Windows 2000 NTFS 3.0 File System Structure

Microsoft Windows 2000 introduced NTFS version 3.0 (often internally labeled as NTFS 5.0), significantly expanding the capabilities of the original NT file system with features like disk quotas, Encrypting File System (EFS), and reparse points. This article breaks down the default structural layout of an NTFS 3.0 volume, detailing the organization of disk sectors, the critical role of the Master File Table (MFT), and the specialized metadata files that govern volume operations.

High-Level Volume Layout

An NTFS 3.0 volume is divided into clusters—contiguous groups of sectors—addressed through Logical Cluster Numbers (LCNs). By default, on volumes larger than 2 GB, Windows 2000 formats NTFS with a 4 KB (8 sectors) cluster size.

The physical volume layout consists of four primary regions:

  1. Partition Boot Sector: Located at the beginning of the volume (first 16 sectors), containing the bootstrap code and the BIOS Parameter Block (BPB), which details cluster sizes, volume geometry, and the starting cluster of the Master File Table. A backup copy of the boot sector is stored at the exact end of the partition.
  2. Master File Table (MFT): The structural core of the file system.
  3. System Files (Metadata): A set of hidden operational files managed by the MFT.
  4. File Area: The remaining clusters on the disk utilized for user data, directories, and file attributes.

The Master File Table (MFT)

In NTFS 3.0, every object on the volume is treated as a file, including the file system structure itself. The MFT is organized as an array of fixed-size records, typically 1,024 bytes (1 KB) each.

  • Small Files (Resident Data): If a file's attributes and data fit within the 1 KB record, the entire file resides directly inside the MFT.
  • Large Files (Non-Resident Data): When data exceeds the record space, NTFS allocates external cluster runs and stores pointers (Virtual Cluster Numbers to Logical Cluster Numbers) inside the MFT record.
  • MFT Zone: To prevent fragmentation of the MFT, Windows 2000 reserves an "MFT Zone" (typically 12.5% of the total disk space) dynamically allocated exclusively for MFT growth until disk space runs low.

Default System Metadata Files

The first entries of the MFT (records 0 through 15) are reserved for core NTFS metadata files, each denoted by a leading dollar sign ($):

  • Record 0 ($MFT): Describes the Master File Table itself, tracking all records and cluster allocations for the MFT.
  • Record 1 ($MFTMirr): A duplicate of the first four critical records of the MFT, used for recovery if the primary MFT sectors are corrupted.
  • Record 2 ($LogFile): Transaction logging file used by the NTFS log manager to record metadata changes for rapid recovery after system crashes.
  • Record 3 ($Volume): Contains the volume label, file system version (NTFS 3.0), and volume operational flags.
  • Record 4 ($AttrDef): An attribute definition table defining attribute types (e.g., $STANDARD_INFORMATION, $DATA, $FILE_NAME) supported on the volume.
  • Record 5 (.): The root directory of the volume, containing index allocations for user files and folders.
  • Record 6 ($Bitmap): A bitmask representing cluster usage across the entire volume, where each bit indicates whether a cluster is free (0) or allocated (1).
  • Record 7 ($Boot): Stores the volume boot code and bootstrap loader.
  • Record 8 ($BadClus): Tracks all bad clusters detected on the drive to prevent allocation.
  • Record 9 ($Secure): Introduced to centralize and optimize security descriptors, sharing identical Access Control Lists (ACLs) across multiple files to save disk space.
  • Record 10 ($UpCase): A table mapping lowercase characters to uppercase Unicode equivalents to enable case-insensitive file lookups.
  • Record 11 ($Extend): A dedicated directory created in NTFS 3.0 to house optional system extensions.

The $Extend Metadata Directory

NTFS 3.0 introduced the $Extend directory to support new enterprise features without altering the base MFT architecture. This directory includes:

  • $Quota: Manages user-based disk usage limits and tracks assigned storage quotas.
  • $ObjId: Stores unique 16-byte object identifiers required for Distributed Link Tracking.
  • $Reparse: Stores pointers for reparse points, which power volume mount points, junction points, and Remote Storage Service.
  • $UsnJrnl: The Update Sequence Number (USN) change journal, providing an ordered log of all modifications made to files and directories on the volume.