NTFS Filesystem

NTFS Filesystem

NTFS (New Technology File System) is the default filesystem for Windows. JNode implements a read-only NTFS driver with support for the Master File Table (MFT), B+-tree directory indexes, non-resident attributes with data runs, and security descriptors.

Architecture

The driver is organized in layers: NTFSFileSystem provides the high-level API, NTFSVolume manages the on-disk volume (boot sector, cluster I/O), MasterFileTable provides MFT record access, and FileRecord represents individual file/directory entries. Attributes (stored in records) handle both resident and non-resident data.

NTFSFileSystem
  └── NTFSVolume
        ├── BootRecord          — Volume parameters (cluster size, MFT location, etc.)
        ├── MasterFileTable     — Central metadata table (MFT records 0-N)
        └── FileRecord[]        — Per-file records in the MFT
              └── NTFSAttribute — Attribute types (STANDARD_INFORMATION, FILE_NAME, DATA, etc.)
                    ├── NTFSResidentAttribute     — Small attributes stored inline in the record
                    └── NTFSNonResidentAttribute — Large attributes mapped via data runs

Key Classes

Class	Purpose
NTFSFileSystem	Entry point; extends AbstractFileSystem<FSEntry>. Provides root directory, volume name/space, flush.
NTFSVolume	Mounted volume; reads boot sector, manages cluster I/O, caches MFT and root directory.
BootRecord	Boot sector parser; extracts clusterSize, mftCluster, mftRecordSize, serialNumber, etc.
MasterFileTable	MFT access. Inner class SystemFiles defines indices for reserved system records (MFT=0, MFTMIRR=1, LOGFILE=2, VOLUME=3, ROOT=5, BITMAP=6, etc.).
FileRecord	A single MFT record for a file or directory. Contains StandardInformationAttribute, FileNameAttribute, data attributes, and optionally an AttributeListAttribute for multi-record files.
NTFSAttribute	Base attribute class. Inner class Types defines attribute type IDs (0x10 STANDARD_INFORMATION, 0x20 ATTRIBUTE_LIST, 0x30 FILE_NAME, 0x80 DATA, 0x90 INDEX_ROOT, 0xA0 INDEX_ALLOCATION, 0xB0 REPARSE_POINT, etc.). Factory method getAttribute() instantiates the appropriate subclass.
NTFSResidentAttribute	Attribute data stored directly within the MFT record (used for small files/directories).
NTFSNonResidentAttribute	Attribute data stored in external clusters, mapped by a chain of data runs. Handles sparse allocation and compressed extents via the cluster compression algorithm.
DataRun	A (offset, length) pair locating a contiguous extent of clusters on disk. Composed into runlists by NTFSNonResidentAttribute.
NTFSIndex	B+-tree directory index built from IndexRootAttribute + IndexAllocationAttribute (indexed via IndexBlock). IndexEntryIterator iterates over directory entries.
SecurityDescriptorStream	Maps SIDs to Windows security descriptors. Supports standard Windows well-known SIDs.
LogFile	Transaction logging support. Wraps the $LOGFILE system file. OperationCode enumerates logged operation types.

MFT Record Layout

Each MFT record (default 1024 bytes) contains:

1. Record header — magic FILE, update sequence offset/size, current/last LSN, record number, base record reference, attribute offset, flags, used/allocated size.
2. Attributes — variable-length, type-coded. Resident attributes store data inline; non-resident attributes store a data runlist pointing to external clusters.
3. Update sequence array — Used for sector-size integrity (each protected sector has a 2-byte checksum at the end).

Data Runs

Non-resident attributes map file logical clusters to physical disk clusters via a runlist. Each DataRun encodes:

• Length: number of clusters in the extent
• Offset: relative or absolute cluster number (delta-compressed; the first run is absolute, subsequent runs are relative to the previous run's ending cluster)

Directory Indexing

Directories use a B+-tree index (IndexRootAttribute at the root of the tree, IndexAllocationAttribute for overflow nodes). Each IndexEntry holds a FileNameAttribute key and a reference to the corresponding MFT record. Iteration uses DirectoryEntryIterator.

Related Pages

• Filesystem-Layer — How filesystems integrate with JNode's VFS and block device layer
• VFS-Layer — In-memory filesystem, mount mechanism, path resolution
• Block-Device-Layer — Block I/O APIs that NTFS sits atop
• Ext2-Ext3-Filesystem — ext2/ext3 driver for comparison
• FAT-Filesystem — FAT driver for comparison
• HFS+-Filesystem — HFS+ driver for comparison
• ISO9660 — Boot CD-ROM filesystem