NTFS treats files as a unit of attribute/attribute value. That is the differences between NTFS and other file system. File data is attribute value without names. Other file attributes includes file name, file owner and file time mark, etc.

Each attribute is composed by single stream, namely simple character array. Strictly speaking, NTFS does not operate files, but read and write the attribute stream. NTFS operates in various ways: creation, deletion, read (byte scope) and writes in (byte scope). The read-write operation aims at innaming attribute of file, as to those with name, it can operate by by named data stream.

Folder of NTFS is only a simple filename and index of file quotation number. If the directory attribute list is smaller than the length of a record, then all information of this folder is saved in MFT record. As to folders bigger than record, it uses B+ tree to manage and uses an indicator to point to an extent cluster. This cluster is used to save attributes of folders that cannot be saved in MFT.

NTFS directory

Data Recovery Ebook home