Posts Tagged ‘NTFS’

How to resolve NTFS Partitions Problems

June 18th, 2012 Comments off

ntfs-partitions The first sector of NTFS partitions is used as the partition boot sector. It contains the information which allows the OS to read the partition. Without it, the partition cannot be accessed.

NTFS has a backup copy of the boot sector on the last sector of the partition which can allow recovery programs to restore it. The FAT also has the boot sector, and resides on the first sector of this partition. The difference is that FAT does not have a backup copy of this information; Recovery is much more difficult than NTFS.

The first file stored on an NTFS partition is called the Master File Table (MFT) which is essentially a listing of the names, properties and locations of all the other files in this partition. This is referenced by the operating system to access individual files.

NTFS stores a backup copy of this file. Data restoration software can access or restore a copy of the MFT in order to access files on the partition.

FAT partitions with something similar, called predictably enough the File Allocation Table (FAT). The FAT is also backed up on the disk, and can be restored by software. The major disadvantage of the FAT as compared to the MFT is that it needs to be located on a specific area of the partition to function, so if that area of the disk is damaged, recovery will become more difficult.

When a file is deleted (removed from the recycle bin within Windows), both file systems simply mark the file as deleted. The data is not actually removed from the hard drive, but rather the space it takes up on the disk is now considered to be free. Consequently, if you delete a file accidentally, you have an excellent chance of being able to restore it provided you do not write more information to the disk.

For example, If you two NTFS partitions on the effected disk. When you ran FDISK, it wrote garbage information over certain areas of this disk, including areas of both partitions. As a result, the first partition (the one with your article on it) had lost its partition boot sector, meaning it could not be accessed normally by an operating system. The second partition had merely had crucial system files overwritten, and was unbootable, but still can accessible once you transferred the disk to another computer.

There is a way to fix all of this, and get the data back

One rule to remember when you have lost data, please don’t write anything more to the affected hard drive!

If you have deleted a partition by accident, do not create another partition, just leave it blank.
If you have deleted files from the recycling bin that you realize you need, do notsave anything to the drive. The reason is that hard drives do not actually erase anything, not data or partitions. When you erase a file from the operating system, it is just marked on the drive as having been deleted. When the system needs to store more data on the drive, it will consider files on the drive marked ‘deleted’ as being empty space, and cheerfully copy over them. If that happens then you’re in big trouble.

Another rule applies twice over for partitions; since partition information just presents the operating system with a way of addressing the space available on the drive. If you wipe out a partition everything from it will seem to be gone.

If there is no partition information, no data can be read by the operating system. This does not mean that your data it is not there however, only that means you can’t see it. Data-recovery programs have no such handicap.

What you need to do was to allow FDISK to test the integrity of the drive, which it does by writing a pattern of data to certain areas. Of course, in the case, many of these areas contained partition information and critical system files. The result was one missing partition, due to a destroyed boot sector, and one unbootable (but still readable) XP installation.

First and best thing to do in a data-loss situation is to make sure no more data is written to the drive. Obviously, if you have just the one partition and it’s fried, you can’t boot normally to the operating system. The best option in this situation is to transfer the drive to another computer, preferably one using the same file-system as your damaged partition (such as, the same operating system, or a newer version). See the PCSTATS Beginners Guides sectionfor information on how to move your hard drive to another computer.

Transferring the HDD to another computer has the dual benefit of preventing the drive from being written to accidentally, and potentially allowing you to retrieve information from the disk just by using Windows Explorer to look through file structures.

If you have damaged or erased essential operating system files, but the partition information is still intact Windows will not boot. The HDD can still be read from a different operating system which is one way out of the doom and gloom.

All the processes described from here on are strictly for resolving software issues with your data, like accidentally deleting partitions or files. If your hard drive has a physical problem, if it is making strange noises, shaking, rattling or smoking, nothing here will apply. Turn off your computer, unplug the drive and call a data recovery service if your data are vital.

NTFS File System Frequently Asked Questions Part I

November 19th, 2009 Comments off

Q: Is the boot limitation for NTFS still 7.87GB?

A: No. NTFS volume size limit is 2TB.

Q: Where can I get a lot of details about the NTFS encryption and security ?

A: Security (NTFS) and Encryption (NTFS,NTFS5) are wide topics.

You can get a lot of information about it on Microsoft’s MSDN Web Site (

Security Topics: File Security and Access Rights

Encryption Topics: File Encryption , Encryption, Sparseness, and Reparse Points

Q: How do you lock files from other machine users on NTFS file system ?

A: NTFS has built-in security feature. Owner of the object can assign certain rights to certain users to restrict access to the object.

If file or folder is located on NTFS, just go to its Properties in Windows Explorer and on the Security tab add users being able access the object, and then remove Everyone user from users list, or restrict its rights.

Q: For Windows 2000 Professional using NTFS — Must All partitions be NTFS or can a FAT32 partition be functional as well?

A: Windows 2000 Professional as long as other Windows 2000 and XP family operating systems have full support for FAT32 and FAT16 file systems, as long as CDFS, HPFS, etc.

Operating system communicates with file system via logical level Win32 API that, in turn, redirects function calls to physical level (file system drivers), so if proper file system driver is installed, operating system can access and work with file system properly.

Drivers for NTFS, NTFS5, FAT12, FAT16, FAT32, CDFS are always installed when you install Windows 2000 / XP.
Drivers for NTFS, FAT12, FAT16, CDFS are always installed when you install Windows NT, there is no built-in driver for FAT32 in Windows NT.

Q: How do you format a blank hard disk drive to NTFS or NTFS5 ?

A: There are no standard utilities to format HDD to NTFS from DOS.

However there are solutions:

  • Attach HDD to another machine having Windows NT installed if you want to format to NTFS, or to Windows 2000 / XP if you want to format it to NTFS5. Then format drive using Disk Manager utility that is included in OS.
  • You can start Windows NT / 2000 / XP installation using bootable CD-ROM. On first steps of installation you will be asked about target location and you will be suggested to format the partition to NTFS. Go this way, and after format is completed, just cancel the installation process.

Q: Is there any problem with my games if I installed it under NTFS filesystem?

A: NTFS file system itself cannot cause problems to any software including games, because NTFS is just a way of data storage.

Software in Windows accesses files via upper-level Win32 API. Win32 API, in turn, redirects function calls to the drivers for the particular file system (NTFS/FAT/CDFS, etc.). Thus software, generally speaking, is not aware of file system it is installed on.

What could cause problems with games is Operating System itself. As long as Windows NT / 2000 / XP are more secure operating systems, and do not support 16-bit device drivers and real mode, some of games that work well under MS-DOS, Windows 95 / 98/ ME might not work under Windows NT / 2000 / XP.

Q: When Data is written to the NTFS disk at what position does in start the write? EG Assuming a file has been deleted (and deleted from the recycle bin if applicable) would it first overwrite this file, or would it start at the next totally unused cluster?

A: It depends on many factors including file system fragmentation, free space, etc.

In most cases it would start with a next totally unused cluster.

Q: When deleting a file at work from a HDD what is the best way to ensure that the file cannot be recovered? ie that the data no longer exists on the drive, rather than just resetting the flag of the relevant file/cluster? Is there any way NTFS will do this? Registry hacks e.t.c?

A: There are no standard mechanisms for this.

Please use third party privacy software (such as Disk Wiper feature in ZDelete) to eliminate unused MFT entries and overwrite clusters containing deleted data.

NTFS File System Frequently Asked Questions Part II

November 19th, 2009 Comments off
Q: Is it possible to convert a FAT32 Hard Drive to NTFS without losing all data on the drive? I like to change from FAT32 to NTFS, my operating system is Windows XP PRO, how can I do that? Without the lost of my programs?

A: Standard Windows utility that is called CONVERT serves this purpose

Just go to the Command Prompt and execute the command:

	C:\> CONVERT  C:  /fs:ntfs

Where C: is a name of the drive you want to convert.

After machine re-boot conversion process will start and you’ll have your FAT32 converted to NTFS without of data loss.

Q: How does NTFS compared to FAT32 in Windows XP, and which is faster?

A: NTFS has much more built-in features than FAT, so generally it is a bit slower.

However it depends on many factors such as cluster size, average file size, etc.

For example, NTFS can keep small files inside MFT entry, so if the file size is less than cluster size, most likely it will be accessed much faster on NTFS than on FAT.

Generally speaking the performance of NTFS on large volumes is higher than performance of FAT32. NTFS performance on small volumes is lower than performance of FAT/FAT32.

Q: How can I copy files from a hard drive formatted to NTFS, to a FAT32 hard drive ?

A: You probably asking about Windows NT that does not support FAT32.

There are third party FAT32 drivers for NTFS, or you can use FREE NTFS Reader to copy files in DOS environment. Just make sure that your DOS supports FAT32. You can use Bootable Floppy Creator to prepare such a floppy containing DOS and NTFS Reader for DOS.

Q: Which version of NTFS is installed on my Windows XP system ?

A: The following versions are currently available:

  • NTFS v1.2 on Windows NT
  • NTFS v3.0 on Windows 2000
  • NTFS v3.1 on Windows XP
Q: When I use the following command “FORMAT” on a volume (Windows XP) what is really written on this volume ?

A: Clean Master File Table (MFT) containing some system records is created for the volume.

Q: I am using a 249 megabyte drive as a backup drive on my xp system. I have it formatted in NTFS and compressed, yet the size of the drive is still the same as before I compressed it. Why?

A: Actual disk size cannot be changed. By applying compressed attribute for the volume you just ordered operating system to try to compress any object that will be placed there.

If object that is placed onto the volume can be compressed, operating system compresses it and it takes less space on the drive than uncompressed one. Thus more free space is left on the drive for other data.

Q: The files I place on the compressed drive are only compressed from 1.15MB to 1.14 MB , is it normal this should be only 100kb of compression per MB?

A: Compression on NTFS uses modified LZ77 algorithm. It is very fast but not always effective.

If works pretty well for the files/documents containing a number of repeating sequences of symbols. Example of such files types: text files, RTF, BMP, HTML files, etc…

For other file types, such as binaries, GIF, JPG, ZIP files, etc. this compression algorithm is not useful so that these files might not be compressed at all.

Q: Could I read file from my pc running windows XP with NTFS5 file system, from a machine under windows 95 on the same network?

A: Surely you can do it, if you configure Networking properly, i.e. create Network Share on WinXP for the folder where file is located and assign proper access rights to the share.

After performing these procedures if you can lookup WinXP machine across the Network you’ll be able to see this network share from Windows 95 and access files inside.

Q: Which is better? NTFS or NTFS5?

A: As for advances in technologies the latest versions are usually better than previous ones.

In addition to all NTFS features, NTFS5 has support for Encryption, Disk Quotas, Sparse Files, Reparse Points, Volume Mount Points.

How NTFS File System Works: NTFS Physical Structure

September 17th, 2009 Comments off

The following information describes how clusters and sectors are organized on an NTFS volume, how the boot sector on the volume determines the file system, and how the Master File Table (MFT) organizes structures on the volume.

Clusters and Sectors on an NTFS Volume

A cluster (or allocation unit) is the smallest amount of disk space that can be allocated to hold a file. All file systems used by Windows Server 2003 organize hard disks based on cluster size, which is determined by the number of sectors (units of storage on a hard disk) that the cluster contains. For example, on a disk that uses 512-byte sectors, a 512-byte cluster contains one sector, whereas a 4-kilobyte (KB) cluster contains eight sectors.

Computers access certain sectors on a hard disk during startup to determine which operating system to start and where the partitions are located. The data stored on these sectors varies depending on the computer platform.

Sequence of Clusters on an NTFS Volume

Clusters on an NTFS volume are numbered sequentially from the beginning of the partition into logical cluster numbers. NTFS stores all objects in the file system using a record called the Master File Table (MFT), similar in structure to a database.

On NTFS volumes, clusters start at sector zero; therefore, every cluster is aligned on the cluster boundary. Contiguous clusters for file storage allow for faster processing of a file.

Note: Floppy disks do not use NTFS and are always formatted as FAT.

Limitations of Cluster Sizes on an NTFS Volume

Because NTFS uses different cluster sizes depending on the size of the volume, each file system has a maximum number of clusters it can support. The smaller the cluster size, the more efficiently a disk potentially stores information because unused space within a cluster cannot be used by other files. And the more clusters a file system supports, the larger the volumes you can create and format by using a particular file system. NTFS uses smaller cluster sizes, which makes it a more efficient file organization structure.

The table Default NTFS Cluster Sizes lists NTFS volume and default cluster sizes.

Default NTFS Cluster Sizes

Volume Size NTFS Cluster Size
7 megabytes (MB)–512 MB 512 bytes
513 MB–1,024 MB 1 KB
1,025 MB–2 GB 2 KB
2 GB–2 terabytes 4 KB

How NTFS File System Works: NTFS Architecture

September 17th, 2009 Comments off

NTFS File System A file system is a required part of the operating system that determines how files are named, stored, and organized on a volume. A file system manages files and folders, and the information needed to locate and access these items by local and remote users.

During the format of a volume you can choose the type of file system for the volume. When you choose the NTFS file system, the formatting process places the key NTFS file data structures on the volume, regardless of whether it is a basic volume or dynamic volume.

During format and setup of a volume file system on a hard disk, a master boot record (MBR) is created. The MBR contains a small amount of executable code called the master boot code as well as a partition table for the disk. When a volume is mounted, the MBR executes the master boot code and transfers control to the boot sector on the disk, allowing the server to boot the operating system on the file system of that specific volume.

Note: The partition table contains a number of fields used to describe the partition. One of these fields is the System ID field, which defines the file system, such as NTFS, on the partition. For NTFS volumes, the system ID is 0x07.

The figure NTFS Architecture shows the architecture of this process.

NTFS Architecture

NTFS File System

The following table describes the components of an NTFS file system.

NTFS Architecture Components on an x86-based System

Component Component Description
Hard disk Contains one or more partitions.
Boot sector Bootable partition that stores information about the layout of the volume and the file system structures, as well as the boot code that loads Ntdlr.
Master Boot Record Contains executable code that the system BIOS loads into memory. The code scans the MBR to find the partition table to determine which partition is the active, or bootable, partition.
Ntldlr.dll Switches the CPU to protected mode, starts the file system, and then reads the contents of the Boot.ini file. This information determines the startup options and initial boot menu selections.
Ntfs.sys System file driver for NTFS.
Ntoskrnl.exe Extracts information about which system device drivers to load and the load order.
Kernel mode The processing mode that allows code to have direct access to all hardware and memory in the system.
User mode The processing mode in which applications run.