaces.

4. Downward compatibility

The NTFS file system can access the data of the FAT file system and the HPFS file system. If the file is written to a removable disk (especially a floppy disk), it will automatically use the FAT file system.

5. Reliability

NTFS treats important transactions as complete transactions, and it is completed only after the entire transaction is completed, which can avoid data loss. If the two are inconsistent, the operating system marks the corresponding sector as a bad sector and no longer uses it (cluster remapping), and then rewrites the file to the disk using the copy of the file retained in memory. If an error occurs while reading the file, NTFS returns a read error message and informs the corresponding application that the data has been lost.

6. Large capacity

NTFS completely solves the storage capacity limitation and can support up to 16EB. (1024B=1KB, 1024KB=1MB, 1024MB=1GB, 1024GB=1TB, 1024TB=1PB, 1024PB=1EB). Cluster sizes for NTFS generally range from 512 bytes to 4KB.

7. Long file names

NTFS allows file names of up to 255 characters, breaking the 8.3 standard FAT limits (FAT stipulates that the main file name is eight characters and the extension is three characters). The most significant disadvantage of the NTFS file system is that it can only be recognized by WindowsNT/2000/XP and above systems and Linux systems. Although the NTFS file system can access the files of the FAT file system, its files cannot be accessed by the FAT file system. When the system crashes, we can only start with a floppy disk, CD-ROM, or U disk. After starting, they use FAT or FAT32. The file system cannot access the NTFS file system, inconveniences data rescue.

System Structure of NTFS

NTFS and FAT32 file systems are almost entirely different file systems in the structure. NTFS has many new features, such as security, fault tolerance, file compression, and disk quotas. NTFS partition has four parts: boot sector, Master File Table (MFT), system files, and file storage area.

1. NTFS data storage structure

In the NTFS file system, access to files is allocated according to clusters, and each cluster is an integer multiple of the physical sector. The cluster size is the integer power of 2 of the physical sector. Still, in the NTFS file system, the size of the cluster is automatically allocated by the formatter based on the volume size. NTFS uses the logical cluster number (LCN for short) and virtual cluster number (VCN for short) to locate the cluster. At the same time, the LCN is used to number all the clusters in the entire volume from the beginning to the end. Multiplying the volume factor by the LCN gives the offset in physical bytes on the volume and thus the detailed address of the top physical disk. VCN numbers the clusters of a specific file in sequence from the beginning to the end, which is convenient for referencing the data in the file. In NTFS, all data information on a volume is stored in files, which include the bootloader (a data structure used to obtain and locate files) and bitmap files (record volume usage and size). In general, the file record size will be fixed at 1KB regardless of the cluster size.

2. Partition boot sector

In booting the operating system, the partition boot sector plays an important role, which stores the structure information related to the volume file and the bootstrap program. When the operating system builds the file system, the generated BPB parameters record much important information in the NTFS system, including the number of sectors per cluster, the total number of sectors in the partition, the starting logical cluster number of the MFT, and the file system identifier. In NTFS, all data on a partition is stored as files.

3. Main file table MFT

The main file table MFT is a core part of the NTFS file system. Through MFT, the detailed storage location of all files on the disk can be determined. The main file table is composed of a series of file records, which is a database corresponding to the file. Each file in the volume contains a file record. The first file record is the basic file record, which mainly stores other extended files. Some details were recorded. The file records in the MFT file record array are physically contiguous and are numbered from 0. MFT is only used by the system to structure and organize the file system and is called metadata. All metafile names start with "$" and are hidden files. The first 16 metadata in the MFT table are the most important. The NTFS system backs them up in the volume storage area to avoid data loss.

4. NTFS file attributes

The file record attributes of NTFS can generally be divided into two types: resident attributes and non-resident attributes. If the attribute value is stored in the file record, these attributes are called resident attributes; conversely, if the attribute value is stored outside the file record, these attributes are called non-resident attributes. The first 4 bytes of the attribute header are the attribute type, which contains the attributes describing the basic information of the file (such as the read and write characteristics of the file, the creation time and modification time of the file, etc.), the file name attributes (such as the file name and its length, The size of the allocated space, the size of the actual space occupied by the file, the last access time of the file, etc.) and the data attributes used to describe the content of the file.

NTFS FAQ

Do I need NTFS for Mac?

NTFS is only available on Windows Linux and BSD systems and is read-only on Mac OS. If you have an NTFS drive for cross-platform use, you need an NTFS for Mac tool to help you read and write NTFS drives securely and stably on your Mac.

Can I copy files from NTFS to Mac?

Yes. NTFS is read-only support on Mac, which means you can view files on NTFS disks and copy files from NTFS drives to your Mac.

Should I use NTFS?

Generally, NTFS is best if you plan to use the disk in a Windows-only environment. If you want to use the drive for cross-platform data exchange, exFAT is ideal.

Related Articles