[ The PC Guide | Systems and Components Reference Guide | Hard Disk Drives | Hard Disk Logical
Structures and File Systems | New Technology File System (NTFS)
| NTFS Directories and Files ]
NTFS File Attributes
As I mention in many places in this discussion of NTFS, almost everything in NTFS is a
file, and files are implemented as collections of attributes. Attributes are just
chunks of information of various sorts--the meaning of the information in an attribute
depends on how software interprets and uses the bits it contains. Directories
are stored in the same general way as files; they just have different attributes that are
used in a different manner by the file system.
All file (and directory) attributes are stored in one of two different ways, depending
on the characteristics of the attribute--especially, its size. The following are the
methods that NTFS will use to store attributes:
- Resident Attributes: Attributes that require a relatively small amount
of storage space are stored directly within the file's primary MFT record itself. These
are called resident attributes. Many of the simplest and most common file
attributes are stored resident in the MFT file. In fact, some are required by NTFS to be
resident in the MFT record for proper operation. For example, the name of the file, and
its creation, modification and access date/time-stamps are resident for every file.
- Non-Resident Attributes: If an attribute requires more space than is
available within the MFT record, it is not stored in that record, obviously. Instead, the
attribute is placed in a separate location. A pointer is placed within the MFT that leads
to the location of the attribute. This is called non-resident attribute storage.
In practice, only the smallest attributes can fit into MFT records, since the records
are rather small. Many other attributes will be stored non-resident, especially the data
of the file, which is also an attribute. Non-resident storage can itself take two forms.
If the attribute doesn't fit in the MFT but pointers to the data do fit, then the data is
placed in a data run, also called an extent, outside the MFT, and a
pointer to the run is placed in the file's MFT record. In fact, an attribute can be stored
in many different runs, each with a separate pointer. If the file has so many extents that
even the pointers to them won't fit, the entire data attribute may be moved to an external
attribute in a separate MFT record entry, or even multiple external attributes. See the discussion of file storage for more details on this
expansion mechanism.
NTFS comes with a number of predefined attributes, sometimes called system defined
attributes. Some are associated with only one type of structure, while others are
associated with more than one. Here's a list, in alphabetical order, of the most common
NTFS system defined attributes:
- Attribute List: This is a "meta-attribute": an attribute that
describes other attributes. If it is necessary for an attribute to be made non-resident,
this attribute is placed in the original MFT record to act as a pointer to the
non-resident attribute.
- Bitmap: Contains the cluster allocation bitmap. Used by the $Bitmap metadata file.
- Data: Contains file data. By default, all
the data in a file is stored in a single data attribute--even if that attribute is broken
into many pieces due to size, it is still one attribute--but there can be multiple data
attributes for special applications.
- Extended Attribute (EA) and Extended Attribute Information: These are
special attributes that are implemented for compatibility with OS/2 use of NTFS
partitions. They are not used by Windows NT/2000 to my knowledge.
- File Name (FN): This attribute stores a name associated with a file or
directory. Note that a file or directory can have multiple file name attributes, to allow
the storage of the "regular" name of the file, along with an MS-DOS short
filename alias and also POSIX-like hard links from multiple directories. See here for more on NTFS file naming.
- Index Root Attribute: This attribute contains the actual index of files
contained within a directory, or part of the index if it is
large. If the directory is small, the entire index will fit within this attribute in the
MFT; if it is too large, some of the information is here and the rest is stored in
external index buffer attributes.
- Index Allocation Attribute: If a directory
index is too large to fit in the index root attribute, the MFT record for the directory
will contain an index allocation attribute, which contains pointers to index buffer
entries containing the rest of the directory's index information.
- Security Descriptor (SD): This attribute contains security
information that controls access to a file or directory. Access
Control Lists (ACLs) and related data are stored in this attribute. File ownership and
auditing information is also stored here.
- Standard Information (SI): Contains "standard information"
for all files and directories. This includes fundamental properties such as
date/time-stamps for when the file was created, modified and accessed. It also contains
the "standard" FAT-like attributes usually
associated with a file (such as whether the file is read-only, hidden, and so on.)
- Volume Name, Volume Information, and Volume Version: These three
attributes store key name, version and other information about the NTFS volume. Used by
the $Volume metadata file.
 Note: For more detail on
how the attributes associated with files work, see the page on
file storage; for directories, the page on directories.
In addition to these system defined attributes, NTFS also supports the creation of
"user-defined" attributes. This name is a bit misleading, however, since the
term "user" is really given from Microsoft's perspective! A "user" in
this context means an application developer--programs can create their own file
attributes, but actual NTFS users generally cannot.
 Next: NTFS Reparse Points
Home - Search
- Topics - Up
| |
