Basic NTFS file system knowledge

1. All NTFS files, including non-data files, are accessed as files.

Metadata files include:

$ MFT $ mftmirr $ logfile $ volume $ attrdef $ bitmap $ boot $ badclus $ quota $ upcase $ Cairo.

2. The information of common files (directories) is expressed by attribute/value pairs.

3. $ MFT records all file records. The file record size is generally 1 K. That is, each file stores a record in the $ MFT file, and the record size is generally 1 kb.

File records are generally organized by Attribute-value pairs.

4. file attributes include

# Define $ unused (0x0)

# Define $ standard_information (0x10)

# Define $ attribute_list (0x20)

# Define $ file_name (0x30)

# Define $ object_id (0x40)

# Define $ security_descriptor (0x50)

# Define $ volume_name (0x60)

# Define $ volume_information (0x70)

# Define $ data (0x80)

# Define $ index_root (0x90)

# Define $ index_allocation (0xa0)

# Define $ Bitmap (0xb0)

# Define $ symbolic_link (0xc0)

# Define $ ea_information (0xd0)

# Define $ EA (0xe0)

# Ifdef_cairo _

# Define $ property_set (0xf0)

# Endif // _ Cairo _

# Define $ first_user_defined_attribute (0x100)

# Define $ end (0 xffffffff)

5. if a data attribute is too large and a file record is not enough to be stored, a row string (run) is used to organize the data of a file. Generally, the data of a file is organized by these row string tables. This can also be done for non-data attributes.

In fact, it is not necessarily a data attribute, but a non-resident attribute, that is, when file records cannot record all the content of an attribute, in this case, only the attribute header and row string information are retained in the file record. In the data area, the data represented by these row string information indicates this attribute.

6. if a file record cannot store all attributes or attribute headers, that is, when there are too many attributes in a file (often because the data partition is too broken, resulting in too many row strings in the attribute header ), other file records will be allocated to other attributes for storage. In $ attribute_list, there will be a series of information (file reference ). The first MFT record is called base file record.

7. File (record) Reference: the location of the file in MFT.

8. file directory. For small file directories, the file reference information of its sub-files and directories is stored in the $ index_root attribute (not $ data). For large directories, the B-tree is used to store the information. B-each item in the tree contains not only the file name (directory name), but also the reference, timestamp, and size of the corresponding file records. $ Index_allocation records the buffered row string information. Which VNC is used in the buffer in the bitmap property record. Therefore, $ index_root, $ index_allocation, and $ bitmap construct the B-tree.

9. $ index_allocation records all row strings of directory items.

10. the line string is expressed as

The offset calculated by the row string is relative and signed. The offset of the second row string is calculated based on the offset of the first row string. That is, the real offset of the second row string is obtained only when the offset of the second row string is added to the offset of the first row string.

Basic NTFS file system knowledge