Ntfs Cheat Sheets

NTFS Reference Sheet
NTFS Boot sector

0
1
2
0 Jump Instruction
10
0x000000
unused
6
7
OEM ID
Media
desc
0x0000
B
C
Bytes/ Sector
Sect /
track
D
E
F
Sect/
res
clust
Hidden Sectors
Number
heads
Total Sectors
Logical Cluster of $MFTMirr
Volume Serial Number
Boot Code
20
unused
30
Logical Cluster of $MFT
40 Clust / File record segment
Clusters / Index Block
50
Checksum
60
.
Boot Code
.
.
1E0
1F0
Boot Code
55
AA
Key
Sect / Clust - Sectors per cluster
res - reserved, note that the terms reserved, unused and 0x00 are specified by Microsoft, the difference between reserved and
unused is not specified. However it should be noted that the blocks specified as all zeros have defined meaning within FAT boot
sectors.
media desc - Media descriptor, legacy from DOS, 0xF8 indicates fixed disk, 0xF0 a HD 3.5inch floppy.
BIOS Parameter Block (BPB)
Extended BPB
Boot code
End of sector marker
reference: http://technet.microsoft.com/en-us/library/cc976796.aspx
NTFS files
File
Name
$Mft
Master File Table
$MFT
record #
0
$MftMirr
MFT mirror
$LogFile
Log file
$Volume
Volume
$AttrDef
4
5
The root folder.
$Bitmap
$Boot
Attribute
definitions
Root file name
index
Cluster bitmap
Boot sector
Contains one base file record for each file and folder on an NTFS volume.
If the allocation information for a file or folder is too large to fit within a
single record, other file records are allocated as well.
Guarantees access to the MFT in case of a single-sector failure. It is a
duplicate image of the first four records of the MFT.
Contains information used by NTFS for faster recoverability. The log file is
used by Windows Server 2003 to restore metadata consistency to NTFS
after a system failure. The size of the log file depends on the size of the
volume, but you can increase the size of the log file by using the Chkdsk
command.
Contains information about the volume, such as the volume label and the
volume version.
Lists attribute names, numbers, and descriptions.
6
7
$BadClus
$Secure
$Upcase
Bad cluster file

Security File
Upcase table
8
9
10
$Extend
NTFS extension
file
11
Represents the volume by showing free and unused clusters.

Includes the BPB used to mount the volume and additional bootstrap
loader code used if the volume is bootable.
Contains bad clusters for a volume.
Contains unique security descriptors for all files within a volume.
Converts lowercase characters to matching Unicode uppercase
characters.
Used for various optional extensions such as quotas, reparse point data,
and object identifiers.
Reserved for future use.
12-15
Description
source: http://technet.microsoft.com/en-us/library/cc781134(WS.10).aspx
Michael Wilkinson, This document may be freely distributed provided this notice remains intact
The original is located at http://www.writeblocked.org/
Page 1 of 4

Some $MFT entry attributes
ID
Attribute Type
0x10 Standard Information
0x20 Attribute List
Description
Includes information such as time stamp and link count.
Lists the location of all the attribute records that do not fit in the MFT record.
A repeatable attribute for both long and short file names. The long name of the file can be up to
255 Unicode characters. The short name is the MS-DOS-readable, 8.3, case-insensitive name for
the file. Additional names, or hard links, required by POSIX can be included as additional file
name attributes.
A volume-unique file identifier. Used by the link tracking service. Not all files have object
identifiers.
0x30 File Name
0x40 Object ID
0x50 Security Descriptor
0x60 Volume Name
0x70 Volume Information
Shows information about who owns the file and who can access the file.
Used only in the $Volume system file. Contains the volume label.
Used only in the $Volume system file. Contains the volume version.
Contains file data. NTFS allows multiple data attributes per file. Each file typically has one
0x80 Data
unnamed data attribute. A file can also have one or more named data attributes, each using a
particular syntax.
0x90 Index Root
Used to implement folders and other indexes.
0xA0 Index Allocation
0xB0 Bitmap
Used for directory junction points and volume mount points. They are also used by file system
0xC0 Reparse Point
filter drivers to mark certain files as special to that driver.
Similar to a data stream, but operations on a logged tool stream are logged to the NTFS log file
0x100 Logged Tool Stream
just like NTFS metadata changes. Used by EFS.
source: http://technet.microsoft.com/en-us/library/cc976808.aspx
File Record Segment Header
Seq no
Update Seq
array offset
st
Hard Link
Count
Update Seq
$LogFile Sequence Number
array size
Flags
Used size of file record Allocated size of file
record
1 attrib
offset
File reference to base file record
Next attrib
MFT Record No
ID
Reserved for update sequence array?
3 default location of update seq array

(size determined by seq size)
Reserved for sequence array?
st
Common location of 1 attrib
Resident Attribute Header
Type ID
Content length
Form code
0x00 = Resident
0x01 = Non resident
Attribute Length
Content
offset
Form
code
name
len
Name
offset
flags
Attrib ID
unused
Flags
0x00FF = Compressed
0x8000 = Sparse
0x4000 = Encrypted
Page 2 of 4

Non Resident Attribute Header
Type ID
Attribute Length
Form name
Name
flags
Atrib ID
code
len
offset
Ending virtual cluster number
Size of attribute content
10
Start virtual cluster number
20 Runlist Compression
0x0000
offset
unit size
30
size on disk of attribute content
40 Data runlists
Initialized size of attribute content
Attrib ID starts from zero

Virtual cluster numbers are used when a MFT record is fragmented
$Standard_Information
3
4
5
Date Created*
10
20
30
40
Date MFT record modified

Flags
Max Versions
Owner ID
Security ID
Update Sequence Number
B
C
D
Date Modified
Date Accessed
Version Num
Class ID
Quota Charged
*Time values are in 100 nanoseconds since January 1, 1601 UTC

flags (used for both $Standard_Information and $File_Name
Bit Hex
Meaning
Bit Hex
Meaning
0
0x0001
Read only
8
0x0100
Temporary
1
0x0002
Hidden
9
0x0200
Sparse File
2
0x0004
System
A
0x0400
Reparse Point
3
0x0008
B
0x0800
Compressed
4
0x0010
C
0x1000
Offline
5
0x0020
Archive
D
0x2000
Not Indexed
6
0x0040
Device
E
0x4000
Encrypted
7
0x0080
Normal
F
0x8000
Source: http://msdn.microsoft.com/en-us/library/aa365535(v=VS.85).aspx
$File_Name
0
10
2
3
4
5
Parent Directory
Date Modified
20
Date Accessed
30
Size on disk
40
B
C
D
Date Created
Date MFT Modified
Logical file size

Flags*
Reparse value
Name Name
Name (variable length)
len type
Name types
Value
Description
POSIX (unicode, case sensitive)
Win32 (unicode, case insensitive)
DOS (8.3 ASCII, case insensitive)
Win32 7 DOS (when Win32 fits in DOS space)
Page 3 of 4

$Data (Standard Header with data run, may be resident or non resident, non resident shown here)
0
0
10
20
30
40
Type ID
Attribute Length
0x80
Start virtual cluster number
Runlist Compression
0x0000
offset
unit size
size on disk of attribute content
Data runlists
Form name
Name
flags
Atrib ID
code
len
offset
Ending virtual cluster number
Size of attribute content
Initialized size of attribute content
Data runlists
$ATTRIBUTE_LIST entry (one entry per attribute in the record, including attributes that precede the list).
Type ID
Record
Length
$MFT Record number
Atrib Attrib
name name
len offset
Seq num
Lowest VCN
Reserved
Start of name (if present)
Source: http://msdn.microsoft.com/en-us/library/bb470038%28v=vs.85%29.aspx
Page 4 of 4

Ntfs Cheat Sheets

Uploaded by

Copyright:

Available Formats

Ntfs Cheat Sheets

Uploaded by

Document Information

Original Description:

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Ntfs Cheat Sheets

Uploaded by

Copyright:

Available Formats

NTFS Reference Sheet

NTFS Boot sector

Master File Table

The root folder.

Bad cluster file

Represents the volume by showing free and unused clusters.

NTFS Reference Sheet

0x30 File Name

3 default location of update seq array

Common location of 1 attrib

Resident Attribute Header

NTFS Reference Sheet

Initialized size of attribute content

Attrib ID starts from zero

Date MFT record modified

*Time values are in 100 nanoseconds since January 1, 1601 UTC

Logical file size

POSIX (unicode, case sensitive)

Win32 (unicode, case insensitive)

DOS (8.3 ASCII, case insensitive)

Win32 7 DOS (when Win32 fits in DOS space)

NTFS Reference Sheet

$MFT Record number

Start of name (if present)

You might also like