NTFS Documentation

Introduction

NTFS is the filesystem of the system Windows NT®. It supports almost all POSIX features, all HFS features, and all HPFS features.

It has some advantages over old filesystems:

• It can deal with large capacity (up to 2^46 GB) storage units.
• It has built-in data compression.
• It uses a log file for transactions.

Prerequisites:

• Most of the numbers are in hexadecimal notation
• When not specified, the unit of a size is the byte.
• Since Windows NT® was first designed for the Intel® architecture, the byte order is little-endian (the integer 12345678 is stored 78 56 34 12).
• An horizontal thick bar in a table means that there is a discontinuity in the offset.
• There still is a lot of questions we should answer to before considering a driver based on this documentation as reliable.

• Have a look at the Master File Table.
• Have a look at this Microsoft PowerPoint document that contains an overview of some structures.
• Read the Notes.

Frequently Asked Questions

• Using Windows NT®.
• Using the Linux NTFS driver.

Greetings

• Albert Cahalan
• Helen Custer
• David Dillard
• Régis Duchesne
• Martin von Löwis
• Domagoj Pensa
• Rani Assaf
• Richard Russon

If you feel that somebody is missing in this list, please tell me.

References

• "Inside the Windows NT® File System", Helen Custer, ISBN: 1-55615-660-X.
• Microsoft TechNet, February 97, Windows NT Training: Support, NTFS
• "Windows NT 4 Server Unleashed", chapter 6, Jason Garms, et al., ISBN: 0-672-30933-5
• The linux-ntfs@tiger.informatik.hu-berlin.de mailing list