NTFS: Difference between revisions

25 bytes added ,  8 months ago
Added a link to the Windows NT page.
[unchecked revision][unchecked revision]
No edit summary
(Added a link to the Windows NT page.)
 
(9 intermediate revisions by 8 users not shown)
Line 1:
{{Filesystems}}
 
NTFS ('''New Technology File System''') is [[Windows NT]]'s native file system. It is not only based on [[HPFS]], but also supports security features such as access control. Since Windows NT is entirely unicode, NTFS is a unicode filesystem, with each character (e.g. in names) being 16-bits instead of 8-bits.
 
== About ==
Line 30:
! Field
! Type
! Length
|-
|JMP || byteint8_t[3] || 3
|-
|OEM System || char[8] || 8
|-
|Bytes Per Sector || unsigned short || 2uint16_t
|-
|Sectors Per Cluster || byte || 1int8_t
|-
|Reserved Sector Count || unsigned short || 2uint16_t
|-
|Table Count || byte || 1int8_t
|-
|Root Entry Count || unsigned short || 2uint16_t
|-
|Sector Count || unsigned short || 2uint16_t
|-
|Media Type || byte || 1int8_t
|-
|Sectors Per Table || unsigned short || 2uint16_t
|-
|Sectors Per Track || unsigned short || 2uint16_t
|-
|Heads || uint16_t
|Hidden Sector Count || unsigned int || 4
|-
|Hidden Sector Count (32-bit) || unsigned int || 4uint32_t
|-
|Sector Count (6432-bit) || unsigned long || 8uint32_t
|Reserved || unsigned int || 4
|-
|Reserved || unsigned int || 4uint32_t
|Sector Count (64-bit) || unsigned long || 8
|-
|Sector Count (64-bit) || uint64_t
|}
 
Line 68 ⟶ 69:
!Field
!Type
!Length
|-
|Master File Table Cluster || unsigned long || 8uint64_t
|-
|Master File Table Mirror Cluster || unsigned long || 8uint64_t
|-
|Clusters Per Record || signed byte || 1int8_t
|-
|Reserved || byteint8_t[3] || 3
|-
|Clusters Per Index Buffer || signed byte || 1int8_t
|-
|Reserved || byteint8_t[3] || 3
|-
|Serial Number || unsigned int || 4uint64_t
|-
|Checksum || unsigned short || 2uint32_t
|}
 
Line 94:
! Field
! Type
! Length
|-
|Record Type || char[4] || 4
|-
|Update Sequence Offset || unsigned short || 2uint16_t
|-
|Update Sequence Length || unsigned short || 2uint16_t
|-
|Log File Sequence Number || unsigned long || 8uint64_t
|-
|Record Sequence Number || unsigned short || 2uint16_t
|-
|Hard Link Count || unsigned short || 2uint16_t
|-
|Attributes Offset || unsigned short || 2uint16_t
|-
|Flags || unsigned short || 2uint16_t
|-
|Bytes In Use || unsigned int || 4uint32_t
|-
|Bytes Allocated || unsigned int || 4uint32_t
|-
|Parent Record Number || unsigned long || 8uint64_t
|-
|Next Attribute Index || unsigned short || 2uint32_t
|-
|Reserved || unsigned short || 2uint32_t
|-
|Record Number || unsigned int || 4uint64_t
|}
 
Line 132 ⟶ 131:
! Field
! Type
! Length
|-
| Attribute Type || unsigned int || 4uint32_t
|}
</table>
 
If the "Attribute Type" field contains the value 0xffffffff, this marks the end of the attribute list. Otherwise, the attribute sequence continues with the length of the attribute "record".
Line 143 ⟶ 140:
! Field
! Type
! Length
|-
| Attribute Length || unsigned int || 4uint32_t
|}
 
This length value defines the total length of the attribute record, including the "Attribute Type" and "Attribute Length" fields.
 
== LinksSee Also ==
=== External Links ===
* [http://www.linux-ntfs.org/ The Linux NTFS project.]
* [https://web.archive.org/web/20210922203602/https://flatcap.org/linux-ntfs/ntfs/index.html Guide to NTFS]
* [https://www.writeblocked.org/resources/NTFS_CHEAT_SHEETS.pdf Cheat sheet]
* [http://www.linux-ntfs.org/ The Linux NTFS project.]
* [http://www.ntfs-3g.org/ NTFS-3G Read/Write Drivers For Linux/FreeBSD/BeOS]
* [http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=tree;f=fs/ntfs;hb=HEAD GIT Linux fs/ntfs tree]
* [http://www.opensource.apple.com/source/ntfs/ Apple Open Source NTFS site]
* [https://github.com/libyal/libfsntfs/blob/main/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc#attribute_chains libfsntfs library documentation]
 
[[Category:Filesystems]]
[[de:NTFS]]
Anonymous user