Windows File System Internals (NTFS)

Objective: The NTFS (New Technology File System) is the default file system for modern Windows versions, designed to be secure, scalable, recoverable, and rich in metadata support.

---

Overview

The NTFS (New Technology File System) is the default file system for modern Windows versions, designed to be secure, scalable, recoverable, and rich in metadata support. Unlike FAT32 or exFAT, NTFS introduces complex data structures, a journaled metadata system, access control lists (ACLs), hard/soft links, and alternate data streams (ADS).

Key NTFS Features

The Master File Table (MFT)

At the heart of NTFS is the MFT (Master File Table). Think of it as the central database of the entire file system. Every file, folder, and metadata structure is stored as an MFT record, including internal system files.

MFT Layout

Each record in the MFT is 1024 bytes and contains:

• File metadata (timestamps, size, attributes)
• Pointers to the file’s data blocks (runs)
• Named streams (e.g., ::$DATA)
• File name entries (long and short names)

Key System Files in the MFT

File Record Attributes

Each NTFS file has a set of attributes that describe both the file and its contents. Attributes are stored either resident (inside the MFT entry) or non-resident (stored in separate clusters).

Common Attributes:

Resident Data

• Small files (<700 bytes) are stored directly in the MFT.

Non-Resident Data

• Larger files are stored elsewhere on disk and referenced via “data runs”.

File Metadata and Timestamps

NTFS tracks multiple timestamps:

• Created: File creation time
• Modified: Last content modification
• MFT Changed: When metadata was last changed
• Accessed: Last file access time

These are stored in STANDARD_INFORMATION and FILE_NAME attributes. Tools like MFTECmd or FTK Imager extract these for forensic timelines.

Alternate Data Streams (ADS)

NTFS supports multiple unnamed or named data streams in a single file. The main stream is usually :$DATA, but you can add hidden ones.

Example:

echo "secret" > notepad.txt:hidden
type notepad.txt:hidden

Forensics Concern:

• ADS are often used to hide payloads or staging binaries.
• dir /R will list streams in Windows.

Directory Structure & Indexing

NTFS directories are files themselves with INDEX_ROOT and INDEX_ALLOCATION attributes.

• Small directories store entries directly inside the MFT (INDEX_ROOT)
• Large directories spill over to other clusters (INDEX_ALLOCATION)

This design allows binary search indexing (B-tree like) instead of linear scanning.

Journaling with $LogFile

NTFS is a journaling file system.

• $LogFile stores redo/undo logs for critical metadata changes.
• Ensures metadata integrity after a power failure or crash.
• Does not journal actual file content, only structural data.

This mechanism supports transactional consistency for files.

NTFS Recovery Concepts

NTFS uses a few safety mechanisms:

1. $LogFile Recovery
   • Replay undo/redo entries post-crash
2. CHKDSK
   • Scans metadata for inconsistencies
   • Can fix MFT, indexes, bitmap mismatches
3. Volume Dirty Bit
   • Flag inside $Volume that triggers auto-CHKDSK

USN Journal (Change Journal)

Located in: $Extend\$UsnJrnl

• Tracks all file-level changes (created, renamed, modified, deleted)
• Used by tools like antivirus, backup software, and forensic tools
• Each event is indexed by USN ID and timestamp

Enable / Query USN Journal:

fsutil usn queryjournal C:

NTFS Object IDs & Reparse Points

• Object IDs: Unique GUIDs for file tracking
• Reparse Points: Used for symbolic links, junctions, OneDrive placeholders

Types of reparse tags:

• IO_REPARSE_TAG_SYMLINK – Symbolic link
• IO_REPARSE_TAG_MOUNT_POINT – Junction
• IO_REPARSE_TAG_APPEXECLINK – App execution alias

You can create symbolic links using:

mklink file2.txt file1.txt

Common NTFS Attacks and Abuses

Low-Level Tools for NTFS Exploration

Summary

• NTFS is a highly advanced file system that embeds metadata, journaling, and fine-grained security into every file.
• The MFT is the backbone of the file system, storing every file and folder as a database-like entry.
• ADS, USN, and Reparse Points introduce both powerful features and potential attack surfaces.
• NTFS journaling ($LogFile) and recovery structures provide strong integrity guarantees.

5 1 vote

Article Rating

Label

{} [+]

Name*

Email*

Website

Label

{} [+]

Name*

Email*

Website

0 Comments

Oldest

Newest Most Voted

Inline Feedbacks

View all comments