There are many file systems in the world. NTFS is a common file system used in the Windows Operating System which stores and manages the important data. This paper concentrates on the basic implementation of the NTFS volume and also highlights the basic security permissions which are necessary to prevent access of files from the intruders. Apart from this, the paper also discuss some of the basic advantages & disadvantages of the NTFS file system and compare it with various other file systems such as FAT 32 file system. The NTFS have several improvements over the FAT file system to improve the performance such as compression, reliability, security permissions etc.

Overview: – File system is the most critical part of the operating system. An operating system is a program that acts as an interface between the computer user and the hardware. In a computer technology, the file system refers to the way that how we files are assigned names and their location for the storage. Therefore file system is a repository that contains storage locations of every file and directories on a hard disk. The file system contains the useful information about how to boot an operating system stored on a disk. The users can be able to perform various operations on a file such as create, delete, open, close etc a file or folder. When we format a hard drive, then a file system is setup on a drive. The file system organizes the files into a database and provides the ease to store, organize, manipulate and access the file by the operating system. Therefore it consists of two parts: collection of files and directory structure which organizes and provides information about the files. There are different types of file systems such as disk file system, network file system, transaction file system etc. The most important file system that comes under the Microsoft Windows is FAT and NTFS file systems.

New Technology File System (NTFS):-

In earlier windows environment such as windows98, the FAT (File Allocation Table) is the most commonly used file system. This file system was developed in late 1970’s and was supported by the MS-DOS operating system. As it works well with all other windows operating system but it does not meet the requirements of the high end users. Then the developers of the windows have decided to implement a new file system known as New Technology File System since Windows NT and windows 2000. It supports very large disks and large files, higher security, higher reliability and more flexibility as compared to the FAT file system. NTFS was implemented by the Microsoft in 1993 with the operating system NT 3.1. In windows, NTFS is the primary file system used in windows 7, XP, Vista, 2000 and NT. NTFS is a transaction based system which ensures that transaction is completed as a whole to minimize the chances of the data loss. The developers of the windows have made changes to the earlier versions of NTFS. The NTFS1.1 is also known as NTFS4.0 that is used in window NT. Then the newer version NTFS5.0 is used in recent operating system such as windows 2000. It includes all the previous version features plus its own features. The maximum file size of NTFS4.0 is only 32 GB where as the version 5.0 are limited by the size of the volume. The NTFS supports compression, encryption, disk quotas, sparse files etc.

Organization of the NTFS Volume: –

Formatting a file system results in the creation of the various system files and Master File Table

that acts as database of files and folders on the NTFS volume. The Figure shows the layout of the NTFS volume.

Partition Boot Sector

Master File Table

System Files

File Area

Table: – Implementation of NTFS File system [Reference 1&4]

(a)Partition Boot sector: – The partition boot sector includes the important information that is required by the system to load the operating system from that partition. It is the first block created on the NTFS partition. The length of this sector is upto 16 sectors only. The first sector contains bootstrap code and the rest 15 sectors are boot sector IPL(Initial Program Loader). It consists of two primary structures-

BIOS Parameter Block :- This has information about the partition and volume label size and the location of metafiles.

Volume Boot Code:- This is a small code of program that guides the system to how to load the operating system.

(b)Master File Table: – MFT is the most important part of the NTFS file system. It contains all the information about the file including size, permissions, file contents etc in the MFT entries and there is one entry per file. When a user creates a file then the space is allocated to it in the MFT table and they are stored as attributes. When the user deletes from the volume then the same entries can be used again and marked as the free entries. There are two types of attributes: resident and non-resident attributes. The resident attributes can easily store in the MFT table.

Sometimes when the file becomes very large and its attributes are not able to fit into the MFT record then they become nonresidents. They allocate one or more clusters space elsewhere in the volume. The MFT is placed at the starting of the disk space to the file system.

(c)Metadata Files: – These files contain the internal details of the data stored on the NTFS volume. During the NTFS partition, these files are created along with it and placed at the top of the partition. These files are also known as system files. The MFT is also one of the types of Meta data files. It includes MFT2 which is duplicate copy of 4 records of MFT which ensures access to MFT in time of failure MFT1. Therefore first 16 records of MFT are reserved for metadata files. The figure shows the metadata files table. [Reference 6]

Metadata File Name

File Name

Description

Master File Table

$MFT

Itself MFT

Master File Table 2

$MFTMirr

Copy of first 16 records of MFT placed on the middle of the disk

Log File

$LogFile

This file is used for NTFS recoverability

Volume Descriptor

$Volume

Housekeeping information – volume label , version etc.

Attribute Definition Table

$AttrDef

contains list of standard attributes on the volume

Root Directory

“.”

Pointer to the root directory

Cluster Allocation Bitmap

$BitMap

Defines which are used and which are available to use on file system

Volume Boot Code

$Boot

Boot sector (bootable partition )

Bad Cluster File

$BadClus

List of bas clusters on the volume so that file system never use them again

Quota Table

$Quota

File where the user rights on the disk space usage

are recorded ( works with NT5)

Upper Case Table

$UpCase

Table for converting files names to Unicode file system names for compatibility

NTFS Partition and NTFS Clusters: –

NTFS partitions are quite different from FAT partitions. In NTFS partition we can define one primary partition and rest all the extended partition. The primary partition is also known as system partition. In an extended partition a user may have an option to set up number of logical drives by naming D, E, F etc .The maximum partition limit for FAT file system is 2 GB or 4 GB that is quite smaller as compared to the NTFS where as NTFS supports 2^64 bytes. [Reference 3].Each entry for extended partition is stored in the partition table. In partition table, partition 1 denotes the address of current drive and second entry highlights the address of the sector that points to the next logical drive. NTFS clusters may be defined as group of the sectors on the NTFS volume. Both file systems use the clusters in a different way due to the internal structure of file systems. NTFS has very smaller sector size 512 bytes and cluster size is a power of 2. Therefore maximum cluster size supported by the NTFS is 2^32 clusters. The other interesting thing is that user can able to change the cluster size with the help of the FORMAT command such as FORMAT D: /a: 8192 will format the D drive to 8192 clusters. But this has to be done very carefully because sometimes it creates problems in the NTFS compression and also results in the wasted space.

NTFS Directories and Files: –

The directories in this file system are also known as folders. The MFT table also contains an entry for each directory in the NTFS file system. The attributes in table describe the complete information about the directories such as directory creation, modification time, header information, security descriptor etc. it doesn’t includes file information. NTFS files includes data of any type such as text files, JPEG images etc. It has almost same attributes as the directories. The structure of each file is based on the following attributes such as header, standard information attribute, file name attribute, data attribute and security descriptor. The files that has very small size can easily fit into MFT record but sometimes files contains large amount of data that is not able to fit in a MFT record. It is then expended and attributes move out of MFT and become nonresident.

It is very surprising fact that there is no limit on file size on the NTFS volume. Apart from this, the maximum length to name the files is 255 characters long and it is not case sensitive. We cannot use the symbols to denote the file names such as +, %, *, etc. NTFS version 5.0 has also another extended feature by using the reparse points to add the additional functionalities to the file system and link with the various files and directories. It doesn’t allow us to change the file system itself.

NTFS Security and Permissions:-

It is one of the most important features of the NTFS file system. By security, we mean that we can set up the various rights to the user or group of users. So the user must have log to the system in order to access its resources. We can define the various user groups over the network. If the user is not a member of a particular group then he is not able to access the resources. There is one predefined group in the NTFS file system known as administrator group that have the power to do anything on a computer. There is major difference in access rights and permissions is that access rights are applied to computer users whereas permissions are applied to various files or folders for example if there is a read permission then the user is able to read its contents cannot able to edit them. The MFT has security descriptor attribute which tells which users can do what type of access. One element of security descriptor is ACL (Access Control List) which allows which user able to access the object and in what manner. Therefore it limits the access on individual users.

The NTFS files and folders permissions help us to prevent the unauthorized access to various files or folders. NTFS has an ability to setup the permissions to file and folders and also tells which folders are shared over the network. The full control permission enables the user to do anything such read or change files or folders, modify folders and execute files in the folders. If the content were too large for the folder then it may compress the folder also. Apart from this it will also enable the user to change the ownership of file or folder with its account or group who is member of it. The table shows the basic permissions and the advanced permissions in the NTFS file system. [Reference 2]

Permissions

Basic Full Control

Basic Modify

Basic Read & Execute

Basic List Folder Contents

Basic Read

Basic Write

Travers Folder/Execute File

List Folder/ Read Data

Read Attributes

Read Extended Attributes

Create Files/Write Data

Create Folders/Append Data

Write Attributes

Write Extended Attributes

Delete Subfolders and Files

Delete

Read Permissions

Change Permissions

Take Ownership

Synchronize

Whenever NTFS partition is created then the default setting of permissions are applied to the

Five default users and groups. The administrator and system group has full control over the file and folders where as user group has read & execute and list folder permissions. But the system owner and other people have no default permissions set. When we are permissions we have to format a drive as NTFS partition. It has another permission No Access in which no one is able to do anything. We can set permissions by clicking right click on the folder and select properties where we set all the permissions.

Permission inheritance: – There are two types of permissions that are applied to files and folders in the NTFS partition. The explicit permissions are those permissions that are applied to file or folder when the user creates it. The inherited permissions are those permissions that are inherited from their parent folders to their children subfolders and files. For example if you have parent folder A and it has Subfolders B, C then these subfolders inherit all the permissions from the folder A and we can the set on them individually also. So the user may have an option to stop inheriting the permissions from their parent folder and convert the permissions to explicit permissions.

Auditing: – This is a one of the most important part of the NTFS security. This feature helps to keep track of the occurrence of certain events and to ensures that the user do their work in a better way. Auditing is a resemblance of the log file which records the data about date and time of the occurrence of certain events. It is applied to same as permissions to file or folders.

Advantages of the NTFS File System: – The basic advantages of the NTFS file system are as follows: – [References 3]

Compression: – Compression is the most important feature of the NTFS File System. This helps us to reduce the amount of the storage on a hard disk for a particular folder. The compression is used for large files. When the user want to read a compressed file, then the decompression filter decompress the file to make it available for the user to read. When the user completes its task, then the file is recompressed again. Apart from this, the most important thing that the user has to be careful while doing compression is that it supports cluster sizes up to 4 KB. Most operating system allows compression of entire disk volume but NTFS allows compression on files and folders. Performance regarded with to read a compressed file as compared to regular files is degraded because of the overhead to compress and decompress the files so it takes more CPU time.

Encryption: – In NTFS, the user may have an option to encrypt the files. The Encrypting File System provides the file encryption technology used to store encrypted files on the NTFS volume and not accessed by another NTFS installation. It ensures the protection from unauthorized users to access the files or folders. The user is able to decrypt the file using a private key. Therefore without proper decryption key the intruders are not able to read, write, and edit any file content. When they are trying to access, open, copy and rename any file then a message “Access Denied” appears on the screen.

Disk Quotas: -Disk Quota is an important feature of NTFS 5.0 version. As it is already in the previous versions of the NTFS but it is used in the NTFS 5.0. In previous versions user is able to consume as much as space on the disk volume. But it creates a problem for the users that they are not able to find sufficient space on the drive for the storage. With the disk quota feature space is shared per user per volume basis. This means we set limit on each user that how much space he is able to use it. We can also set a warning limit to each user when he consumes space more than assigned space. When we use extra space then warning is generated but the user is able to use extra space.

Sparse Files Support: – This is also another astonishing feature that is used in the NTFS 5.0 version. A sparse file has an attribute that causes the system to allocate only meaningful data and stored on the disk. Then the non meaningful data is not stored on disk which is composed of large strings of zeros. Therefore the file that contains more zero’s data or empty space are said to be sparse files. So the files that contains the real data is stored on disk and the rest of file contains zero is stored on sparse file. When the user wants to access the data then the NTFS provides both the real data from disk and sparse data from the sparse files. The file system yields allocated data as real data and de-allocated data as zeros.

Hard Links: – In the NTFS file system we can store the files at the two different locations. A hard link is link when we have we have two same files as different names OS.txt and OS1.txt. When the user deletes the first file then the other remains the same and vice-versa.

Limitations of the NTFS File System: – As we know that NTFS is a very useful system for the windows operating system but it has several disadvantages also: –

High Space Overhead: – Space overhead refers to the space that is required by the file system and that space is not used by the user to store data. Therefore it requires a minimum of 400 MB space overhead on drive volume. If the user use the NTFS file system on a smaller drives then it creates problem to store data for the user and also degrades the performance.

No Floppy Disk Format: -There is also major disadvantage of NTFS file system is that we cannot able to format a floppy disk with the NTFS volume. FAT is the most commonly used file system to format floppy disk. [Reference 7]

File Naming Limit: – We can set the file name limit to only 255 characters long. We can use the capital letters in the file names but txt.doc and TXT.doc are the same files. Also we cannot able to use the symbols in the file names such as %, &, <, >, etc

Operating system Incompatibility: – We know that NTFS works well with the windows 2000 and later versions of the windows. Therefore this file system is not compatible with the window 95, 98, ME and DOS operating system.

Comparison of FAT32 and NTFS5.0 File Systems: –

Criteria

FAT32

NTFS 5.0

Operating System

DOS, Windows 98, Windows ME, Windows 2000 and later versions

Windows 2000 and later versions of windows

Volume Size

32 GB for all OS, 2 TB for some operating system

2 TB

Maximum Files

4 GB

Equals to volume size

Files Names

Up to 255 characters

Up to 255 characters long

Security

No

Yes (encryption)

Compression

No

Yes

Performance

Good for small partition

Good for large partition

Disk Quota

No

Yes

Sparse files

No

Yes

Recoverability

No

Yes

Fault Tolerance

Minimal

Maximum and is automatic

Floppy Disk Format

Yes

No

Space Overhead

Less

Near about 400 MB

Table: Comparison between file systems. [Reference 3]

One of the most interesting real factors of the file system terminology is that the user may have an option to convert FAT32 partition into NTFS partition. The Microsoft provides a CONVERT command to change the FAT partition into NTFS partition and not vice versa. This can be done by using a simple command like “convert c: /fs: ntfs” which converts “C” volume into the NTFS partition.

Conclusion: –

In a nutshell, we can say that NTFS is the most commonly used file system in the windows environment. NTFS is a system that is used in future also.[Reference 7]. The NTFS system works well with the complexity of directory structure and if the directories have more files then it didn’t affect the performance of the file system. The NTFS provides better results for large drives where security permissions are important to prevent access from intruders. Similarly FAT file system is well suited in those situations where user needs compatibility with all other operating systems. Therefore the fragmentation in disk also reduces the performance of the FAT file system but in NTFS it doesn’t affect the performance of NTFS file system. Therefore we can say that NTFS file system out performances FAT32 in every aspect, expect when the partition are small. It is already understood that NTFS has more features as compared to the FAT32. The FAT32 was normally used in older operating systems but now a day NTFS is becoming more and more popular.