NTFS System (Metadata) Files

NTFS System (Metadata) Files

As I mentioned in the architectural overview, the NTFS file system stores virtually all data, both user data and internal management data, in the form of files. The most important of these are a set of special system files, which are also called metadata files. The prefix "meta-" generally refers to something "transcendent" or "beyond"--or merely self-referring. So "metadata files" are files that contain data about data. And that's exactly what these files do. They contain internal information (data) about the "real" data stored on the NTFS volume.

These metadata files are created automatically by the system when an NTFS volume is formatted, and are placed at the beginning of the partition. Now, explaining how these files work is a bit complicated. :^) Understanding their location in an NTFS volume requires that I mention another key structure, the NTFS Master File Table (MFT). The MFT is actually one of these metadata files, but it also contains descriptions of the other metadata files, and in some cases entire other metadata files. Yes, it's a bit confusing. :^) Reading the page on the MFT will help you understand how it works, but in a nutshell, here's what happens: the MFT contains a record describing every file and directory in an NTFS volume, and if the file is small enough, its actual contents may be stored in the MFT itself. Since the metadata files are just "files" to NTFS (albeit special ones), they too have records in the MFT. In fact, the first 16 records of the MFT are reserved for metadata files.

Phew, sorry about that, but hey, I didn't design this thing. :^) Actually, the system is hard to explain, but it is logically consistent, and does work well. The table below provides the important information about the metadata files, including their English names, file names, MFT record numbers and a brief description of what each does:

Metadata File Name	File Name	MFT Record #	Description
Master File Table (MFT)	$MFT	0	This is the MFT itself. This seems to be a bit of a chicken-and-egg problem--how can a record in the MFT contain the MFT? :^) It doesn't. This first MFT record contains descriptive information about the MFT. This is consistent with how NTFS works--since the MFT itself is just "a file", so it also needs a record in the MFT!
Master File Table 2 (MFT2) or Master File Table Mirror	$MFTMirr	1	This is a mirror of the first 16 records of the real Master File Table. It is stored either in the middle of the partition (for Windows NT 3.5 and earlier) or the end of the partition (for Windows NT 4.0 and later). The mirror is a "backup" that is used to ensure that the first few records of the MFT, which of course describe the metadata files themselves, can be accessed in case of a disk error on the original MFT.
Log File	$LogFile	2	The transaction logging file for the volume. This is part of NTFS's file system recoverability feature.
Volume Descriptor	$Volume	3	Contains key information about the volume (partition) itself, such as its name, NTFS version, creation time, and so on. See the complete list of NTFS file attributes for more information.
Attribute Definition Table	$AttrDef	4	This table contains the names and descriptions of the various types of NTFS file attributes used on the volume. (It doesn't contain the attributes themselves, but rather descriptions of what the attributes mean. Remember--metadata.)
Root Directory / Folder	"." (single period)	5	This is a pointer to the root directory or folder of the volume.
Cluster Allocation Bitmap	$Bitmap	6	Contains a "map" showing which clusters on the volume are used and which are available for use.
Volume Boot Code	$Boot	7	This record contains a copy of the volume boot code (or a pointer to it). The volume boot code is also found in the volume boot sector.
Bad Cluster File	$BadClus	8	A list of all clusters on the volume that have been marked as "bad" (meaning, an error was detected on the volume somewhere in those clusters, so the file system wants to be sure not to use them again.)
Quota Table	$Quota	9	Table containing quota information, if disk quotas are being used on the volume. Only used for NTFS 5.0 or later.
Upper Case Table	$UpCase	10	Table containing information for converting file names to the Unicode (16-bit) file naming system for international compatibility.

Note: Records 11 through 15 in the MFT (the 12th through 16th records, since MFT records are numbered starting from zero) are reserved for future metadata files.

The elegance of the metadata system is that by storing internal information in files, it is possible to expand on the capabilities of the file system--changing "dedicated" internal structures is more complicated. Also, these files do not need to be stored in a specific location on the hard disk, so if a specific area of the hard disk is damaged, they can be moved.

Next: Master File Table (MFT)

Home - Search - Topics - Up

Not responsible for any loss resulting from the use of this site.
Please read the Site Guide before using this material.