1. Windows XP File System Management Group D

2. 3 Layers of Drivers Filter Drivers Filter Drivers –Virus protection, compression, encryption File System Drivers File System Drivers –Implement FS format (NTFS - XP, FAT) Volume Drivers Volume Drivers –Control hardware device

3. File System Drivers Fulfill I/O requests with I/O Manager Fulfill I/O requests with I/O Manager Use file object pointers to determine file location Use file object pointers to determine file location Read Requests traverse driver layers Read Requests traverse driver layers Link between logical (user) and physical representation (storage) Link between logical (user) and physical representation (storage)

4. File System Drivers Local Local –Process I/O for Hardware Devices Remote Remote –Transfer files to / from remote file servers via network protocols Support for file system independent of file storage volume Support for file system independent of file storage volume

5. Master File Table (MFT) NTFS uses MFT entries to define the files to which they correspond. All information about a file, including its size, time and date stamps, permissions, and data content is either stored in MFT entries or in space external to the MFT but described by the MFT entries. NTFS uses MFT entries to define the files to which they correspond. All information about a file, including its size, time and date stamps, permissions, and data content is either stored in MFT entries or in space external to the MFT but described by the MFT entries. As files are added to an NTFS volume, more entries are added to the MFT and so the MFT increases in size. When files are deleted from an NTFS volume, their MFT entries are marked as free and may be reused, but the MFT does not shrink. Thus, space used by these entries is not reclaimed from the disk. As files are added to an NTFS volume, more entries are added to the MFT and so the MFT increases in size. When files are deleted from an NTFS volume, their MFT entries are marked as free and may be reused, but the MFT does not shrink. Thus, space used by these entries is not reclaimed from the disk.

6. Master File Table (MFT) To learn MFT size, follow these instructions: Start  All Programs  Accessories  System Tools  Disk Defragmenter

7. Simplified illustration of the MFT structure

8. Master File Table (MFT) The first record of this table describes the master file table itself, followed by a MFT mirror record. If the first MFT record is corrupted, NTFS reads the second record to find the MFT mirror file, whose first record is identical to the first record of the MFT. The locations of the data segments for both the MFT and MFT mirror file are recorded in the boot sector. A duplicate of the boot sector is located at the logical center of the disk. The first record of this table describes the master file table itself, followed by a MFT mirror record. If the first MFT record is corrupted, NTFS reads the second record to find the MFT mirror file, whose first record is identical to the first record of the MFT. The locations of the data segments for both the MFT and MFT mirror file are recorded in the boot sector. A duplicate of the boot sector is located at the logical center of the disk.

9. Master File Table (MFT) The third record of the MFT is the log file, used for file recovery. The seventeenth and following records of the master file table are for each file and directory (also viewed as a file by NTFS) on the volume. The third record of the MFT is the log file, used for file recovery. The seventeenth and following records of the master file table are for each file and directory (also viewed as a file by NTFS) on the volume.

10. MFT Record for a Small File or Directory

11. Data Streams  Where the contents of an NTFS file are;  Multiple data streams allowed in one file: Default the contents of the file; Alternate meta and supplemental data;  Where the contents of an NTFS file are;  Multiple data streams allowed in one file: Default the contents of the file; Alternate meta and supplemental data;

12.  Attribute type Data  Attribute name how NTFS differentiates between alternate data streams  Attribute type Data  Attribute name how NTFS differentiates between alternate data streams Data Streams

13. File Compression  Transparent to applications Done at system level Same API calls for both compressed and uncompressed files  Lempel-Ziv “I am fat and because I am fat, I can't even tell you that I am fat.” “$1 and because $1, I can't even tell you that $1.” $1=[I am fat]  Transparent to applications Done at system level Same API calls for both compressed and uncompressed files  Lempel-Ziv “I am fat and because I am fat, I can't even tell you that I am fat.” “$1 and because $1, I can't even tell you that $1.” $1=[I am fat]

14.  Segmented compression Divides file in compression units Random file I/O without decompressing the entire file Compresses files while still being modified  Segmented compression Divides file in compression units Random file I/O without decompressing the entire file Compresses files while still being modified File Compression

15. NTFS Encryption True support for encryption in file system (unlike encrypted loopback device in linux) True support for encryption in file system (unlike encrypted loopback device in linux) Same API as regular files Same API as regular files All data streams are encrypted All data streams are encrypted Encrypted in 16 cluster chunks Encrypted in 16 cluster chunks Encryption uses PKI to store data encryption key for each user (see next) Encryption uses PKI to store data encryption key for each user (see next)

16. Structure of an EFS file FEKDDF (Data Decryption Field) User Name Encrypted FEK, etc FEK DRF (Data Recovery Field) Encrypted Data From Presentation by Ken Knapton, formerly Chief Technology Officer of AccessData Corporation

17. File Attributes defined by NTFS Credit: www.ntfs.com

19. Fat 12 Example

20. Fat 16 Example

21. Fat 32 Example

22. NTFS Example

23. NTFS’ Boot Sector Example

24. Data Stored in MFT Credit: www.ntfs.com

25. MFT Example