from Wikipedia, the free encyclopedia
Manufacturer Microsoft
Full name New Technology File System
Initial release July 1993 ( Windows NT 3.1 )
Partition identifier 0x07 ( MBR )
EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 ( GPT )
Technical implementation
Directories B + tree
Files Bitmap / Extents
Defect block list Bitmap / Extents
Maximum values
Size of a file 16  TiB in the current implementation (16  EiB due to the concept) = approx. 17.1  TB or 18.0  EB
Number of all files 4,294,967,295 (2 32 -1)
Length of the file name 255 characters
File system size 256  TiB in the current implementation (16  EiB due to the concept)
Allowed characters in the file name all characters except '\ 0' (NUL) and '/' , Windows also prohibits the following characters \: *? "<> |
Dates of a file Creation, modification, modification after POSIX , last access
Date range January 1, 1601 to May 28, 60056
Forks supported
File attributes read-only , hidden, system file, archive
File rights management ACL
Transparent compression at file level, LZ77 (from Windows NT 3.51 )
Transparent encryption at file level
DESX (from Windows 2000 ),
Triple DES (from Windows XP ),
AES (from Windows XP Service Pack 1, Windows Server 2003 )
Supporting operating systems native:
Windows NT -based operating systems ( Windows NT 3.1 to Windows 10 )
other operating systems:
via third-party drivers ( Linux , MS-DOS , Windows 9x , macOS ),
restrictions: see information below

NTFS is a proprietary file system from Microsoft for all operating systems in the Windows NT series. The abbreviation stands for New Technology File System .

Compared to the FAT file system , NTFS offers, among other things, targeted access protection at file level and greater data security through journaling . However, compatibility is not as broad as with FAT. Another advantage of NTFS is that the file size is not limited to 4 GiB as with FAT  . Larger files, for example, when creating DVD - images needed.


When the development of Windows NT, later Microsoft Windows NT 3.1, began, it was not yet clear which file system the future operating system would use. At that point in time the file system FAT16 , which was used by MS-DOS , and HPFS , the file system of OS / 2, existed . The FAT file system was already widespread by then, but in David Cutler's opinion , both FAT and the more advanced HPFS did not meet the reliability requirements that he wanted a file system to be. The new file system, in his opinion, needed to be able to automatically restore damaged files. In addition, both file systems had limitations on the maximum file size and number, and it was to be expected that the new operating system would handle larger amounts of data in the future. The development of a third file system, however, threatened the operating system's schedule.

The specification phase for the new file system began. Under FAT16, file names were limited to the 8.3 format. These names were often cryptic due to the forced brevity and also difficult to remember. HPFS supported filenames up to 255 characters long, but older DOS or Windows programs could not see such files. NTFS was supposed to solve this problem by automatically giving a short form to every long file name so that older applications could edit the file.

However, the development of the new file system was on shaky ground. April 1991 almost meant the end of NTFS when several developers decided to stop development of this file system due to lack of time. Only when Cutler, who was on vacation at the time, returned and ordered the resumption of development, the work continued. The test phase of the new file system began in February 1992, and it was not until October 1992 that the file system was stable enough for implementation.

Structure - MFT

NTFS inherited many of the concepts of the HPFS file system from IBM , which was used in the OS / 2 operating system initially developed with Microsoft , but goes far beyond that in some aspects.

In contrast to inode- based file systems, which are used by Unix (concept: everything is one file), with NTFS all information about files is stored in one file (concept: everything is in one file), the master file table , or MFT for short saved. This file contains the entries, which blocks belong to which file, the access rights and the attributes. The properties (attributes) of a file under NTFS include file size, date of file creation, date of last change, release, file type and also the actual file content.

Very small files and directories are saved directly in the MFT. Larger files are then saved as an attribute in a data run. There are 4 stages of file growth.

When the hard disk is formatted, a fixed space is reserved for the MFT that cannot be occupied by other files. When this area is completely filled with information, the file system begins to use free space on the data carrier, which can lead to fragmentation of the MFT. By default, an area of ​​12.5% ​​of the partition size is reserved for the MFT.

When saving metadata , a journal is kept , which means that a planned action is written to the journal first. Only then is the actual write access to the data carried out, and finally the journal is updated. If a write access is not completely terminated, for example because of a crash, the file system only needs to undo the changes in the journal and is then back in a consistent state.

NTFS versions

The following list reflects the mapping between the NTFS and Windows versions:

Version compatibility

  • The only upward compatibility exists for version 3.0 to 3.1, since the data carrier formats are identical. This means that even Windows NT 4.0 can still access Windows XP partitions, with the exception of the USN journal required for Windows domain controllers in a dual boot scenario on the same computer. Windows NT 3.1 can be updated using updated system files from Windows NT 3.5 (NTFS 1.0 to version 1.1), for which Microsoft has published official instructions.
  • In principle, all other versions of NTFS are backwards compatible with earlier versions (later Windows versions have full access to older NTFS versions), but they are not forward compatible with later versions without an updated driver.

Differences from the FAT file system

From NTFS 1.X

The differences compared to FAT are:

  • efficient use of memory for partitions over 400 MiB
  • Metadata journaling : the file system structures are always in a consistent state
  • Long file names: In contrast to FAT16 , file names can also be native (without VFAT ) up to 255 characters long and consist of almost any Unicode characters. NTFS is case-sensitive; Although this is not supported by Win32 applications, POSIX applications can also correctly manage files that are only case-sensitive.
  • a maximum length of the complete path name of 32,767 characters (however, Windows up to version Windows 10 Build 14352 limits the usable length to 260 characters)
  • flexible rights management through the use of access control lists
  • maximum file size of theoretically 16  Exbibytes (EiB)
  • fast and efficient storage of small files directly in the MFT (from Windows NT 3.51 by default 4096 byte large cluster used)
  • Storage of alternative data streams
  • Transparent compression of files (although it was developed from the start, it is only implemented in Windows NT 3.51 and higher and is only supported for unencrypted files and cluster sizes of up to 4  KiB ).

From NTFS 2.X

  • Data encryption (only at file level)

From NTFS 3.X

  • Transparent file encryption with EFS (not in Windows XP Home Edition and only for uncompressed data)
  • Quotas to limit the usable hard disk space for individual users,
  • Analysis points (English Reparse Point ) for linking actions / functions with files or directories,
  • Hard links : each file can be referenced by up to 1023 filenames (one file, many names),
  • for files with a lot of blank content, when marked as a sparse file , only portions that are actually written are saved.
  • Increased defragmentation speed.

Reparse points

Analysis points (English also reparsepoint called) are a flexible extension to the file system, by linking the file system entries with functions. These can be used in a variety of ways - for example managed via the command fsutil- and also expanded in future versions. A file system driver that is unaware of a certain type of reparse point will not execute it. When accessing an analysis point, the function-specific analysis data are dynamically evaluated by the corresponding function (hence "analysis"). This implies that such an analysis can also fail and access to the data provided by the analysis point is not possible (possibly due to current, temporary circumstances).

The following functions are currently supported by NTFS:

  • Junction points to connect directory links to directories.
  • Mount points to logical volumes in other directories to include .
  • Symbolic links to link file entries to files. These were introduced with Vista and, unlike the previously mentioned reparse points, also support references to non-local objects - they can therefore (like the mount points ) refer beyond (physical) disk boundaries.

Enhancements since Windows Vista

Transactional NTFS (TxF)

With the introduction of Windows Vista , the NTFS file system was expanded to include the concept of atomic operations (transactions). This transaction-based NTFS (English Transactional NTFS ; TxF for short) enables applications to carry out file operations atomically. Changes to the file system are therefore only carried out if the entire transaction has been carried out successfully. A transaction can include a single operation or a sequence of file operations (for example the creation, deletion or renaming of one or more files or directories).

Transactional NTFS was implemented on the basis of the Kernel Transaction Manager (KTM), also introduced with Windows Vista , which enables transactions at the kernel level. It extends the journal functionality already contained in previous NTFS versions, which is limited to the integrity of the structure of the file system, by the following options:

  • Atomic operations on individual files:
An example of this is the saving of a file by an application: If a program or computer crash so far during the write process, only part of the data was written under earlier NTFS versions, which could lead to an incomplete file. This was particularly problematic if an earlier file version was to be replaced or overwritten - data loss was the result.
  • Atomic operations involving multiple files:
If an application has to make changes to several files at the same time, all necessary file operations can be combined in one transaction and data inconsistency in the event of an error can be avoided.
  • Atomic operations across computer boundaries:
Performing the same operations on multiple computers is a common administrative task; for example in a computer network of a company. Transactional NTFS interacts with the Distributed Transaction Coordinator (DTC) and ensures that changes can be carried out successfully on all participating computers that support Transactional NTFS (e.g. the central synchronization of several workstation computers).

Windows supports transactions from Windows Vista or Windows Server 2008 . In the meantime, however, Microsoft recommends the use of alternatives, the API must therefore be viewed as deprecated and its use should be discouraged.

Standard cluster sizes and limitations

Depending on the size of the drive, the following standard cluster sizes are assigned:

operating system NT 3.51 NT 4.0 all from Windows 2000
Drive size Cluster size Sectors Cluster size Sectors Cluster size Sectors
7 Mebibytes to 512 MiB 512 bytes 1 4,096 bytes 8th 4,096 bytes 8th
512 Mebibytes to 1 GiB 1,024 bytes 2 4,096 bytes 8th 4,096 bytes 8th
1 gibibyte to 2 GiB 2,048 bytes 4th 4,096 bytes 8th 4,096 bytes 8th
2 gibibytes to 2 TiB 4,096 bytes 8th 4,096 bytes 8th 4,096 bytes 8th
2 tebibytes to 16 TiB not supported (MBR) not supported (MBR) 4,096 bytes 8th
16 tebibytes to 32 TiB not supported (MBR) not supported (MBR) 8,192 bytes 16
32 tebibytes to 64 TiB not supported (MBR) not supported (MBR) 16,384 bytes 32
64 tebibytes to 128 TiB not supported (MBR) not supported (MBR) 32,768 bytes 64
128 tebibytes to 256 TiB not supported (MBR) not supported (MBR) 65,536 bytes 128
more than 256 tebibytes unsupported unsupported unsupported

"Not supported (MBR)" = The master boot record only supports drives up to 2 Tebibyte, in addition the GUID Partition Table is used, which is only supported from Windows 2000 and by computers with an Extensible Firmware Interface .

File names are limited to 255 UTF-16 characters. Certain names are reserved and can only be assigned in the root directory of a drive. These are: $ MFT, $ MFTMirr, $ LogFile, $ Volume, $ AttrDef,. (Period), $ Bitmap, $ Boot, $ BadClus, $ Secure, $ Upcase and $ Extend. Paths are limited to around 32,767 characters (UTF-16), but with some API functions to only 260 characters.
Long and compatible short filenames
If files have lost their long filenames and encounter files with long filenames but the same 8.3 short name, name collisions can occur, which are not apparent at first glance. This can also occur after both files previously peacefully coexisted in another directory where the LFN file had a different short name.
Maximum drive sizes
Theoretically, the maximum drive size of NTFS 2 is 64 −1 cluster. In practice, however, it is restricted by the operating system. Under Windows XP Professional it is 2 32 −1 clusters, which, for example, when using 64  KiB per cluster corresponds to a maximum drive size of 256 TiB minus 64 KiB (using the standard cluster  size of 4 KiB the maximum would be 16 TiB minus 4 KiB) . However, since the Master Boot Record (MBR) only allows partitions up to 2 TiB (≈ 2.2  TB ), dynamic or GPT volumes must be used for more than 2 TiB . Booting from such a volume requires a system with EFI and 64 bit in Microsoft Windows .
Maximum file size
The maximum file size under NTFS is theoretically 16 EiB (16 × 1024 6 = 2 64 bytes) minus 1 KiB (18,446,744,073,709,550,592 bytes). In practice, however, this is restricted by the operating system: under Windows XP 16 TiB (2 44 bytes) minus 64 KiB.
Files per drive
Theoretically 4,294,967,295 files (2 32 −1), which corresponds to the maximum number of clusters, but is subject to further exceptions and restrictions.

Support from other operating systems

Since NTFS is a proprietary file system, access by operating systems other than those of the Windows NT series may only be possible to a limited extent.

Access with DOS-based operating systems

For DOS -based operating systems, which also include the Windows 9x series , there are drivers such as NTFS4DOS , which allow full access to NTFS drives.

Access with Unixoid operating systems

Linux supports full read and write access via NTFS-3G , read access to encrypted files and can format data carriers in NTFS. There is also a kernel driver. As of version 10.3, macOS can read NTFS file systems, but cannot write them. In version 10.6 (Snow Leopard), a hidden write functionality was found, but it has not been officially released.

Under Linux, macOS and FreeBSD , the NTFS-3G user-mode driver can also be used to write to NTFS file systems. Paragon also provides a commercial driver.

See also


  • Harald Bögeholz: data depositor. Defragmenter for NTFS. (c't 21/2005, p. 178)

Web links

Individual evidence

  1. a b G. Pascal Zachary: Showstopper! The breakneck race to create Windows NT and the next generation at Microsoft. E-Rights / E-Reads, New York 2009, ISBN 0-7592-8578-0 , pp. 129 f .
  2. ^ Zachary, p. 133
  3. ^ Zachary, p. 146 f.
  4. Zachary, pp. 148-150
  5. ^ Zachary, p. 218
  6. ^ Zachary, p. 239
  7. blogs.technet.com: Jeff Hughes, The Four Stages of NTFS File Growth (2009)
  8. a b STOP 7B When Not Updating File Systems for Windows NT 3.1. support.microsoft.com, accessed November 16, 2015
  9. a b c New possibilities and features of the NTFS 3.1 file system - page at Microsoft Help and Support ; As of December 1, 2007
  10. Microsoft Knowledge Base - Filenames are Case Sensitive on NTFS Volumes . Retrieved March 15, 2013.
  11. File systems in comparison - FAT32 vs. NTFS. In: Allround-PC.com , accessed on November 15, 2013.
  12. Documentation on the Kernel Transaction Manager (English)
  13. Alternatives to using Transactional NTFS. In: Microsoft.com. December 5, 2013, accessed on January 13, 2014 : "Microsoft strongly recommends developers investigate utilizing the discussed alternatives (or in some cases, investigate other alternatives) rather than adopting an API platform which may not be available in future versions of Windows. "
  14. Default cluster size for NTFS, FAT, and exFAT. KB 140365 (Revision: 9.1). In: http://support.microsoft.com/kb/ . Microsoft, July 12, 2013, accessed March 16, 2014 .
  15. ^ How NTFS Works
  16. MSDN: Naming Files, Paths, and Namespaces
  18. www.rodsbooks.com/gdisk/booting.html: Rod Smith, Booting from GPT (English)
  19. a b c Microsoft TechNet Working with File Systems
  20. ntfsprogs 2.0.0 release notes
  21. Alvares, Milind: Snow Leopard's hidden NTFS read / write support . October 2, 2009. Archived from the original on March 30, 2015. Retrieved July 30, 2015.