2024-12-23

NTFS

How to resolve NTFS Partitions Problems

DATARECOVERYUNION.COM09 mins

ntfs-partitions The first sector of NTFS partitions is used as the partition boot sector. It contains the information which allows the OS to read the partition. Without it, the partition cannot be accessed.

NTFS has a backup copy of the boot sector on the last sector of the partition which can allow recovery programs to restore it. The FAT also has the boot sector, and resides on the first sector of this partition. The difference is that FAT does not have a backup copy of this information; Recovery is much more difficult than NTFS.

The first file stored on an NTFS partition is called the Master File Table (MFT) which is essentially a listing of the names, properties and locations of all the other files in this partition. This is referenced by the operating system to access individual files.

NTFS stores a backup copy of this file. Data restoration software can access or restore a copy of the MFT in order to access files on the partition.

FAT partitions with something similar, called predictably enough the File Allocation Table (FAT). The FAT is also backed up on the disk, and can be restored by software. The major disadvantage of the FAT as compared to the MFT is that it needs to be located on a specific area of the partition to function, so if that area of the disk is damaged, recovery will become more difficult.

When a file is deleted (removed from the recycle bin within Windows), both file systems simply mark the file as deleted. The data is not actually removed from the hard drive, but rather the space it takes up on the disk is now considered to be free. Consequently, if you delete a file accidentally, you have an excellent chance of being able to restore it provided you do not write more information to the disk.

For example, If you two NTFS partitions on the effected disk. When you ran FDISK, it wrote garbage information over certain areas of this disk, including areas of both partitions. As a result, the first partition (the one with your article on it) had lost its partition boot sector, meaning it could not be accessed normally by an operating system. The second partition had merely had crucial system files overwritten, and was unbootable, but still can accessible once you transferred the disk to another computer.

There is a way to fix all of this, and get the data back

One rule to remember when you have lost data, please don’t write anything more to the affected hard drive!

If you have deleted a partition by accident, do not create another partition, just leave it blank.
If you have deleted files from the recycling bin that you realize you need, do notsave anything to the drive. The reason is that hard drives do not actually erase anything, not data or partitions. When you erase a file from the operating system, it is just marked on the drive as having been deleted. When the system needs to store more data on the drive, it will consider files on the drive marked ‘deleted’ as being empty space, and cheerfully copy over them. If that happens then you’re in big trouble.

Another rule applies twice over for partitions; since partition information just presents the operating system with a way of addressing the space available on the drive. If you wipe out a partition everything from it will seem to be gone.

If there is no partition information, no data can be read by the operating system. This does not mean that your data it is not there however, only that means you can’t see it. Data-recovery programs have no such handicap.

What you need to do was to allow FDISK to test the integrity of the drive, which it does by writing a pattern of data to certain areas. Of course, in the case, many of these areas contained partition information and critical system files. The result was one missing partition, due to a destroyed boot sector, and one unbootable (but still readable) XP installation.

How.
First and best thing to do in a data-loss situation is to make sure no more data is written to the drive. Obviously, if you have just the one partition and it’s fried, you can’t boot normally to the operating system. The best option in this situation is to transfer the drive to another computer, preferably one using the same file-system as your damaged partition (such as, the same operating system, or a newer version). See the PCSTATS Beginners Guides sectionfor information on how to move your hard drive to another computer.

Transferring the HDD to another computer has the dual benefit of preventing the drive from being written to accidentally, and potentially allowing you to retrieve information from the disk just by using Windows Explorer to look through file structures.

If you have damaged or erased essential operating system files, but the partition information is still intact Windows will not boot. The HDD can still be read from a different operating system which is one way out of the doom and gloom.

All the processes described from here on are strictly for resolving software issues with your data, like accidentally deleting partitions or files. If your hard drive has a physical problem, if it is making strange noises, shaking, rattling or smoking, nothing here will apply. Turn off your computer, unplug the drive and call a data recovery service if your data are vital.

Read More

NTFS File System Frequently Asked Questions Part I

DATARECOVERYUNION.COM07 mins

Q: Is the boot limitation for NTFS still 7.87GB?

A: No. NTFS volume size limit is 2TB.

Q: Where can I get a lot of details about the NTFS encryption and security ?

A: Security (NTFS) and Encryption (NTFS,NTFS5) are wide topics.

You can get a lot of information about it on Microsoft’s MSDN Web Site (http://msdn.microsoft.com)

Security Topics: File Security and Access Rights

Encryption Topics: File Encryption , Encryption, Sparseness, and Reparse Points

Q: How do you lock files from other machine users on NTFS file system ?

A: NTFS has built-in security feature. Owner of the object can assign certain rights to certain users to restrict access to the object.

If file or folder is located on NTFS, just go to its Properties in Windows Explorer and on the Security tab add users being able access the object, and then remove Everyone user from users list, or restrict its rights.

Q: For Windows 2000 Professional using NTFS — Must All partitions be NTFS or can a FAT32 partition be functional as well?

A: Windows 2000 Professional as long as other Windows 2000 and XP family operating systems have full support for FAT32 and FAT16 file systems, as long as CDFS, HPFS, etc.

Operating system communicates with file system via logical level Win32 API that, in turn, redirects function calls to physical level (file system drivers), so if proper file system driver is installed, operating system can access and work with file system properly.

Drivers for NTFS, NTFS5, FAT12, FAT16, FAT32, CDFS are always installed when you install Windows 2000 / XP.
Drivers for NTFS, FAT12, FAT16, CDFS are always installed when you install Windows NT, there is no built-in driver for FAT32 in Windows NT.

Q: How do you format a blank hard disk drive to NTFS or NTFS5 ?

A: There are no standard utilities to format HDD to NTFS from DOS.

However there are solutions:

  • Attach HDD to another machine having Windows NT installed if you want to format to NTFS, or to Windows 2000 / XP if you want to format it to NTFS5. Then format drive using Disk Manager utility that is included in OS.
  • You can start Windows NT / 2000 / XP installation using bootable CD-ROM. On first steps of installation you will be asked about target location and you will be suggested to format the partition to NTFS. Go this way, and after format is completed, just cancel the installation process.

Q: Is there any problem with my games if I installed it under NTFS filesystem?

A: NTFS file system itself cannot cause problems to any software including games, because NTFS is just a way of data storage.

Software in Windows accesses files via upper-level Win32 API. Win32 API, in turn, redirects function calls to the drivers for the particular file system (NTFS/FAT/CDFS, etc.). Thus software, generally speaking, is not aware of file system it is installed on.

What could cause problems with games is Operating System itself. As long as Windows NT / 2000 / XP are more secure operating systems, and do not support 16-bit device drivers and real mode, some of games that work well under MS-DOS, Windows 95 / 98/ ME might not work under Windows NT / 2000 / XP.

Q: When Data is written to the NTFS disk at what position does in start the write? EG Assuming a file has been deleted (and deleted from the recycle bin if applicable) would it first overwrite this file, or would it start at the next totally unused cluster?

A: It depends on many factors including file system fragmentation, free space, etc.

In most cases it would start with a next totally unused cluster.

Q: When deleting a file at work from a HDD what is the best way to ensure that the file cannot be recovered? ie that the data no longer exists on the drive, rather than just resetting the flag of the relevant file/cluster? Is there any way NTFS will do this? Registry hacks e.t.c?

A: There are no standard mechanisms for this.

Please use third party privacy software (such as Disk Wiper feature in ZDelete) to eliminate unused MFT entries and overwrite clusters containing deleted data.

Read More

NTFS File System Frequently Asked Questions Part II

DATARECOVERYUNION.COM07 mins
Q: Is it possible to convert a FAT32 Hard Drive to NTFS without losing all data on the drive? I like to change from FAT32 to NTFS, my operating system is Windows XP PRO, how can I do that? Without the lost of my programs?

A: Standard Windows utility that is called CONVERT serves this purpose

Just go to the Command Prompt and execute the command:

	C:\> CONVERT  C:  /fs:ntfs

Where C: is a name of the drive you want to convert.

After machine re-boot conversion process will start and you’ll have your FAT32 converted to NTFS without of data loss.

Q: How does NTFS compared to FAT32 in Windows XP, and which is faster?

A: NTFS has much more built-in features than FAT, so generally it is a bit slower.

However it depends on many factors such as cluster size, average file size, etc.

For example, NTFS can keep small files inside MFT entry, so if the file size is less than cluster size, most likely it will be accessed much faster on NTFS than on FAT.

Generally speaking the performance of NTFS on large volumes is higher than performance of FAT32. NTFS performance on small volumes is lower than performance of FAT/FAT32.

Q: How can I copy files from a hard drive formatted to NTFS, to a FAT32 hard drive ?

A: You probably asking about Windows NT that does not support FAT32.

There are third party FAT32 drivers for NTFS, or you can use FREE NTFS Reader to copy files in DOS environment. Just make sure that your DOS supports FAT32. You can use Bootable Floppy Creator to prepare such a floppy containing DOS and NTFS Reader for DOS.

Q: Which version of NTFS is installed on my Windows XP system ?

A: The following versions are currently available:

  • NTFS v1.2 on Windows NT
  • NTFS v3.0 on Windows 2000
  • NTFS v3.1 on Windows XP
Q: When I use the following command “FORMAT” on a volume (Windows XP) what is really written on this volume ?

A: Clean Master File Table (MFT) containing some system records is created for the volume.

Q: I am using a 249 megabyte drive as a backup drive on my xp system. I have it formatted in NTFS and compressed, yet the size of the drive is still the same as before I compressed it. Why?

A: Actual disk size cannot be changed. By applying compressed attribute for the volume you just ordered operating system to try to compress any object that will be placed there.

If object that is placed onto the volume can be compressed, operating system compresses it and it takes less space on the drive than uncompressed one. Thus more free space is left on the drive for other data.

Q: The files I place on the compressed drive are only compressed from 1.15MB to 1.14 MB , is it normal this should be only 100kb of compression per MB?

A: Compression on NTFS uses modified LZ77 algorithm. It is very fast but not always effective.

If works pretty well for the files/documents containing a number of repeating sequences of symbols. Example of such files types: text files, RTF, BMP, HTML files, etc…

For other file types, such as binaries, GIF, JPG, ZIP files, etc. this compression algorithm is not useful so that these files might not be compressed at all.

Q: Could I read file from my pc running windows XP with NTFS5 file system, from a machine under windows 95 on the same network?

A: Surely you can do it, if you configure Networking properly, i.e. create Network Share on WinXP for the folder where file is located and assign proper access rights to the share.

After performing these procedures if you can lookup WinXP machine across the Network you’ll be able to see this network share from Windows 95 and access files inside.

Q: Which is better? NTFS or NTFS5?

A: As for advances in technologies the latest versions are usually better than previous ones.

In addition to all NTFS features, NTFS5 has support for Encryption, Disk Quotas, Sparse Files, Reparse Points, Volume Mount Points.

Read More

How NTFS File System Works: NTFS Physical Structure

DATARECOVERYUNION.COM04 mins

The following information describes how clusters and sectors are organized on an NTFS volume, how the boot sector on the volume determines the file system, and how the Master File Table (MFT) organizes structures on the volume.

Clusters and Sectors on an NTFS Volume

A cluster (or allocation unit) is the smallest amount of disk space that can be allocated to hold a file. All file systems used by Windows Server 2003 organize hard disks based on cluster size, which is determined by the number of sectors (units of storage on a hard disk) that the cluster contains. For example, on a disk that uses 512-byte sectors, a 512-byte cluster contains one sector, whereas a 4-kilobyte (KB) cluster contains eight sectors.

Computers access certain sectors on a hard disk during startup to determine which operating system to start and where the partitions are located. The data stored on these sectors varies depending on the computer platform.

Sequence of Clusters on an NTFS Volume

Clusters on an NTFS volume are numbered sequentially from the beginning of the partition into logical cluster numbers. NTFS stores all objects in the file system using a record called the Master File Table (MFT), similar in structure to a database.

On NTFS volumes, clusters start at sector zero; therefore, every cluster is aligned on the cluster boundary. Contiguous clusters for file storage allow for faster processing of a file.

Note: Floppy disks do not use NTFS and are always formatted as FAT.

Limitations of Cluster Sizes on an NTFS Volume

Because NTFS uses different cluster sizes depending on the size of the volume, each file system has a maximum number of clusters it can support. The smaller the cluster size, the more efficiently a disk potentially stores information because unused space within a cluster cannot be used by other files. And the more clusters a file system supports, the larger the volumes you can create and format by using a particular file system. NTFS uses smaller cluster sizes, which makes it a more efficient file organization structure.

The table Default NTFS Cluster Sizes lists NTFS volume and default cluster sizes.

Default NTFS Cluster Sizes

Volume SizeNTFS Cluster Size
7 megabytes (MB)–512 MB512 bytes
513 MB–1,024 MB1 KB
1,025 MB–2 GB2 KB
2 GB–2 terabytes4 KB
Read More

How NTFS File System Works: NTFS Architecture

DATARECOVERYUNION.COM04 mins

NTFS File System A file system is a required part of the operating system that determines how files are named, stored, and organized on a volume. A file system manages files and folders, and the information needed to locate and access these items by local and remote users.

During the format of a volume you can choose the type of file system for the volume. When you choose the NTFS file system, the formatting process places the key NTFS file data structures on the volume, regardless of whether it is a basic volume or dynamic volume.

During format and setup of a volume file system on a hard disk, a master boot record (MBR) is created. The MBR contains a small amount of executable code called the master boot code as well as a partition table for the disk. When a volume is mounted, the MBR executes the master boot code and transfers control to the boot sector on the disk, allowing the server to boot the operating system on the file system of that specific volume.

Note: The partition table contains a number of fields used to describe the partition. One of these fields is the System ID field, which defines the file system, such as NTFS, on the partition. For NTFS volumes, the system ID is 0x07.

The figure NTFS Architecture shows the architecture of this process.

NTFS Architecture

NTFS File System

The following table describes the components of an NTFS file system.

NTFS Architecture Components on an x86-based System

ComponentComponent Description
Hard diskContains one or more partitions.
Boot sectorBootable partition that stores information about the layout of the volume and the file system structures, as well as the boot code that loads Ntdlr.
Master Boot RecordContains executable code that the system BIOS loads into memory. The code scans the MBR to find the partition table to determine which partition is the active, or bootable, partition.
Ntldlr.dllSwitches the CPU to protected mode, starts the file system, and then reads the contents of the Boot.ini file. This information determines the startup options and initial boot menu selections.
Ntfs.sysSystem file driver for NTFS.
Ntoskrnl.exeExtracts information about which system device drivers to load and the load order.
Kernel modeThe processing mode that allows code to have direct access to all hardware and memory in the system.
User modeThe processing mode in which applications run.
Read More

Identifying FAT16, FAT32, and NTFS File Systems and partitions

DATARECOVERYUNION.COM03 mins

File systems How can I tell what type of file system (FAT16, FAT32, NTFS) my drive is formatted in?

To identify what type of file system the drive is formatted in:

  1. Click on the Start button and select Computer if using Windows Vista, My Computer if using Windows XP or 2000, or Windows Explorer if using Windows Me or 98.
  2. Right-click on the drive letter you want to check.
  3. Click on the Properties option from the pull down menu. A window will appear with the type of file system you have. If you do not see any information regarding FAT16, FAT32, or NTFS in the window that means the drive is formatted in FAT16.

Notes:

  1. Partitions created with the FAT16 file system have a size limitation of 2,048 MB (2.1 GB).
  2. Microsoft first started supporting the FAT32 file system with the release of Windows 95B (a.k.a. OSR2), circa 1997.
  3. When booting from Windows 95A, a Windows 95A startup disk, or any version of MS-DOS, a FAT32 partition will appear as a NON-DOS partition in FDISK.
  4. FAT32 partitions have a theoretical partition size limitation of 2 terabytes (TB). However, new partitions created by either Windows Vista, Windows XP, or Windows 2000 will limit their size to 32 gigabytes (GB). To create partitions greater than 32 GB under Windows Vista, XP, or 2000, you will need to format them using the NTFS file system (or create multiple FAT 32 partitions for drives greater than 32GB).
  5. Windows Vista, Windows XP, Windows 2000, and Windows NT all support the NTFS file system. Windows 2000, XP, and Vista can both support the FAT32 and NTFS file systems, however Windows Vista cannot be installed on a FAT32 partition. Windows NT cannot support FAT32 partitions.
  6. MaxBlast and DiscWizard allow FAT32 partitioning of a drive larger than 32GB.
Read More

File Systems

DATARECOVERYUNION.COM010 mins

Different operating systems use different file systems. Some are designed specifically to work with more than one, for compatibility reasons; others work only with their own file system. This section takes brief look at the most common operating systems in use on the PC and the file systems that they use. This enables you to know what parts of the rest of the discussion on file systems is most relevant to your situation.

The most common name of the file system, “FAT”, is problematic, even though it is still often used. The first FAT file system used 12-bit file allocation tables; this was later expanded to 16 bits, and became the most common file system implementation for hard disks from the late 1980s to the late 1990s. To distinguish these versions of FAT from the 32-bit successor called FAT32, the older FAT variants are now sometimes called FAT12 or FAT16. However, you will still hear just “FAT” used a lot; if so, you need to find out what specifically is being referred to, if it matters in that particular context. For more elaboration on the differences between FAT12, FAT16 and FAT32.

Throughout my discussion of file systems, I have referred to the FAT family of file systems. This includes several different FAT-related file systems, as described here. The file allocation table or FAT stores information about the clusters on the disk in a table. There are three different varieties of this file allocation table, which vary based on the maximize size of the table. The system utility that you use to partition the disk will normally choose the correct type of FAT for the volume you are using, but sometimes you will be given a choice of which you want to use.

Since each cluster has one entry in the FAT, and these entries are used to hold the cluster number of the next cluster used by the file, the size of the FAT is the limiting factor on how many clusters any disk volume can contain. The following are the three different FAT versions now in use:

  • FAT12: The oldest type of FAT uses a 12-bit binary number to hold the cluster number. A volume formatted using FAT12 can hold a maximum of 4,086 clusters, which is 2^12 minus a few values (to allow for reserved values to be used in the FAT). FAT12 is therefore most suitable for very small volumes, and is used on floppy disks and hard disk partitions smaller than about 16 MB (the latter being rare today.)
  • FAT16: The FAT used for most older systems, and for small partitions on modern systems, uses a 16-bit binary number to hold cluster numbers. When you see someone refer to a “FAT” volume generically, they are usually referring to FAT16, because it is the de facto standard for hard disks, even with FAT32 now more popular than FAT16. A volume using FAT16 can hold a maximum of 65,526 clusters, which is 2^16 less a few values (again for reserved values in the FAT). FAT16 is used for hard disk volumes ranging in size from 16 MB to 2,048 MB. VFAT is a variant of FAT16.
  • FAT32: The newest FAT type, FAT32 is supported by newer versions of Windows, including Windows 95’s OEM SR2 release, as well as Windows 98, Windows ME and Windows 2000. FAT32 uses a 28-bit binary cluster number–not 32, because 4 of the 32 bits are “reserved”. 28 bits is still enough to permit ridiculously huge volumes–FAT32 can theoretically handle volumes with over 268 million clusters, and will support (theoretically) drives up to 2 TB in size. However to do this the size of the FAT grows very large; see here for details on FAT32’s limitations.

    • Here’s a summary table showing how the three types of FAT compare:

     

    Virtual FAT (VFAT)
    Microsoft incorporated several enhancements into the disk management capabilities of Windows 95. Access to the file system can be done using high-speed, protected-mode, 32-bit drivers, or for compatibility, the older DOS 16-bit routines. Support was added for long file names and also for better control over such matters as disk locking, so utilities could access the disk in “exclusive mode” without fear of other programs using it in the meantime.

    Despite the new name and new capabilities, VFAT as a file system is basically the same as FAT is. Most of the new capabilities relate to how the file system is used, and not the actual structures on the disk. VFAT handles standard FAT16 partitions, and under Windows 95 OSR2 or later, FAT32 partitions as well. The only significant change in terms of actual structures is the addition of long file names. Even here, VFAT supports these using what is basically a hack, as opposed to anything really revolutionary.

    With the exception of the long file names, Windows 95, using VFAT, shares the same logical disk structures as DOS or Windows 3.x using FAT.

    NTFS
    The NTFS file system used by Windows NT is completely different from, and incompatible with, the FAT file system that is used by DOS and the other Windows varieties. NTFS can only be used by Windows NT–other operating systems do not have the ability to use a disk formatted with NTFS.
    NTFS is in virtually every way, far superior to FAT. It is a robust, full-featured system that includes file-by-file compression, full permissions control and attribute settings, transaction-based operation, and many more features. It also does not have the problems with cluster sizes and hard disk size limitations that FAT does, and has other performance-enhancing features such as RAID support.

    The only way that NTFS is not superior to FAT is in compatibility with older software. NTFS is not nearly as widely-used as FAT, for this reason. For now I am not including a full examination of NTFS on the site, but I may add this at a later time if it seems warranted.

    Read More

    NTFS Master File Table (MFT)

    DATARECOVERYUNION.COM04 mins

    Each file on an NTFS volume is represented by a record in a special file called the master file table (MFT). NTFS reserves the first 16 records of the table for special information. The first record of this table describes the master file table itself, followed by a MFT mirror record. If the first MFT record is corrupted, NTFS reads the second record to find the MFT mirror file, whose first record is identical to the first record of the MFT. The locations of the data segments for both the MFT and MFT mirror file are recorded in the boot sector. A duplicate of the boot sector is located at the logical center of the disk.

    The third record of the MFT is the log file, used for file recovery. The seventeenth and following records of the master file table are for each file and directory (also viewed as a file by NTFS) on the volume.

    Figure provides a simplified illustration of the MFT structure:

    Figure 5-2 MFT Structure

     

    The master file table allocates a certain amount of space for each file record. The attributes of a file are written to the allocated space in the MFT. Small files and directories (typically 1500 bytes or smaller), such as the file illustrated in next figure, can entirely be contained within the master file table record.

    Figure 5-2 MFT Record for a Small File or Directory:

     

    This design makes file access very fast. Consider, for example, the FAT file system, which uses a file allocation table to list the names and addresses of each file. FAT directory entries contain an index into the file allocation table. When you want to view a file, FAT first reads the file allocation table and assures that it exists. Then FAT retrieves the file by searching the chain of allocation units assigned to the file. With NTFS, as soon as you look up the file, it’s there for you to use.

    Directory records are housed within the master file table just like file records. Instead of data, directories contain index information. Small directory records reside entirely within the MFT structure. Large directories are organized into B-trees, having records with pointers to external clusters containing directory entries that could not be contained within the MFT structure.

    Read More