NTFS standard three

 

System Files

Unlike fixed data block FAT/FAT32 partition layout, NTFS volumes all data files stored in a manner, including boot records and catalogs volumes of important data (important data in the block is called NTFS volume system files), so it allows you to store important data volumes anywhere volumes (in addition to the boot record), and for all the important data has a standard way to manipulate it. This feature makes any change in the volume size is very convenient (in the volume bitmap file plus or minus the change in the sector of information on the line), but also can be easily avoided FAT/FAT32 volume FAT table section has physical damage the problem is most of the space will be used for the volume. 

Corresponds to the kind of important data, NTFS file system partition there were 16, they are:

Record number
Name
OS
Description
0
$MFT
 
Master File Tab Master File Table. The document records the volume all the files (including $ MFT own) a description of the information through the $ MFT file can access all the information volume. $ MFT file record by a number of files (FRS) components. Description of each file occupies one or more documented. For each file, $ MFT is called a set of attributes (Attributes) records to save their information. $ MFT file information in the first 12 were recorded information 12 system files, from No. 12-23 records retention, records from the 24th to record information from other files.
1
$MFTMirr
 
Mirror of $ MFT $ MFT file before 4 files ($ MFT, $ MFTMirr, $ LogFile, $ Volume) description of the backup. This document is mainly used to restore the volume when the volume of data corruption.
2
$LogFile
 
Transaction log file volumes of information.
3
$Volume
 
Volume basic information, including volume name, serial number and other information.
4
$AttrDef
 
Attribute definition, which defines the attribute types available in this volume.
5
.(Root Directory)
 
Root directory NTFS volumes.
6
$Bitmap
 
Record the volume of all the use of the distribution unit. The data file corresponds to each cluster Bit.
7
$Boot
 
Boot record to boot from an NTFS volume through the file system code. This document is the only one NTFS volume fixed position file must be placed in the first sector of the volume.
8
$BadClus
 
Record volume of bad clusters information, this document is a sparse file that contains only the bad cluster information.
9
$Qutoa
NT
 
9
$Secure
2K
The security descriptor record volumes of information used in character.
10
$UpCase
 
The records of all Unicode character encoding uppercase code under the, for comparing and sorting the file name.
11
$Extend
2K
This file is a directory, extended metadata catalog ,which records the GUID, and volume quotas and other information objects. $ ObjId, $ Quota, $ Reparse, $ UsnJrnl
12
$Extend\$Reparse
2K
Reparse point file        11 to 15 marked for use
13
$Extend\$UsnJrnl
2K
Change log file
14
$Extend\$Quota
2K
Quota Management Document
15
$Extend\$ObjId
2K
Object ID documents
16~23
 
 
Reserved,                 marked as unused
>24
A File
 
General Files
>24
A Dir
 
General Catalog
 
 

File contains at least $ STANDARD_INFORMATION, $ FILE_NAME attribute 

$MFT 

MFT record set in the properties file

Type
Description
Name
0x10
$STANDARD_INFORMATION
 
0x30
$FILE_NAME
$MFT
0x80
$DATA
[Unnamed]
0xB0
$BITMAP
[Unnamed]

 Unnamed data stream format  

Inode
Filename
Description
0
$MFT
Master File Table -An index of every file
1
$MFTMirr
A backup copy of the first 4 records of the MFT
2
$LogFile
Transactional logging file
3
$Volume
Serial number, creation time, dirty flag
...
...
...
 
 
 The file is $ MFT backup file, holds the $ MFT in the first four months documentation files. The role of the $ MFT file is that when restoring data volumes when the file is damaged.
 
In the MFT file record set properties
Type
Description
Name
0x10
$STANDARD_INFORMATION
 
0x30
$FILE_NAME
$MFTMirr
0x80
$DATA
[Unnamed]
 
 

Inode
Filename
Description
0
$MFT
Master File Table -An index of every file
1
$MFTMirr
A backup copy of the first 4 records of the MFT
2
$Logfile
Transactional logging file
3
$Volume
Serial number, creation time, dirty flag
4
...
If present, further FILE records from the MFT (see $MFT)

$LogFile  

In the MFT file record set properties

Type
Description
Name
0x10
$STANDARD_INFORMATION
 
0x30
$FILE_NAME
$LogFile
0x80
$DATA
[Unnamed]
 
 
In the MFT file record set properties

Type
Description
Name
0x10
$STANDARD_INFORMATION
 
0x30
$FILE_NAME
$Volume
0x50
$SECURITY_DESCRIPTOR
 
0x60
$VOLUME_NAME
 
0x70
$VOLUME_INFORMATION
 
0x80
$DATA
[Unnamed]

   Unnamed data stream format

0 bytes long

 
In the MFT file record set properties

Type
Description
Name
0x10
$STANDARD_INFORMATION
 
0x30
$FILE_NAME
$AttrDef
0x50
$SECURITY_DESCRIPTOR
 
0x80
$DATA
[Unnamed]

  

Offset
Size
Description
0x00
128
Label in Unicode
0x80
4
Type
0x84
4
Display rule
0x88
4
Collation rule
0x8C
4
Flags
0x90
8
Minimum size
0x98
8
Maximum size

Flag
Description
0x00
Binary
0x01
Filename
0x02
Unicode String
0x10
Unsigned Long
0x11
SID
0x12
Security Hash
0x13
Multiple Unsigned Longs

 
 
Domain name: www.mrtlab.com | | Telephone: +86-27-82621261
MRT data recovery website,provides professional HDD firmware repair and data recovery technical resources!
Copyright 2003-2014 Powered By MrtLab