NTFS facts for kids

The New Technology File System (NTFS) is a special way computers organize and store files. It's like a super-smart librarian for your hard drive! Microsoft created it. Since Windows NT 3.1, NTFS has been the main file system for the Windows NT family of operating systems.

NTFS replaced older file systems like File Allocation Table (FAT). It offers many improvements. For example, it helps keep your files safe with access control lists (ACLs). It also allows you to encrypt or compress files. NTFS can even make copies of your system while it's running. This helps with backups. You can also use NTFS on other operating systems like Linux and BSD.

How NTFS Was Created

In the 1980s, Microsoft and IBM worked together. They wanted to build a new kind of operating system with a graphical look. This project led to OS/2 and its file system, HPFS.

Microsoft and IBM later went their separate ways. IBM continued with OS/2. Microsoft started developing Windows NT and, along with it, NTFS. The first NTFS developers were Tom Miller, Gary Kimura, Brian Andrew, and David Goebel. NTFS borrowed many good ideas from HPFS.

Different Versions of NTFS

Microsoft has released several versions of NTFS over the years. Each new version brought improvements.

Newer Windows versions, like Windows Vista, added features that use NTFS. These include NTFS symbolic links and partition shrinking. But they didn't change the core NTFS system itself.

How Big Can NTFS Be?

NTFS can handle very large storage drives and files. It works best with small blocks of data called "clusters," usually 4 KB in size.

The largest size an NTFS drive can be is huge! For example, with 4 KB clusters, a drive can be up to 16 TB. Newer Windows versions (like Windows 10 version 1709) can handle even larger drives, up to 8 PB. This is much bigger than older limits.

Individual files can also be incredibly large. The theoretical limit for a single file is 16 EB. In practice, with Windows 10 version 1709, a file can be up to 8 PB. These sizes are enormous, far more than most people will ever need!

Using NTFS with Different Operating Systems

Windows Systems

NTFS versions generally work well with each other. This means you can usually use an NTFS drive from a newer Windows on an older Windows. However, some newer features, like "Previous Versions" (which saves old copies of files), might not work on older Windows versions.

Windows has a tool called `convert.exe`. It can change older file systems like FAT16 or FAT32 into NTFS. This is handy because you don't have to delete all your files first.

Other Operating Systems

Many other operating systems can also work with NTFS drives:

• FreeBSD: This system has been able to read NTFS drives since 1999.
• Linux: Linux can read NTFS drives. Newer versions of the Linux kernel (like 2.6.15 and later) can also write to existing files on NTFS drives. A special driver called NTFS3, added in kernel version 5.15, allows full reading and writing. There's also NTFS-3G, which is a free tool that lets Linux, macOS, and other systems read and write to NTFS drives.
• macOS: Apple's macOS can read NTFS drives. While it has hidden support for writing, it's not turned on by default because it can be unstable. Companies like Paragon Software Group sell reliable tools to enable full read and write access.
• OS/2 and DOS: Some older systems like OS/2 and DOS also have tools that allow them to read and sometimes write to NTFS drives.

Keeping Your Files Safe

NTFS has strong security features to protect your data. It uses access control lists and file encryption.

Access Control Lists (ACLs)

NTFS file system permissions on a modern Windows system

Every file and folder in NTFS has a special security tag. This tag tells the computer who can do what with the file. For example, it can say that everyone can read a file, but only an administrator can change it. This is called a discretionary access control list (DACL).

There's also a system access control list (SACL). This list keeps track of who tries to access a file and what they do. It's like a security log. For example, a company might use it to see if anyone tries to delete important files.

Encryption

Encrypting File System (EFS) lets you encrypt files or folders on an NTFS drive. When a file is encrypted, its contents are scrambled. Only someone with the correct digital key can unscramble and read it. This keeps your private information safe.

EFS uses a fast method to encrypt the file itself. Then, it encrypts the key for that file with your personal digital key. This way, it's quick to encrypt large files. If you lose your key, there are ways for a recovery agent to still access the files if needed.

It's important to know that you can't encrypt and compress the same file using NTFS's built-in tools. You have to choose one or the other. EFS is not available in all versions of Windows, like the Home versions.

Cool Features of NTFS

Journaling

NTFS is a "journaling file system." This means it keeps a special log, called the NTFS Log (`$LogFile`). This log records all changes made to the file system's structure. If your computer suddenly shuts down, the log helps NTFS fix any problems. It makes sure your files and folders stay organized and don't get corrupted.

Newer Windows versions (like Windows 8 and 10) use a different log format. This can cause older Windows versions (like Windows 7) to think there's a problem and run a disk check. But it's usually not a real issue.

The USN Journal (Update Sequence Number Journal) is another log. It tracks changes to files, folders, and their settings. This helps programs keep track of what's happening on your drive.

Hard Links

Imagine having one file, but it appears in two different places with two different names. That's what a "hard link" does! Both names point to the exact same file data. If you change the file using one name, it changes for the other name too. Hard links only work on the same drive.

Windows uses hard links for things like short filenames. These are older, shorter names for files that some old programs might still need.

Alternate Data Streams (ADS)

Alternate data streams let you attach hidden data to a file. It's like having a secret compartment in a file. For example, when you download a file from the internet, your browser might add a small hidden stream called "Zone.Identifier." This stream tells Windows that the file came from the internet and might be unsafe. Windows then asks you if you're sure you want to open it.

You usually can't see these streams in Windows Explorer, and their size isn't added to the file's size. If you copy a file with an ADS to a drive that doesn't support them, the hidden data might be lost. Because they are hidden, some harmful computer programs (malware) have used ADSs to hide their code. That's why security programs now check for them.

File Compression

NTFS can compress files and folders. This saves space on your hard drive. When you turn on compression for a folder, any files you put in it will automatically shrink. NTFS uses a special method to compress data. It works best on files that have lots of repeated information, like text documents.

Good Things About Compression

• Saves Space: You can fit more files on your drive.
• Faster Apps: On computers with fast processors, compressing applications can sometimes make them load quicker because less data needs to be read from the disk.
• Less I/O: Even with SSD drives that compress data themselves, NTFS compression can reduce how much data the drive has to move around.

Things to Watch Out For

• Fragmentation: Large compressed files can become "fragmented." This means their data is split into many small pieces across the drive. While this isn't as big a problem for SSDs, it can slow down older hard disk drives.
• Boot Problems: If important system files needed to start Windows are compressed, your computer might not boot correctly. Newer Windows versions prevent this.

System Compression

Since Windows 10, Microsoft added a new way to compress system files. This feature is called CompactOS. It helps reduce the space Windows takes up on your drive. It's different from regular NTFS file compression. CompactOS is mainly for saving space on devices with limited storage.

Sparse Files

A sparse file: Empty bytes don't need to be saved, thus they can be represented by metadata.

One petabyte (1,125,899,906,842,624 bytes) of sparse files, 0 bytes on disk.

Imagine a file that's mostly empty, like a huge book with only a few pages written. A "sparse file" works like that. It looks like a very big file to programs, but it only uses space on your disk for the parts that actually have data. The empty parts don't take up any room. This is useful for things like databases.

Volume Shadow Copy

The Volume Shadow Copy Service (VSS) helps you recover older versions of files. It's like a time machine for your documents! When you change a file, VSS saves a copy of the old version. This allows you to go back and get an earlier version if you need to. It also helps backup programs copy files even if they are currently being used.

Disk Quotas

Disk quotas let computer administrators control how much disk space each user can use. It's like giving everyone a limit on how many books they can borrow from the library. An administrator can set a warning level and then stop users from saving more files once they hit their limit.

Reparse Points

Reparse points are special tags on files or folders. They tell the file system to do something extra when that file or folder is accessed. For example, they are used for NTFS symbolic links, which are like shortcuts that can point to files or folders anywhere on your computer, even on different drives.

Limitations of NTFS

Resizing Drives

Windows Vista and newer versions let you shrink or expand a drive partition. However, this tool can't move certain important system files. So, sometimes you might need to move or turn off things like your page file (virtual memory) before you can shrink a drive. Other programs can help with this.

OneDrive and NTFS

Since 2017, Microsoft's OneDrive cloud storage service needs to be on an NTFS drive. This is because OneDrive uses reparse points for its "Files On-Demand" feature. This feature lets you see all your OneDrive files on your computer, but only download them when you need them. This means OneDrive files might not work correctly on older Windows versions or other file systems.

How NTFS is Built

NTFS is made up of several key parts that work together. It has a special area called the partition boot sector (PBS) that helps your computer start up. The most important part is the Master File Table (MFT).

Inside, NTFS uses a special kind of tree structure called a B-tree to organize data. This helps it find files quickly. It also uses a journal (like a diary) to make sure everything stays in order, even if there's a power outage.

NTFS allows almost any character in file names, including many different languages. File names can be up to 255 characters long. However, some names are reserved and cannot be used for files in the main directory, like `$MFT` or `$LogFile`.

Master File Table (MFT)

The Master File Table (MFT) is like the main index of your entire drive. It stores important information about every single file, folder, and even the hidden system files. This includes the file name, when it was created, who can access it, and where its data is stored on the drive.

This MFT system helps NTFS find files very quickly. It also makes it easy to add new features to the file system. A backup copy of the MFT, called the MFT mirror, is kept safe in case the main MFT gets damaged.

Metafiles

NTFS uses several special, hidden files called "metafiles." These files help organize and manage the file system itself. They are not like regular files you create. They store information about the drive, track free space, manage security, and more.

Here are some important metafiles:

• `$MFT`: The Master File Table, which lists all files.
• `$MFTMirr`: A backup of the most important parts of the MFT.
• `$LogFile`: The journal that records changes to the file system.
• `$Volume`: Contains information about the entire drive, like its name.
• `$Bitmap`: Shows which parts of the drive are used and which are free.
• `$Boot`: Contains the code needed to start the operating system.
• `$BadClus`: Keeps track of any bad spots on the drive.
• `$Secure`: Stores security settings for files and folders.
• `$Extend`: A folder for other special features like disk quotas.

These metafiles are usually hidden from you. Special tools are needed to view them.

Resident vs. Non-Resident Attributes

NTFS tries to store small pieces of file information directly inside the MFT. This is called "resident data." It's faster because the computer doesn't have to look elsewhere on the drive.

If the file information is too big to fit in the MFT, NTFS stores it in other places on the drive. This is called "non-resident data." The MFT then just points to where that data is located.

Opportunistic Locks (Oplocks)

Opportunistic locks, or oplocks, are a way for computers to work more efficiently, especially over a network. They allow a computer to temporarily "lock" a file. This means it can do things like save changes or read ahead without worrying about other programs changing the file at the same time. This helps speed things up and uses less network data.

Time Tracking

NTFS records file times (like creation or modification dates) in UTC (Coordinated Universal Time). This is a worldwide standard time. When Windows shows you the time, it converts it to your local time zone.

Sometimes, when you copy files between an NTFS drive and a drive with an older file system (like FAT), the time might seem off by an hour. This can happen because of daylight saving time changes.

See also

In Spanish: NTFS para niños

• Comparison of file systems
• NTFSDOS
• ntfsresize
• WinFS (a canceled Microsoft filesystem)
• ReFS, a newer Microsoft filesystem