posted by Andrew Hudson on Mon 29th Nov 2010 21:50 UTC
IconNTFS is the file system used by Windows. It is a powerful and complicated file system. There are few file systems that provide as many features and to fully cover them all would require a book. And in fact there is a book detailing NTFS, and it's already out of date. The purpose of this article is not to cover all of the features of NTFS, nor will it exhaustively cover NTFS features in detail. Instead we will cover its basic structure and then describe some of its more advanced features and provide use examples where possible. We will focus more on what it does, rather than how it does it. Trying to walk the line between informative and detailed is difficult and so this article contains a lot of references for people who hunger for more detail.


Glossary of NTFS Terms

  • Sector - A low level unit of storage on a disk. Traditionally 512 bytes, now moving to 4096 bytes
  • Cluster - A unit of disk space on a file system that consists of multiple sectors
  • File system - a method of organizing and storing files and data
  • Partition - A logical division of a hard disk's data that is formatted with and holds the file system
  • MBR - The master boot record is both a sector and a partition and holds OS boot information
  • Metadata - Attributes that help describe file data, such as owner, size, creation date, file type, etc.
  • MFT - The Master File Table is the primary metadata file that defines an NTFS volume or partition
  • Basic disk - A basic disk or basic volume is a simple storage type used by Windows
  • Dynamic disk - Dynamic disks are a more advanced storage type used by Windows. Useful when a system has many disks. They offer features that basic disks do not such as spanning, striping, and RAID
  • GUID partition table (GPT) - The GPT is a new disk architecture that expands on the MBR and allows for very large file systems
  • Slack - Wasted space due to the cluster size of a file system


A File System of Files

NTFS is a file system that is built using files. The primary file is the Master File Table, or MFT. It is the top metadata file and either contains or points to all other NTFS files. The partition file list, the volume information, cluster allocations are each files. One exception is the Master Boot Record. It is a system partition, not a file. It must be loaded by Windows before the file system is initialized.


Fill Your Quota

NTFS quotas are a means of insuring that some users don't hog the disk and also for monitoring disk usage. Disk quotas are generally most useful on servers with multiple users but you could use a quote to provide a warning before your home PC disk fills up or keep your family members from filling up the disk.

Disk quotas can be created per user per volume. You can set a warning to be issued when disk usage exceeds a threshold. The warning can be issued to the user by email and to the administrator by log entry. You can also set a hard quota limit. Once a user exceeds the hard limit they cannot save a file until one of three things occurs: the user deletes files, another user takes ownership of some files, or the admin increases the user's quota. When quotas are set, a free space check will reflect only that user's quota.

To access quotas on a PC: From Explorer, right click on the top of a disk volume, E.G., Local Disk (C:). Select Properties, Quota, Show Quota Settings.

To access quotas on a server: Open gpedit.msc, the Group Policy Editor. Navigate to Computer Configuration, Administrator Templates, System, then Disk Quotas. On the right hand side, double click on Default Quota Limit and Warning Level Properties.

It is considered a best practice to notify users before applying quotas and providing them with some sort of backup or archiving strategy. Some users take quotas very personally. Turning quotas on does increase processing overhead slightly, so use it wisely.

Admins can track quota events in the Event Logs. To do this, select Control Panel, System and Security, Administrative Tools, View Event Logs.


Better Backups with Shadow Copy

Released with Windows Server 2003 and improved in Windows Server 2008, shadow copy enables better backups. When Microsoft released Vista and Windows Server 2008 it replaced the venerable NTBackup utility with WBAdmin, or Windows Backup and Restore Center. This is also called Complete PC Backup or Windows Server Backup. The new backup system uses the Virtual Snapshot Service which in turn relies on NTFS Shadow Copy features.

Shadow copies provide the ability to take a file system snapshot without having to deal with the issue of file contents changing during the backup. Shadow copies also circumvent the problem of files being locked during a backup. Admins no longer need to take a server down to free the file system from the file locks of pesky users. Downtime affects productivity, and under ideal conditions, productivity means money.

Normally shadow copies don't need maintenance but you can use the vssadmin to create, delete, and list shadow copies. Click on the Windows start icon (lowest left), type CMD into the Search Programs and Files line, Under the Programs line, right click on cmd.exe and select Run as Administrator. On the command line type:

vssadmin list providers

If you are running on Windows Server you can create a new volume shadow copy by typing (replace vol with the volume id):

vssadmin create shadow /for=:

If you are running Windows Server 2008 or later you can use the diskshadow command line utility to script VSS operations.


File Compression Made Easy

Remember how popular Stacker was in past decades? No? Stacker was a 3rd party add-on that made it possible to double the effective space on your disk for text and office files. It was simple to install, transparent to use, and so cool that Microsoft put them out of business by adding file compression to Windows. Big lawsuit.

Under NTFS it is possible to set compression for a specific file, a specific folder, or a folder and all sub-folders beneath it.

To access compression: From Explorer, right click on a folder or file and select Properties, then the General tab, then the Advanced button. Under Compress of Encrypt attributes, select Compress contents to save disk space. When you select a folder, Windows will ask if you want to apply compression just to this folder, or to subfolders and files as well. Once a file or folder is compressed it will be displayed in an alternate color, the default is blue.

NTFS compression uses the LZ77 compression method. Although there are several compression methods that provide higher compression, LZ77 provides a reasonable tradeoff between compression and speed. For non-binary files it is typical to get 2X compression. Although you can compress MP3 files, JPEG images, or video files, LZ77 will not provide better compression. These files are already compressed.

When copying an uncompressed file to a compressed folder, the uncompressed file will stay uncompressed. When copying a compressed file to an uncompressed folder, the compressed file will be uncompressed. Compressed files are uncompressed transparently to the user or the opening application, when accessed.

Table of contents
  1. NTFS, 1/4
  2. NTFS, 2/4
  3. NTFS, 3/4
  4. Interview: Dr Gary Kimura, 1/4
e p (15)    91 Comment(s)

Technology White Papers

See More