NTFS Documentation: $MFT

Definition

In NTFS, everything is a file. Even all metadata are stored in files called system files. It is quite unusual for a filesystem, but it allows the filesystem driver to manipulate these data in a generic way (for example, to perform access control on them), and since these data can be moved and located anywhere on the storage unit, it reduces the risk of damage. The Master File Table (MFT) is the most important system file. It contains information about all the files of the volume. There is exactly one MFT per volume.

Layout

The MFT is a sequence of FILE records. The first 16 FILE records describe system files, as follows:

FILE record number File name
0 $MFT
1 $MFTMirr
2 $LogFile
3 $Volume
4 $AttrDef
5 . (root directory)
6 $Bitmap
7 $Boot
8 $BadClus
9 $Quota
A $UpCase
B
C
D
E
F
10 and higer Any file

Note: You probably noticed that the MFT is self-referencing. This situation could lead to an infinite loop during file creation:

  1. A new (base) FILE record must be added to the data attribute of the MFT, which is necessarily non-resident (because its stream, which at least contains the base FILE record of the MFT, is necessarily larger than one FILE record).

  2. The runlist of the data attribute of the MFT will grow.

  3. To store that, the MFT may require a new (extension) FILE record...

To avoid this, FILE records B to F are reserved for extension FILE records of the MFT itself (they are not for future use).

Properties

The MFT can't shrink when the system is running.

Regis Duchesne at VIA, ECP, France
Last modified: Sun Feb 14 16:29:44 PST 1999