NTFS System (Metadata) Files

As I mentioned in the architectural overview, the NTFS file system stores virtually
all data, both user data and internal management data, in the form of files. The
most important of these are a set of special system files, which are also
called metadata files. The prefix "meta-" generally refers to something
"transcendent" or "beyond"--or merely self-referring. So "metadata files" are files
that contain data about data. And that's exactly what these files do. They contain
internal information (data) about the "real" data stored on the NTFS volume.

These metadata files are created automatically by the system when an NTFS
volume is formatted, and are placed at the beginning of the partition. Now,
explaining how these files work is a bit complicated. :^) Understanding their
location in an NTFS volume requires that I mention another key structure, the
NTFS Master File Table (MFT). The MFT is actually one of these metadata files,
but it also contains descriptions of the other metadata files, and in some cases
entire other metadata files. Yes, it's a bit confusing. :^) Reading the page on the
MFT will help you understand how it works, but in a nutshell, here's what happens:
the MFT contains a record describing every file and directory in an NTFS volume,
and if the file is small enough, its actual contents may be stored in the MFT itself.
Since the metadata files are just "files" to NTFS (albeit special ones), they too have
records in the MFT. In fact, the first 16 records of the MFT are reserved for
metadata files.

Phew, sorry about that, but hey, I didn't design this thing. :^) Actually, the system
is hard to explain, but it is logically consistent, and does work well. The table
below provides the important information about the metadata files, including their
English names, file names, MFT record numbers and a brief description of what
each does:

MFT
Metadata File
File Name Record Description
Name
#

This is the MFT itself. This seems to be a bit of a chicken-and-egg

problem--how can a record in the MFT contain the MFT? :^) It
Master File doesn't. This first MFT record contains descriptive
$MFT 0
Table (MFT) information about the MFT. This is consistent with how NTFS
works--since the MFT itself is just "a file", so it also needs a record
in the MFT!

This is a mirror of the first 16 records of the real Master File Table.
Master File It is stored either in the middle of the partition (for Windows NT
Table 2 3.5 and earlier) or the end of the partition (for Windows NT 4.0
(MFT2) or $MFTMirr 1 and later). The mirror is a "backup" that is used to ensure that the
Master File first few records of the MFT, which of course describe the
Table Mirror metadata files themselves, can be accessed in case of a disk error
on the original MFT.
 The transaction logging file for the volume. This is part of NTFS's
Log File $LogFile 2
file system recoverability feature.

Contains key information about the volume (partition) itself, such

Volume
$Volume 3 as its name, NTFS version, creation time, and so on. See the
Descriptor
complete list of NTFS file attributes for more information.

This table contains the names and descriptions of the various types
Attribute
of NTFS file attributes used on the volume. (It doesn't contain the
Definition $AttrDef 4
attributes themselves, but rather descriptions of what the attributes
Table
mean. Remember--metadata.)

Root
"." (single
Directory / 5 This is a pointer to the root directory or folder of the volume.
period)
Folder

Cluster
Contains a "map" showing which clusters on the volume are used
Allocation $Bitmap 6
and which are available for use.
Bitmap

This record contains a copy of the volume boot code (or a pointer
Volume Boot
$Boot 7 to it). The volume boot code is also found in the volume boot
Code
sector.

A list of all clusters on the volume that have been marked as "bad"
Bad Cluster
$BadClus 8 (meaning, an error was detected on the volume somewhere in those
File
clusters, so the file system wants to be sure not to use them again.)

Table containing quota information, if disk quotas are being used

Quota Table $Quota 9
on the volume. Only used for NTFS 5.0 or later.

Table containing information for converting file names to

Upper Case
$UpCase 10 the Unicode (16-bit) file naming system for international
Table
compatibility.

Note: Records 11 through 15 in the MFT (the 12th through 16th records,
since MFT records are numbered starting from zero) are reserved for future
metadata files.

The elegance of the metadata system is that by storing internal information in files,
it is possible to expand on the capabilities of the file system--changing "dedicated"
internal structures is more complicated. Also, these files do not need to be stored in
a specific location on the hard disk, so if a specific area of the hard disk is
damaged, they can be moved.