IST447 - NTFS File System Suarez F

Read Only Attribute

A designation that a file can only be read. It may not be changed, modified, or deleted.

System Attribute

A file attribute that marks a file as being crucial to the operating system.

Flag

A file attribute that marks a file as having a unique characteristic such as Read-Only, Archive, System, Hidden, or compressed.

What is a Journaling File System?

A file system that tracks file changes in a journal or log file first, before putting them in the main file system. This helps prevent crashes.

Reparse Point

A system in an operating system that tracks changes to where files are moved and renamed that create pointers where the data used to be.

Logical Size

Actual size of a file from the first byte to the last. The size of the file on the disk.

Physical Size

Actual size of a file plus the size of the slack space.

Alternate Data Stream

Allows more than one data stream to be attributed to a file.

$BadClus

Bad Clusters on a partition are tracked with this file.

Allocation Units

Clusters on a drive where a file is written. These clusters are comprised of sectors.

$SECURITY_DESCRIPTOR

Contains the file's access control policy.

True/False - NTFS stands for "Next Technology File System"

False - NTFS Stands for New Technology File System.

True/False - When NTFS first debuted, the Windows OS set it as the default option, but allowed the user to choose FAT instead.

False - NTFS was a formatting option, defaulting to FAT unless the user chose NTFS instead.

True/False - When a file is deleted on an NTFS partition, a flag in the $Bitmap is set, indicating the file is not in use, and the allocated clusters are marked with 0s in $MFT, which means they are unallocated.

False - When a file is deleted on an NTFS partition, a flag in the $MFT is set, indicating the file is not in use, and the allocated clusters are marked with 0s in $Bitmap , which means they are unallocated.

$File_Name

File attribute that lists the name of the file

Attribute

File metadata that indicates file behavior.

$STANDARD_INFORMATION

File that gives time information such as when a file was created, changed, modified, last accessed, and the metadata change time.

$Secure

File that holds partition boot sector and boot code information.

GREP

Globally search a Regular Expression and Print - A type of search for data using regular expressions.

MFHFS, HFS+

Hierarchical File System Plus - The file system Macs use.

$Volume_Name

Holds NTFS version, volume label and identifier.

$DATA

Holds data content, starting cluster and cluster runs.

MAC Times

"Modified Access Created" A metadata timestamp on a file that indicates the last time it was modified.

$MFT is similar to what entry in FAT?

$MFT is similar to the directory entry in FAT.

$MFTMirr

A backup copy of the first four entries of the master file table.

End of File Marker

Indicator of last cluster used by a file.

$LogFile

Journaling file that tracks metadata information used for system rcovery and the stability of a file.

$MFT

Master File Table

MFT Entry

Master File Table - This is how NTFS stores information on files. Each file recorded is listed as the MFT Entry.

Name some examples of how NTFS is more robust than FAT.

NTFS provides stronger security, greater recoverability and better performance in regard to read, write and search capabilities.

In an NTFS partition, where is all the important file system data contained?

The data is contained in the actual files.

What is "$" in regards to NTFS?

The designation of special metadata in an NTFS file system.

In what year did the first version of NTFS debut?

The first version of NTFS debuted in August 1993. with Windows NT.

With what Windows OS did the first version of NTFS debut?

The first version of NTFS debuted with Windows NT.

$Bitmap

Tracks all cluster's allocation status of a partition.

True/False - An excellent example of resident data are cookie files.

True - Cookies are almost always small enough in file size to be resident data.

True/False - With NTFS, everything about a file is an attribute, including the data itself.

True - Everything about a file is an attribute, including the data itself.

Resident Data (in the MFT)

When a file is small enough that it only needs to be stored in the master file table. Typically the files are under 700 bytes.

$Attribute_List

When an attribute exceeds master file table entry limits, they can be tracked in this file

With what Windows OS did NTFS become the default?

Windows XP