Windows File Systems - NTFS

NTFS and the MFT

NTFS was introduced in the Windows NT operating system and has been the native file system for Windows systems ever since. However it has some limitations and these are starting to hold it back when Windows Server is used for critical business systems.
In theory, an NFT filespace can be allocated up to 240TB, but tested capacities are much less than this. Disks are now supplied with multi-terabyte capacities and NTFS needs third party software to cope with them.
If NTFS disks or files become corrupt then it was necessary to run a chkdsk command with all systems down and this was time consuming on large disks and it was not really acceptable to have important business systems down for extended times. Windows 12 R2 introduced spot fixing for NTFS, an offline repair utility that is much faster than chkdsk and so has less impact on business systems. With spot fixing, a scan runs as a background task alongside other active programs and this scans the file system and logs the issues that it finds for later correction. You can then take the volume offline during a maintenance window and run Spotfix to sort out the corruptions logged by the scan. The actual downtime should just be a few seconds.
ReFS is a new file system that fixes these issues, see the link on the right. However ReFS is not intended to replace NTFS, the two file systems will run in tandem for the forseeable future.

Some NTFS features are -

  • Transaction logs exist to help recover from disk failures.
  • NTFS has the ability to control access at file level by setting permissions for directories and/or individual files.
  • NTFS files are not accessible from other operating systems such as DOS. This stops people hacking security by booting from a DOS floppy disk.
  • If the amount of data is less than about 2 KB, the data is actually stored in the directory entry itself, that's faster retrieval and space saving!
  • NTFS disk can span over several physical volumes, essential for large industrial strength applications.
  • NTFS uses a data retrieve technique called 'elevator seeking'. Data reads are sorted and read in track order, rather than in the order submitted. This means the reads heads aren't seeking back and forward over the disk, but read the IOs in sequence up the disk
  • The MFT directory is stored in the middle the disk, to reduce seek time to find files. You have to read the directory to find where the file is, Once located in the directory, your file is never more than half the disk away from the read heads.
  • NT will try to allocate data in a single contiguous extent. This also reduces seek time when reading the whole file.


In NTFS, all objects are files, even the metadata about files. This allows the file system to handle all objects consistently. The Master File Table (MFT) is the most important system file. It contains information about all the files on the volume. There is exactly one MFT per volume. There is also at least one entry in the MFT for every file on an NTFS volume. If the base file record is not big enough to hold all the information about a file, an extension record is created. The MFT file records contain all the information about a file, including its size, time and date stamps,permissions, data content, etc.
The MFT consists of a series of 1KB records, with Record 0 describing the MFT itself. Record 1 is a duplicate of Record 0 for resilience. The file descriptors are called attributes, Resident Attributes fit inside the MFT, while Non-resident Attributes are too big and are held in overflow records. Attributes include stuff like the archive bit, time stamps, file names (a file can have several names, including a short name and a long name), and the ACL or security data for the file. If the file is small enough then all the data held by that file can be contained within the MFT record. If a file is too big to fit into the MFT then the MFT data record points to an external cluster on disk. A badly fragmented file will need several MFT records to hold all the pointers to the bits of the file, so fragmentation degrades performance.

Directories are held in the MTF as file records, with small directories fully contained in the MTF, while large directories are organised into B-trees, with records pointing to external clusters for the rest of the data.
It is important that the MFT does not become fragmented, as this can affect system performance. NTFS will reserve space for the MFT, but if the rest of the disk fills up, this reserved space will be used. NTFS does not delete records from the MTF when files are deleted, but it does mark them as reusable.

If you allocate lots of small files on your disk, you will fill up the MFT before the disk fills up. If you allocate big files, you will run out of disk space before the MFT is full. You can change the amount of space reserved by NTFS for the MFT by updating the NTFS zone reservation parameter, by editing

HKEY-LOCAL-MACHINE\System\CurrentControlSet\Control\FileSystem Add Value name NtfsMftZoneReservation as a type REG-DWORD and set the data value to a number between 1and 4. The bigger the number, the more space that will be reserved for the MFT. Caution - Microsoft warn that before you make any change to the registry, you should take a backup, and be prepared for the system to crash.

The valid values are -

  • 1 - default 12.5%
  • 2 - 25%
  • 3 - 37.5%
  • 4 - 50%

Note that if you change this setting it will apply to all the disks on your server, and also it is best to set the parameter at disk creation time, as if it is increased after creation the MFT will become fragmented.

Reparse points were introduced with Windows 2000 storage subsystem. They provide 'hooks' into the file system that can be used by ISVs to add storage functionality.

NTFS Change Journal

Change Journal software was introduced with Windows 2000 operating system. It is used by functions that are only interested in processing new or changed files on a volume. Examples are backup, virus scanning, indexing services and auditing. A record is added to the Change Journal every time a file or directory is updated. Applications that need to find changed files can get their information from the Change Journal, they do not have to scan the entire volume. This can mean a considerable saving in I/O operations and time, especially if not many files have changed.

NTFS cluster sizes

The minimum size of a file in the NTFS file system is the size of a single cluster and files cannot share space within a cluster. The smaller the cluster size, the more efficiently a disk stores information, the bigger the cluster the better the performance as more data is moved per IO operation. The file system has limits on the number of clusters it can support so it chooses the default cluster size of the volume. The default cluster size can be overridden by a user, up to a maximum size of 64KB.
A Win2016 server can support volume sizes up to 256TB.

An NTFS partition consists of 4 sectors
The partition boot sector
Filesystem data
The MFT backup

NTFS Cluster Size Volume Size
4 KB 16TB
8 KB 32 TB
16 KB 64 TB
32 KB 128 TB
64 KB 256 TB