Windows File System Internals (NTFS)
Objective: The NTFS (New Technology File System) is the default file system for modern Windows versions, designed to be secure, scalable, recoverable, and rich in metadata support.
Contents
- 1 Overview
- 2 Key NTFS Features
- 3 The Master File Table (MFT)
- 4 File Record Attributes
- 5 File Metadata and Timestamps
- 6 Alternate Data Streams (ADS)
- 7 Directory Structure & Indexing
- 8 Journaling with $LogFile
- 9 NTFS Recovery Concepts
- 10 USN Journal (Change Journal)
- 11 NTFS Object IDs & Reparse Points
- 12 Common NTFS Attacks and Abuses
- 13 Low-Level Tools for NTFS Exploration
- 14 Summary
Overview
The NTFS (New Technology File System) is the default file system for modern Windows versions, designed to be secure, scalable, recoverable, and rich in metadata support. Unlike FAT32 or exFAT, NTFS introduces complex data structures, a journaled metadata system, access control lists (ACLs), hard/soft links, and alternate data streams (ADS).
Key NTFS Features
| Feature | Description |
|---|---|
| Metadata-driven | Every file and directory is stored as a metadata record in the MFT |
| Journaling | Changes to critical metadata are recorded in the $LogFile before being committed |
| Security | Full support for file permissions, ACLs, and encryption (EFS) |
| ADS (Alternate Data Streams) | Allows multiple data streams per file |
| Compression & Encryption | Built-in per-file compression and support for EFS |
| Hard Links & Reparse Points | Advanced linking and symbolic path redirection features |
| Sparse Files | Support for efficiently handling large files with empty regions |
The Master File Table (MFT)
At the heart of NTFS is the MFT (Master File Table). Think of it as the central database of the entire file system. Every file, folder, and metadata structure is stored as an MFT record, including internal system files.
MFT Layout
Each record in the MFT is 1024 bytes and contains:
- File metadata (timestamps, size, attributes)
- Pointers to the file’s data blocks (runs)
- Named streams (e.g.,
::$DATA) - File name entries (long and short names)
Key System Files in the MFT
| Entry Name | Purpose |
|---|---|
$MFT | The Master File Table itself |
$Bitmap | Tracks which clusters are used/free |
$LogFile | Journals metadata changes |
$Secure | Security descriptors and ACLs |
$Volume | Volume info (version, dirty flag) |
$AttrDef | List of valid attributes |
$Extend | Houses extended features (like quotas, EFS, USN Journal) |
File Record Attributes
Each NTFS file has a set of attributes that describe both the file and its contents. Attributes are stored either resident (inside the MFT entry) or non-resident (stored in separate clusters).
Common Attributes:
| Attribute | Description |
|---|---|
STANDARD_INFORMATION | Basic timestamps and permission flags |
FILE_NAME | Long and short name entries |
DATA | The file’s actual data (can be named streams) |
OBJECT_ID | Unique identifier for tracking |
SECURITY_DESCRIPTOR | NTFS ACLs |
ATTRIBUTE_LIST | Used if the record can’t fit in one MFT entry |
Resident Data
- Small files (<700 bytes) are stored directly in the MFT.
Non-Resident Data
- Larger files are stored elsewhere on disk and referenced via “data runs”.
File Metadata and Timestamps
NTFS tracks multiple timestamps:
Created: File creation timeModified: Last content modificationMFT Changed: When metadata was last changedAccessed: Last file access time
These are stored in STANDARD_INFORMATION and FILE_NAME attributes. Tools like MFTECmd or FTK Imager extract these for forensic timelines.
Alternate Data Streams (ADS)
NTFS supports multiple unnamed or named data streams in a single file. The main stream is usually :$DATA, but you can add hidden ones.
Example:
echo "secret" > notepad.txt:hidden
type notepad.txt:hidden
Forensics Concern:
- ADS are often used to hide payloads or staging binaries.
dir /Rwill list streams in Windows.
Directory Structure & Indexing
NTFS directories are files themselves with INDEX_ROOT and INDEX_ALLOCATION attributes.
- Small directories store entries directly inside the MFT (
INDEX_ROOT) - Large directories spill over to other clusters (
INDEX_ALLOCATION)
This design allows binary search indexing (B-tree like) instead of linear scanning.
Journaling with $LogFile
NTFS is a journaling file system.
$LogFilestores redo/undo logs for critical metadata changes.- Ensures metadata integrity after a power failure or crash.
- Does not journal actual file content, only structural data.
This mechanism supports transactional consistency for files.
NTFS Recovery Concepts
NTFS uses a few safety mechanisms:
- $LogFile Recovery
- Replay undo/redo entries post-crash
- CHKDSK
- Scans metadata for inconsistencies
- Can fix MFT, indexes, bitmap mismatches
- Volume Dirty Bit
- Flag inside
$Volumethat triggers auto-CHKDSK
- Flag inside
USN Journal (Change Journal)
Located in: $Extend\$UsnJrnl
- Tracks all file-level changes (created, renamed, modified, deleted)
- Used by tools like antivirus, backup software, and forensic tools
- Each event is indexed by USN ID and timestamp
Enable / Query USN Journal:
fsutil usn queryjournal C:
NTFS Object IDs & Reparse Points
- Object IDs: Unique GUIDs for file tracking
- Reparse Points: Used for symbolic links, junctions, OneDrive placeholders
Types of reparse tags:
IO_REPARSE_TAG_SYMLINK– Symbolic linkIO_REPARSE_TAG_MOUNT_POINT– JunctionIO_REPARSE_TAG_APPEXECLINK– App execution alias
You can create symbolic links using:
mklink file2.txt file1.txt
Common NTFS Attacks and Abuses
| Abuse Technique | Description |
|---|---|
| ADS Persistence | Hide malicious DLLs or scripts in alternate streams |
| MFT Record Abuse | Create thousands of MFT entries to trigger slowdowns or detection blind spots |
| Symbolic Link Hijack | Abuse reparse points to redirect execution |
| USN Journal Wipe | Delete forensic history using low-level tools |
Low-Level Tools for NTFS Exploration
| Tool | Purpose |
|---|---|
NTFSInfo (Sysinternals) | View cluster sizes, MFT layout |
MFTECmd (Eric Zimmerman) | Parse MFT and timestamps |
FTK Imager | Browse NTFS structure for forensics |
fsutil | Query volume, reparse points, streams |
NTFSWalker | Inspect MFT and attributes |
WinHex / 010 Editor | View raw disk sectors and parse binary templates |
Summary
- NTFS is a highly advanced file system that embeds metadata, journaling, and fine-grained security into every file.
- The MFT is the backbone of the file system, storing every file and folder as a database-like entry.
- ADS, USN, and Reparse Points introduce both powerful features and potential attack surfaces.
- NTFS journaling (
$LogFile) and recovery structures provide strong integrity guarantees.
That’s a great point about building skills, not just relying on luck! It reminds me of resources like jiliok login, which focuses on education within the iGaming space – a smart approach for new players! Really helps with responsible gaming.
Interesting analysis! Understanding game mechanics is key, and platforms like ph978 casino are evolving to help with that. Strategic play really elevates the experience, don’t you think? It’s about more than just luck!
Fala galera do bolão! A apostaganha4 parece ter umas apostas interessantes. Preciso dar uma olhada com mais calma, mas a primeira impressão foi boa. Quem sabe a gente não faz uns gains por lá? Confere aí: apostaganha4
Yo what’s up, heard some good things from the homies about tk88bet. Gonna check them out myself. They said the odds are good and customer service is on point. Fingers crossed I win big! Definitely gonna try tk88bet out!
Bk8vietnam is my go-to spot for online betting. Always a smooth experience and great promotions. Check it out here: bk8vietnam
Finding a reliable BK8 link can be a pain. Thankfully, bk8link1.info has got you covered. Easy to find the latest access. Give it a look: bk8link1
Feeling lucky? Iwinfortune might be your next favorite spot. They have a lot of games and the site is really user-friendly. See for yourself: iwinfortune
Jilipark2 is fun! Fast payouts and great customer service. I had a withdrawal issue but they fixed it really fast. It’s my favorite! jilipark2
Gotta say, 123dbet caught my eye. Gave it a whirl, and I’m impressed! Cool interface. Defo worth a look-see! 123dbet
Okay, 55bmwslot… fingers crossed for some smooth spins and big payouts! Let’s see what those reels can do! Give them a try now 55bmwslot
Hey, 56dplataforma seems alright. I really had a good experience, it was smooth and easy so I keep going back! It’s nice to finally be somewhere consistent. Give it a hot with: 56dplataforma
I gotta say, 6789fccom has a lot going for it. Good offers, the games are very varied, and you can just keep playing forever! The world’s your oyster! Check it out, you won’t regret doing the same: 6789fccom
68win21 is alright I suppose. Not a bad website if you are looking to spend a little time and unwind. Perhaps you could win something if you’re lucky. Give it a go here: 68win21
It’s fascinating how easily our brains can fall into patterns when gambling – loss aversion is real! Seeing platforms like jl 77 apk emphasize responsible gaming & KYC is a good sign, helping manage those impulses. Awareness is key!
Came across 3363cc the other day. Heard some mixed reviews. Anyone got personal experience with them? Official page 3363cc
Downloaded the mega777apk the other day and it’s pretty cool! Easy to navigate and play on my phone. Definitely recommend if you’re into mobile gaming. mega777apk
Gave winovamx a spin. It’s alright! Nothing ground-breaking, but had a few good rounds. Worth a look to see if it’s your style. winovamx
Just found this during a boring meeting and finally clicked away! The localized payment options like GCash are perfect for us. Check out 8K8T download to start winning today.
Alright, me88casino is on my radar. The vibes are nice, and I’ve heard some good things. See for yourself here me88casino
Nova88slot is pretty good. Love the colours on the page. Check em out now at nova88slot!
Yo, just tried my luck at pk88asia, gotta say, had some decent wins. Interface is pretty smooth too. Check it out if you’re feeling lucky pk88asia
Boss777game, eh? Gotta love a site with confidence. Layout looks good, and they seem to have some cool promos. Let’s see if they live up to the name. You can find it here boss777game
Trying to register on hot646.ph Been a bit of a headache, to be honest. Hopefully, it’s worth the trouble once I’m actually in. hot646.ph login register
Hey folks, if you’re looking for something new, give 555taya a go. I think you you will like it here. Find it here 555taya.
I’ve been using Matbet for a while now to watch my favorite teams play. I’m really happy with how easy their platform is to use. Streaming is great: matbet izle
Hey there! Are you looking for Malbet? I found it here! Easy to use and keep up with all the action. malbet
One less place to look for Altili guesses. Get your Nesine Altili guesses here nesine altılı tahmin!
I teach tech for fun; this secure Philippine gaming site impresses me with its strict KYC and SSL safety at 25ph club. I’d recommend checking their verified app before depositing funds via GCash today.
Decided to try cm88okvip. Hoping for some luck! The site looks promising, fingers crossed for a big payout! Give it a shot: cm88okvip
Alright, 8winbet1! Jumped in recently and gotta say, not bad at all. The site’s easy to navigate, and I actually won a bit on the slots. Keeping my fingers crossed for more luck. Check it out if you’re looking for a new spot to play. 8winbet1
Hey Brazzino777, just wanted to say I’m digging the vibe here! The graphics are sharp, and I’ve actually had some decent payouts. Definitely worth a shot if you’re looking for a fun experience. brazzino777
Gana777mx… suena a ganador, ¿no? Well, give it a shot and see if the name holds up. A good option for those looking for a Mexican online gaming experience. Explore here: gana777mx
Alright, alright, let’s see what mxzuviocasino’s all about. New casino? I’m always down for a little gamble. Wish me luck! Dive in here: mxzuviocasino
hehe555login… sounds kinda fun! Gonna give it a spin and see if the name lives up to the hype. Wish me some positive vibes! See for yourself: hehe555login
H2 Club? Sounds exclusive! I’m always looking for the best. Gotta see what the buzz is about. h2 club
Anyone using soi cau mn minh ngoc hom nay for their picks? Share your strategies and winning numbers! Let’s win big together! soi cau mn minh ngoc hom nay
Winzo Gold, huh? Is it actually legit gold? Or just a way to describe virtual currency? What’s the deal everyone? winzo gold
This history really makes you think about how much the industry has changed. Seeing the sheer breadth of options, like the bet365 games app link, reminds me how much polish is expected now. bet365 games app link