3. Volume Layout
3.1. Overview
A freshly formatted NTFS volume will look like:

Table 1.4. Layout of a freshly formatted NTFS volume

BOOT

MFT

More Meta data

Free Space

3.2. Notes
3.2.1. Other information
Everything is a file in NTFS. The index to these files is the Master File Table (MFT). The MFT lists the Boot Sector file ($Boot), located at the beginning of the disk. $Boot also lists where to find the MFT. The MFT also lists itself.

Located in the centre of the disk, we find some more Metadata files. The interesting ones are: $MFTMirr and $LogFile. The MFT Mirror is an exact copy of the first 4 records of the MFT. If the MFT is damaged, then the volume could be recovered by finding the mirror. The LogFile is journal of all the events waiting to be written to disk. If the machine crashes, then the LogFile is used to return the disk to a sensible state.

Hidden at the end of the volume, is a copy of the boot sector (cluster 0). The only Metadata file that makes reference to it is $Bitmap, and that only says that the cluster is in use.

3.2.2. MFT Zone
To prevent the MFT becoming fragmented, Windows maintains a buffer around it. No new files will be created in this buffer region until the other disk space is used up. The buffer size is configurable and can be 12.5%, 25%, 37.5% or 50% of the disk. Each time the rest of the disk becomes full, the buffer size is halved.

MFT Zone Reservation IS NOT STORED ON DISK MFT Zone (reserved space for MFT)
1 = 12.5%
2 = 25.0%
3 = 37.5%
4 = 50.0%

This is the "system files" space at the beginning of the disk. Ntfs Mft Zone Reservation link in to Mft and bitmap
      cluster size 512 bytes, 1k, 2k, 4k, 8k, 16k, 32k, 64k
      very flexible, all the system files can be relocated, except $Boot
      supports streams named data streams
      attributes for a file can span several MFT records not necessarily contiguous or in order
      everything is an attribute, including the data
      filenames stored in Unicode
      journaling file system
      compression
      security
      hard links
      encryption
      LCNs vs VCNs

Trackback: http://blog.easeus.com/action.php?action=tb&id=35

Tags: windows,NTFS,xp,ntfs