NT File System (NTFS)

11 Key excerpts on "NT File System (NTFS)"

• 

  eBook - ePub

  Cyber Forensics

  From Data to Digital Evidence

  • Albert J. Marcella, Jr., Frederic Guillossou(Authors)
  • 2012(Publication Date)
  • Wiley

    (Publisher)

  CHAPTER NINE File Systems—NTFS and Beyond CHAPTER 9 FURTHER EXAMINES file systems, focusing now on file systems beyond FAT, which are those most likely to be encountered by the cyber forensic investigator.

  As technology truly does march to its own beat and is constantly in a state of flux and change, the cyber forensics professional should be attuned to the changes announced by vendors regarding their operating systems and the file system variations that may emerge from any advancement in operating system designs and future release updates to these operating systems.

  NEW TECHNOLOGY FILE SYSTEM

  Next up, a review of another Windows file system, the New Technology File System (NTFS), whose use started with Windows NT in 1993. Windows XP, 2000, Server 2003, 2008, and Windows 7 also all use later versions of NTFS. The filing system is very complex and to make matters worse there are very little published specifications from Microsoft that describes the “on-disk layout.”

  What this means is that logical representations of the physical structure of this file system are speculative and very difficult to visualize. It’s a good thing our goal here is not an in-depth bit-for-bit analysis of each file system, but instead a more conceptual understanding of file systems in general.

  An important concept in understanding the NTFS design is that all data is allocated to files, including the file system itself; the file system files can be located anywhere in the volume, as would a regular file. Therefore, NTFS does not have a normal File System Layout like FAT, as discussed in Chapter 8, where there are areas at the beginning of the volume reserved for these data.

  The entire file system is considered a data area, and any sector can be allocated to a file. The only constant within the NTFS file structure is that the first sectors contain the boot sector, similar to the volume boot in FAT.

  The New Technology File System (NTFS) contains the following “components”:

  1. Partition Boot Sector (PBR)—similar to VBR in FAT

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Scene of the Cybercrime

  • Debra Littlejohn Shinder, Michael Cross(Authors)
  • 2008(Publication Date)
  • Syngress

    (Publisher)

  NTFS is the most secure file system offered for computers running Microsoft Windows operating systems. NTFS was designed as a replacement for the FAT file system on Windows NT operating systems, including successive releases such as Windows 2000, Windows Server 2003, XP, and Vista. It was designed to be more robust and secure than other Microsoft file systems. Part of these features can be seen in how it handles partitions. As we'll see later in this chapter, partitions are logical divisions of a hard disk, allowing you to divide the space on a hard disk so that it functions as separate drives. For example, you could partition a hard disk to appear as C: or D: on the computer. NTFS supports very large partition sizes (up to 16EB, in theory) and allows you to create volumes that span two or more partitions.

  NTFS is also more reliable because it supports a feature called hot fixing, a process by which the operating system detects a bad sector on the disk and automatically relocates the data stored on that sector to a good sector, and then marks the bad sector so that the system won't use it. This process is done on the fly, without the awareness or intervention of the user or applications.

  Metadata and the Master File Table

  Metadata is information about a particular set of data, and can include such information as who created a file, its size, and other technical information hidden from the common user. In other words, metadata is data about data. It can be used to describe a file, its format, when it was created, and other information. NTFS stores data about files, users, and other information the system uses in the form of special files that are hidden on the system. When a disk is formatted to use NTFS, these files are created, and their locations are stored in one of these files, called the Master File Table (MFT). The special system files that NTFS creates to store metadata, and their location in the MFT, are listed in Table 4.4

  Sign up to read

  Learn more about book
• 

  eBook - PDF

  Guide to Operating Systems

  • Palmer, Greg Tomsho(Authors)
  • 2016(Publication Date)
  • Cengage Learning EMEA

    (Publisher)

  If a file is very small, there is sometimes enough room in the MFT record to store the file data. If there is not enough room, the system allocates clusters elsewhere on the disk. The 4 Windows File Systems 165 Copyright 2017 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. WCN 02-300 repeated; it is possible to have a whole series of different security attributes for different users. It is also possible to have multiple filenames that refer to the same file, a technique known as hard linking . This is a feature, also available in UNIX/Linux file systems, that is sometimes used to make the same file appear in multiple directories without having to allocate disk space for the file more than once. NTFS is referred to in two ways. The first is by the actual release num-bering and the second is the more accepted way, which very roughly refers to a Windows operating system. Table 4-3 shows the five versions of NTFS, the operating system they correspond to, and the generally accepted version number for NTFS. Table 4-3 NTFS versions Official version number Generally accepted version number Windows operating system 1.0 NTFS 1.1 NTFS 1.2 NTFS 4 Windows NT 3.51 and NT 4.0 3.0 NTFS 5.0 Windows 2000 3.1 NTFS 5.1/5.2 Windows XP/Windows Server 2003/Windows Server 2008/Vista 3.1 NTFS 6.0 Wi ndows Server 2008 R2/Windows 7 and later Some of the basic features incorporated into NTFS include: • Long filenames • Built-in security features • Better file compression than FAT • Ability to use larger disks and files than FAT • File activity tracking for better recovery and stability than FAT • Portable Operating System Interface for UNIX (POSIX) support • Volume striping and volume extensions • Less disk fragmentation than FAT As a full-featured network file system, NTFS is equipped with security features that meet the U.S.

  Sign up to read

  Learn more about book
• 

  eBook - PDF

  Guide to Computer Forensics and Investigations

  • Bill Nelson, Amelia Phillips, Christopher Steuart, , Bill Nelson, Amelia Phillips, Christopher Steuart(Authors)
  • 2018(Publication Date)
  • Cengage Learning EMEA

    (Publisher)

  Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. CHAPTER 5 Working with Windows and CLI Systems 213 so that NT could read OS/2 HPFS disk drives. Since the release of Windows 2000, this backward-compatibility is no longer available. For a detailed explanation of NTFS structures, see www.ntfs.com/ntfs.htm . NTFS offers substantial improvements over FAT file systems. It provides more information about a file, including security features, file ownership, and other file attributes. With NTFS, you also have more control over files and folders (directories) than with FAT file systems. NTFS was Microsoft’s move toward a journaling file system. The system keeps track of transactions such as file deleting or saving. This journaling feature is helpful because it records a transaction before the system carries it out. That way, in a power failure or other interruption, the system can complete the transaction or go back to the last good setting. In NTFS, everything written to the disk is considered a file. On an NTFS disk, the first data set is the Partition Boot Sector , which starts at sector [0] of the disk and can expand to 16 sectors. Immediately after the Partition Boot Sector is the Master File Table (MFT) . The MFT, similar to FAT in earlier Microsoft OSs, is the first file on the disk. An MFT file is created at the same time a disk partition is formatted as an NTFS volume and usually consumes about 12.5% of the disk when it’s created. As data is added, the MFT can expand to take up 50% of the disk. (The MFT is covered in more detail in “NTFS System Files.”) An important advantage of NTFS over FAT is that it results in much less file slack space. Compare the cluster sizes in Table 5-3 with Table 5-2, which showed FAT cluster sizes. Clusters are smaller for smaller disk drives. This feature saves more space on all disks using NTFS.

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  EnCase Computer Forensics -- The Official EnCE

  EnCase Certified Examiner Study Guide

  • Steve Bunting(Author)
  • 2012(Publication Date)
  • Sybex

    (Publisher)

  NTFS (version 1.0, also dubbed NT3.1) first rolled out in August 1993 with Windows NT. It went through two more iterations up through 1996 (versions 1.1 and 1.2, also dubbed NT3.5, NT3.51, and NT4.0). Windows 2000 gave birth to version 3.0, also dubbed NTFS 5.0. With XP in the fall of 2001, version 3.1 was born and also dubbed NTFS 5.1. Still under version 3.1, Windows Server 2003 rolled out in 2003 with a NTFS 5.2; Windows Server 2008 and Windows Vista rolled out with NTFS 6.0. And finally Windows Server 2008 R2 and Windows 7 rolled out with NTFS 6.1.

  Windows NT and 2000 provided NTFS as a formatting option, defaulting to FAT unless the user chose otherwise. Starting with Windows XP, the default format is NTFS. Thus, newer Windows systems will mostly use NTFS, but FAT will still continue to coexist with NTFS (it is used on other forms of media, as discussed earlier).

  From the previous analysis of file systems, you know that, regardless of their name, they must perform certain basic functions for the system:

  • Track the name of the file (or directory)
  • Track the point where the file starts
  • Track the length of the file along with other file metadata, such as date and time stamps
  • Track the clusters used by the file (cluster runs)
  • Track which allocations units (clusters) are allocated and which are not

  NTFS does all these things and more. An NTFS partition is identified as such, initially at least, by an entry in the partition table of the MBR. From Chapter 1, “Computer Hardware,” you know that Windows requires the partition to be properly identified in the partition table in order for Windows to mount it. When the NTFS partition is formatted, the VBR for NTFS is created and 16 sectors are reserved for its use, but typically only 8 are used for data. Bytes 3–6 of the first sector of the VBR will be “NTFS.” Recall that FAT32 stored the backup of its VBR in the reserved area at the beginning of the volume. By contrast, NTFS stores its backup copy in the last sector of the partition.

  In an NTFS partition, unlike FAT, all the important file system data is contained in actual files. NTFS uses many system files, but at the very heart of the NTFS system are $MFT (master file table) and $Bitmap . $MFT is similar to the directory entry in FAT, and the $Bitmap

  Sign up to read

  Learn more about book
• 

  eBook - PDF

  Guide to Operating Systems

  • Greg Tomsho(Author)
  • 2020(Publication Date)
  • Cengage Learning EMEA

    (Publisher)

  MODULE 4 File Systems 158 Copyright 2021 Cengage Learning. All Rights Reserved. May not be copied, scanned, or duplicated, in whole or in part. Due to electronic rights, some third party content may be suppressed from the eBook and/or eChapter(s). Editorial review has deemed that any suppressed content does not materially affect the overall learning experience. Cengage Learning reserves the right to remove additional content at any time if subsequent rights restrictions require it. • Encrypting File System (EFS)—Makes an encrypted file inaccessible to everyone except the user who encrypted it, including users who have been granted permission to the file. • Disk quotas—Enable administrators to limit the amount of disk space that users’ files can occupy on a disk volume or in a folder. • Volume mount points—Make it possible to associate the root of a disk volume with a folder on an NTFS volume, thereby forgoing the need for a drive letter to access the volume. • Shadow copies—Enable users to keep historical versions of files so that they can revert a file to an older version or restore an accidentally deleted file. • Journaling—A log of file system activity to enable recovery from system failures. • Hot fix—The ability to recover from bad disk sectors. • Self-healing NTFS—Background operation of disk checking. NTFS File and Folder Permissions As a full-featured network file system, NTFS is equipped with security features that meet the U.S. government’s C2 security specifications. C2 security refers to high-level, “top-secret” standards for data protection, system auditing, and system access, which are required by some government agencies. One security feature is the ability to establish the type of access allowed for users of folders and files within folders. File and folder access by users can be tailored to the requirements of an organization. For example, the system files on a server can be protected so only the server administrator has access.

  Sign up to read

  Learn more about book
• 

  eBook - PDF

  MCSA Guide to Installation, Storage, and Compute with Microsoft® Windows Server 2016, Exam 70-740

  • Greg Tomsho(Author)
  • 2017(Publication Date)
  • Cengage Learning EMEA

    (Publisher)

  For hard drives, however, particularly on Windows servers, NTFS is usually the way to go, although some applications benefit from ReFS. Note Chapter 1 mentioned another variation of FAT, exFAT, which has the same features as FAT32 but can be used to format volumes larger than 32 GB, up to a theoretical 64 zettabytes (ZB, a billion terabytes) and file sizes up to 16 EB. When you format a volume larger than 32 GB in Disk Management, exFAT is offered as a format option. The NTFS and ReFS File Systems NTFS is a full-featured file system that Microsoft introduced with Windows NT in 1993. Since that time, its features have been expanded to help administrators gain control of ever-expanding storage requirements. NTFS has supported file and folder permissions almost since its inception, which was a considerable advantage over FAT. Many compelling features have been added, particularly starting with Windows 2000: • Disk quotas —Enable administrators to limit the amount of disk space that users’ files can occupy on a disk volume. Starting with Windows Server 2008, quotas can also be specified for folders. • Volume mount points —Make it possible to associate the root of a disk volume with a folder on an NTFS volume, thereby forgoing the need for a drive letter to access the volume. • Shadow copies —Enable users to keep historical versions of files so that they can revert a file to an older version or restore an accidentally deleted file. • File compression —Allows users to store documents in a compressed format without needing to run a compression/decompression program to store and retrieve the documents. • Encrypting File System (EFS) —Makes encrypted files inaccessible to everyone except the user who encrypted the file, including users who have been granted permission to the file. EFS protects files even if the disk is removed from the system.

  Sign up to read

  Learn more about book
• 

  eBook - ePub

  Operating System Forensics

  • Ric Messier(Author)
  • 2015(Publication Date)
  • Syngress

    (Publisher)

  The New Technology File System (NTFS) was developed by Microsoft to be part of the NT operating system, which Microsoft was intending to be a head up competitor of OS/2, the operating system Microsoft was developing with IBM. OS/2 was everything that DOS/Windows was not. It was stable, robust, and reliable. NT was supposed to be all those things as well, while still being wholly Microsoft’s. NT was developed by a team of people led by Dave Cutler who came from Digital Equipment Corporation. Cutler had a lot of experience with solid, reliable operating systems. Unlike FAT, which was the file system of DOS/Windows, NTFS needed to be resilient, reliable, and be able to support larger drives than those supported by FAT at the time. Additionally, it needed to support security mechanisms like the ability to prevent some users from getting access to the files, while still allowing other users to get that access.

  One major difference between NTFS and FAT is that when you format a FAT partition, you are creating all of the data structures on the disk. This means that you are creating a file table, where all of the clusters have an entry. This is all done at the time the disk is formatted. In the case of NTFS, the effect of formatting is the same – the data structures get written out to the disk but unlike FAT, only the minimal amount of information is written. This means that the master file table is created with just the bare bones entries in the table. The table continues to grow as more files are added to it. In the case of FAT, the table has a fixed size based on the number of clusters on the file system. With NTFS, the table is only as large as it needs to be based on the files that are being stored.

  NTFS makes use of a journal, which is a transaction log. The journal is used to recover the file system in case of a system failure.

  The data structures on disk are completely different for NTFS than they were for FAT, not surprisingly. The way it was designed was based on entirely different requirements with more system capacity allowing for more complexity in the file system structure. One big difference between NTFS and FAT is that NTFS is a proprietary file system and so details are not always available, which means support within other operating systems is not always there. Even in cases, where another operating system may implement support for NTFS, they do not always implement write support for the file system to prevent corruption of any data or files. Access to NTFS is handled by drivers and it is up to the author of the driver to know how NTFS works, so, it can make all the appropriate changes in order to implement writing.

  Sign up to read

  Learn more about book
• 

  eBook - PDF

  Operating Systems In Depth

  Design and Programming

  • Thomas W. Doeppner(Author)
  • 2011(Publication Date)
  • Wiley

    (Publisher)

  Indexing is a notion used in databases in which one finds data items by their attributes, much as one finds items in a book by looking them up in the index. Directories provide an index of files based on the last components of their name attributes. NTFS also maintains an index based on object ID in a special hidden file, implemented using a B tree, whose components are, of course, attributes. This is used by system components and applications that need a way to refer to files other than by names. Multiple data streams allow one to associate data with a file in addition to the normal data. These are essentially a means for adding new attributes of arbitrary length to files. For example, 17 This “volume aggregation” is actually done not by NTFS proper, but by a lower-level module on which NTFS is layered. • • • • 276 CHAPTER 6 File Systems many Windows applications support a notion of properties with which one can tag a file with a description of the file’s contents. In NTFS, such properties are implemented as separate data streams (see Figure 6.52). The standard data stream containing the “normal” file data is unnamed and referred to implicitly simply by using the file name. The other streams are referred to by appending a colon and the stream’s name to the file name. For example, the information associated with the file \MyStuff\book.doc is referred to as \MyStuff\book.doc:information. One option for an NTFS file is for it to be compressed. Two techniques are employed for doing this. One is simply not to allocate space for long runs of zeros within files. Such runs are left out of the runlist of extents. Thus when the file system encounters a gap in the runlist, it assumes this missing extent contains all zeros. The second technique is to use a compression algorithm 18 to compress the data in individual extents. Thus an extent that logically covers, for example, 16 kilobytes of data might be con- tained in 4 kilobytes of actual disk space.

  Sign up to read

  Learn more about book
• 

  eBook - PDF

  Operating System Concepts

  • Abraham Silberschatz, Peter B. Galvin, Greg Gagne(Authors)
  • 2014(Publication Date)
  • Wiley

    (Publisher)

  It provides the mechanism for on-line storage of and access to both data and programs of the operating system and all the users of the computer system. The file system consists of two distinct parts: a collection of files, each storing related data, and a directory structure, which organizes and provides information about all the files in the system. File systems live on devices, which we described in the preceding chapter and will continue to discuss in the following one. In this chapter, we consider the various aspects of files and the major directory structures. We also discuss the semantics of sharing files among multiple processes, users, and computers. Finally, we discuss ways to handle file protection, necessary when we have multiple users and we want to control who may access files and how files may be accessed. CHAPTER OBJECTIVES • To explain the function of file systems. • To describe the interfaces to file systems. • To discuss file-system design tradeoffs, including access methods, file sharing, file locking, and directory structures. • To explore file-system protection. 10.1 File Concept Computers can store information on various storage media, such as magnetic disks, magnetic tapes, and optical disks. So that the computer system will be convenient to use, the operating system provides a uniform logical view of stored information. The operating system abstracts from the physical properties of its storage devices to define a logical storage unit, the file. Files are mapped by the operating system onto physical devices. These storage devices are usually nonvolatile, so the contents are persistent between system reboots. 455 456 Chapter 10 File System A file is a named collection of related information that is recorded on secondary storage. From a user’s perspective, a file is the smallest allotment of logical secondary storage; that is, data cannot be written to secondary storage unless they are within a file.

  Sign up to read

  Learn more about book
• 

  eBook - PDF

  Silberschatz's Operating System Concepts

  • Abraham Silberschatz, Peter B. Galvin, Greg Gagne(Authors)
  • 2020(Publication Date)
  • Wiley

    (Publisher)

  CHAPTER OBJECTIVES • Explain the function of file systems. • Describe the interfaces to file systems. • Discuss file-system design tradeoffs, including access methods, file shar- ing, file locking, and directory structures. • Explore file-system protection. 13.1 File Concept Computers can store information on various storage media, such as NVM devices, HDDs, magnetic tapes, and optical disks. So that the computer system will be convenient to use, the operating system provides a uniform logical view of stored information. The operating system abstracts from the physical properties of its storage devices to define a logical storage unit, the file. Files are mapped by the operating system onto physical devices. These storage devices are usually nonvolatile, so the contents are persistent between system reboots. 571 572 Chapter 13 File-System Interface A file is a named collection of related information that is recorded on sec- ondary storage. From a user’s perspective, a file is the smallest allotment of logical secondary storage; that is, data cannot be written to secondary storage unless they are within a file. Commonly, files represent programs (both source and object forms) and data. Data files may be numeric, alphabetic, alphanu- meric, or binary. Files may be free form, such as text files, or may be formatted rigidly. In general, a file is a sequence of bits, bytes, lines, or records, the mean- ing of which is defined by the file’s creator and user. The concept of a file is thus extremely general. Because files are the method users and applications use to store and retrieve data, and because they are so general purpose, their use has stretched beyond its original confines. For example, UNIX, Linux, and some other oper- ating systems provide a proc file system that uses file-system interfaces to provide access to system information (such as process details). The information in a file is defined by its creator.

  Sign up to read

  Learn more about book