Upgrading and Repairing PCs

NTFS

Windows NT 3.1 (the first version of NT despite the 3.1 designation) was released in August 1993 and introduced the New Technology File System (NTFS), which is unique to NT-based operating systems (including Windows 2000 and Windows XP) and is not supported by Windows 9x/Me. NTFS includes many advanced features not found in the FAT file systems.

NTFS supports larger volumes (up to 16TiB), larger files, and more files per volume than FAT. NTFS also uses smaller cluster sizes than even FAT32, resulting in more efficient use of a volume. For example, a 30GiB NTFS volume uses 4KiB clusters, whereas the same size volume formatted with FAT32 uses 16KiB clusters. Smaller clusters reduce wasted space on the volume. NTFS cluster sizes are shown in Table 24.7.

Table 24.7. NTFS Cluster Sizes

Volume Size	Sectors per Cluster	Cluster Size
16MiB–512MiB	1	0.5KiB
>512MiB–1GiB	2	1KiB
>1GiB–2GiB	4	2KiB
>2GiB–2TiB[1]	8	4KiB
MB = Megabyte = 1,000,000 bytes GB = Gigabyte = 1,000MB = 1,000,000,000 bytes TB = Terabyte = 1,000GB = 1,000,000,000,000 bytes KiB = Kibibytes = 1,024 bytes MiB = Mebibyte = 1,024KiB = 1,048,576 bytes GiB = Gibibyte = 1,024MiB = 1,073,741,824 bytes TiB = Tebibytes = 1,024GiB = 1,099,511,627,776 bytes

^[1] Larger cluster sizes can be forced by altering the format parameters; however, file compression is disabled if clusters larger than 8 sectors (4KiB) are selected.

NTFS uses a special file structure called a master file table (MFT) and metadata files. The MFT is basically a relational database that consists of rows of file records and columns of file attributes. It contains at least one entry for every file on an NTFS volume. NTFS creates file and folder records for each file and folder created on an NTFS volume. These are stored in the MFT and consume 1KiB each. Each file record contains information about the position of the file record in the MFT, as well as file attributes and any other information about the file.

NTFS was designed to manage clusters using up to 64-bit numbers, which is an astronomical amount, but the current implementations use 32-bit numbers instead. Using 32-bit numbers allows for addressing up to 4,294,967,295 clusters, each of which is typically up to 4KiB.

NTFS reserves a total of 32 sectors for a 16-sector-long default volume boot sector and a backup boot sector. The default boot sector is located at the beginning (logical sector 0) of the volume, whereas the backup boot sector is written at the logical center of the volume (if it was formatted using NT 3.51 and earlier) or at end of the volume (if it was formatted with NT 4.0 or later, including 2000 and XP).

An NTFS volume can therefore comprise up to 34,359,738,392 total sectors (32 sectors reserved for the default and backup boot sectors, plus 4,294,967,295 clusters x 8 sectors), which is 17.59TB or 16.00TiB. Note that this capacity is theoretical because the 32-bit sector numbering scheme used in the partition tables located in the MBR limits a disk to no more than 4,294,967,295 (2³²–1) sectors, which is 2.2TB or 2TiB. Therefore, even though NTFS can in theory handle a volume of up to 17.59TB, the reality is that this is currently limited by the partition table format of the MBR to only 2.2TB.

Windows 2000 and XP can get around this on nonbootable drives by using a new storage format called a dynamic disk. Windows 2000 and XP Professional (but not XP Home) offer two types of storage: basic disks and dynamic disks. Basic disks use the same structures as before, with an MBR on the disk containing a partition table limited to four primary partitions per disk, or three primary partitions and one extended partition with unlimited logical drives. Primary partitions and logical drives on basic disks are known as basic volumes.

Dynamic disks were first introduced in Windows 2000 and provide the capability to create dynamic volumes that can be simple (using only one drive), spanned (using multiple drives), or striped (using multiple drives simultaneously for increased performance). Dynamic disks use a hidden database (contained in the last mega byte of the disk) to track information about dynamic volumes on the disk and about other dynamic disks in the computer. Because each dynamic disk in a computer stores a replica of the dynamic disk database, a corrupted database on one dynamic disk can be repaired using the database on another. By spanning or striping multiple drives using dynamic disk formats, you can exceed the 2TiB limit of a single MBR-based partition.

Although the 32-bit sector numbering in the partition tables on MBR disks limits NTFS basic disks to 2TiB volumes, you can use dynamic volumes to create NTFS volumes larger than 2TiB by spanning or striping multiple basic disks to create a larger dynamic disk. Because the dynamic volumes are managed in the hidden database, they are not affected by the 2TiB limit imposed by the partition tables in the MBR. In essence, dynamic disks enable Windows 2000 and XP Pro to create NTFS volumes as large as 16TiB. The volume limits for NTFS are listed in Table 24.8.

Table 24.8. NTFS Volume Limits

Volume Limit	Clusters	Sectors per Cluster	Total Volume Sectors	Volume Size (Decimal)	Volume Size (Binary)
Minimum size	32,698	1	32,730	16.76MB	15.98MiB
Basic disk max.	536,870,908	8	4,294,967,296	2.2TB	2TiB
Dynamic disk max.	4,294,967,295	8	34,359,738,392	17.59TB	16TiB
MB = Megabyte = 1,000,000 bytes GB = Gigabyte = 1,000MB = 1,000,000,000 bytes TB = Terabyte = 1,000GB = 1,000,000,000,000 bytes KiB = Kibibytes = 1,024 bytes MiB = Mebibyte = 1,024KiB = 1,048,576 bytes GiB = Gibibyte = 1,024MiB = 1,073,741,824 bytes TiB = Tebibytes = 1,024GiB = 1,099,511,627,776 bytes

Some notable characteristics and features of NTFS include

• Files are limited in size to 16TiB less 64KiB or by the size of the volume, whichever is lower. NTFS supports up to 4,294,967,295 (2³²–1) files on a volume.

• NTFS is not normally used on removable media because NTFS does not flush data to the disk immediately. In addition, removing NTFS-formatted media without using the Safe Removal application can result in data loss. For removable media that can be ejected unexpectedly, you should use FAT12, FAT16, or FAT32 instead.

• NTFS incorporates transaction logging and recovery techniques. In the event of a failure, upon reboot NTFS uses its log file and checkpoint information to restore the consistency of the file system.

• NTFS dynamically remaps clusters found to contain bad sectors and then marks the defective cluster as bad so it will no longer be used.

• NTFS has built-in security features. These enable you to set permissions on a file or folder.

• NTFS has a built-in encrypting File System (EFS). This performs dynamic encryption and decryption as you work with encrypted files or folders, while preventing others from doing so.

• It enables the setting of disk quotas. You can track and control space usage for NTFS volumes among various users.

• NTFS has built-in dynamic compression, which compresses and decompresses files as you use them.