Drivers of NTFS

Win 32 I/O API is completed by I/O management. I/O management sends requests of I/O to NTFS FSD to be executed.
In implementation, I/O management also works together with high speed buffer management, memory management, file log service, volume management and disk driver.

Applications create and store files via FSD of NTFS. This process is includes following steps: Firstly Windows 2000/XP checks authority, only legal users' request can be run. Then I/O management transforms the file handle into the file object indicator. Finally NTFS obtains files in disk through the file object indicator.

Now let's analyze how NTFS obtains files in disk through the file object indicator. NTFS obtains stream control block (SCB) of file attribute through the file object indicator. Each SCB expresses the single attribute file, and includes information on how it obtains that attribute. All SCBs of a file point to a common data construction File Control Block (FCB). FCB contains an indicator that points to the file record of main file table (MFT). NTFS gets the file access authority through this indicator.

Data Recovery Ebook home