Editing NTFS (section)

{{Short description|Proprietary file system developed by Microsoft}}
{{Infobox file system
| developer = [[Microsoft]]
| name = NT File System<ref name="karresand2019">{{Cite journal| doi = 10.1016/j.diin.2019.04.018| issn = 1742-2876| volume = 29| pages = –51–S60| last1 = Karresand| first1 = Martin| last2 = Axelsson| first2 = Stefan| last3 = Dyrkolbotn| first3 = Geir Olav| title = Using NTFS Cluster Allocation Behavior to Find the Location of User Data| journal = Digital Investigation| date = 2019-07-01| s2cid = 199004263| doi-access = free| hdl = 11250/2631756| hdl-access = free}}</ref>
| full_name = NT File System<ref name="ntfs_abbr"/>
| variants = 
| introduction_date = {{Start date and age|1993|07|27}}
| partition_id = {{mono|[[Partition type#PID 07h|0x07]]}} ([[Master boot record|MBR]])<br />{{mono|[[Basic Data Partition|EBD0A0A2-B9E5-4433-87C0-68B6B72699C7]]}} ([[GUID Partition Table|GPT]])
| directory_struct = [[B-tree]] variant<ref name="How NTFS Works">{{cite web|title=How NTFS Works|url=https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc781134(v=ws.10)|work=Windows Server 2003 Technical Reference |date=8 October 2009 |publisher=Microsoft|access-date=25 January 2025}}</ref><ref>{{cite web|access-date=2019-05-13|title=B*Trees – NTFS Directory Trees – Concept – NTFS Documentation|url=https://flatcap.org/linux-ntfs/ntfs/concepts/tree/index.html|website=flatcap.org|archive-date=2019-05-13|archive-url=https://web.archive.org/web/20190513230245/https://flatcap.org/linux-ntfs/ntfs/concepts/tree/index.html|url-status=dead}}</ref>
| file_struct = Bitmap
| bad_blocks_struct = $BadClus (MFT Record)
| max_volume_size = 2<sup>64</sup> [[Data cluster|clusters]] − 1 cluster (format);<br />256{{nbsp}}[[terabyte|TB]]{{efn|name=units|1={{CompUnits|KBMBGBTBPBEB}}}} − 64{{nbsp}}[[kilobyte|KB]]{{efn|name=units}} ([[Windows 10]] version 1703, [[Windows Server 2016]] or earlier implementation)<ref name="How NTFS Works"/><br />8{{nbsp}}[[petabyte|PB]]{{efn|name=units}} − 2{{nbsp}}[[megabyte|MB]]{{efn|name=units}} (Windows 10 version 1709, [[Windows Server 2019]] or later implementation)<ref name="MS-FSA_id_1" />
| max_file_size = 16{{nbsp}}[[exabyte|EB]]{{efn|name=units}}&nbsp;− 1{{nbsp}}[[kilobyte|KB]] (format);<br />16{{nbsp}}[[terabyte|TB]]&nbsp;− 64{{nbsp}}[[kilobyte|KB]] ([[Windows 7]], [[Windows Server 2008 R2]] or earlier implementation)<ref name="How NTFS Works"/><br />256{{nbsp}}[[terabyte|TB]]&nbsp;− 64{{nbsp}}[[kilobyte|KB]] ([[Windows 8]], [[Windows Server 2012]] or later implementation)<ref name="MS-FSA">{{cite web |url= https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fsa/4e3695bd-7574-4f24-a223-b4679c065b63 |title= Appendix A: Product Behavior |work= [MS-FSA]: File System Algorithms |publisher= Microsoft |date= 14 November 2013 |access-date= 2012-09-21}}</ref><br />8{{nbsp}}[[petabyte|PB]] − 2{{nbsp}}[[megabyte|MB]] (Windows 10 version 1709, [[Windows Server 2019]] or later implementation)<ref name="MS-FSA_id_1" />
| max_files_no = 4,294,967,295 (2<sup>32</sup>−1)<ref name="How NTFS Works" />
| max_filename_size = 255 [[UTF-16]] code units<ref name="ntfsdoc">{{cite web |url= http://dubeyko.com/development/FileSystems/NTFS/ntfsdoc.pdf |archive-url=https://ghostarchive.org/archive/20221009/http://dubeyko.com/development/FileSystems/NTFS/ntfsdoc.pdf |archive-date=2022-10-09 |url-status=live |title= NTFS Documentation |first1= Richard |last1= Russon |first2= Yuval |last2= Fledel |access-date= 2011-06-26}}</ref>
| dates_recorded = Creation, modification, POSIX change, access
| date_range = 1 January 1601 – 14 Sept 30828 (File times are 64-bit positive signed numbers<ref>{{cite web |url=https://learn.microsoft.com/en-us/windows/win32/api/minwinbase/ns-minwinbase-systemtime  |title=SYSTEMTIME structure (minwinbase.h) |publisher=Microsoft |date=October 5, 2021 |access-date=January 7, 2024}}</ref> counting 100-nanosecond intervals (ten million per second) since 1601, which is more than 32,000 years)
| date_resolution = 100 ns
| forks_streams = Yes (see {{section link||Alternate data stream (ADS)}} below)
| attributes = Read-only, hidden, system, archive, not content indexed, off-line, temporary, compressed, encrypted
| file_system_permissions = [[Access Control List|ACLs]]
| compression = Per-file, [[LZ77]] ([[Windows NT 3.51]] onward)
| encryption = Per-file,<br />[[DESX]] ([[Windows 2000]] onward),<br />[[Triple DES]] ([[Windows XP]] onward),<br />[[Advanced Encryption Standard|AES]] (Windows XP Service Pack 1, [[Windows Server 2003]] onward)
| OS = [[Windows NT 3.1]] and later<br />[[Mac OS X 10.3]] and later (read-only)<br />[[Linux kernel]] version 2.6 and later<br />Linux kernel versions 2.2–2.4 (read-only)<br />[[FreeBSD]]<br />[[NetBSD]]<br/>[[OpenBSD]] (read-only)<br />[[ChromeOS]]<br />[[Oracle Solaris|Solaris]]<br />[[ReactOS]] (read-only)
| filename_character_set = {{Plainlist|
* In [[Win32]] namespace: any [[UTF-16]] code unit (case-insensitive) except <code>/\:*"?&lt;&gt;&#124;</code> as well as [[null character|NUL]]<ref name="ntfsdoc"/>
* In [[POSIX]] namespace: any [[UTF-16]] code unit (case-sensitive) except <code>/</code> as well as [[null character|NUL]]
  }}
| introduction_os = [[Windows NT 3.1]]
| single_instance_storage = Yes ([[Windows Server 2012]])<ref name="singleinstancestorage">{{cite web |url= https://www.techrepublic.com/blog/the-enterprise-cloud/windows-server-8-data-deduplication-what-you-need-to-know/ |title= Windows Server 8 data deduplication |author= Rick Vanover |date= 14 September 2011 |access-date= 2011-12-02 |archive-date= 2016-07-18 |archive-url= https://web.archive.org/web/20160718150957/http://www.techrepublic.com/blog/the-enterprise-cloud/windows-server-8-data-deduplication-what-you-need-to-know/ |url-status= dead }}</ref>
}}
'''NT File System''' ('''NTFS''') (commonly called ''New Technology File System'') is a proprietary [[journaling file system]] developed by [[Microsoft]] in the 1990s.<ref>{{cite book |doi=10.1007/978-1-84628-732-9_6 |chapter=The New Technology File System |title=Forensic Computing |date=2007 |pages=215–275 |isbn=978-1-84628-397-0 }}</ref><ref>{{Cite web |last=Weiss |first=David |date=2022-08-01 |title=What Is NTFS and How Does It Work? |url=https://www.datto.com/blog/what-is-ntfs-and-how-does-it-work/ |access-date=2024-08-14 |website=Datto |language=en-US}}</ref><ref name="ntfs_abbr">{{cite web |url=https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-efsr/230807ac-20be-494f-86e3-4c8ac23ea584 |title=Glossary |work=[MS-EFSR]: Encrypting File System Remote (EFSRPC) Protocol |publisher=Microsoft |date=14 November 2013}}</ref>

It was developed to overcome scalability, security and other limitations with [[File Allocation Table|FAT]].<ref>{{cite book |doi=10.1016/B978-0-12-804449-0.00004-X |chapter=Data Hiding Under Windows® OS File Structure |title=Data Hiding Techniques in Windows OS |date=2017 |last1=Hassan |first1=Nihad Ahmad |last2=Hijazi |first2=Rami |pages=97–132 |isbn=978-0-12-804449-0 }}</ref> NTFS adds several features that [[File Allocation Table|FAT]] and [[HPFS (file system)|HPFS]] lack, including: [[access control list]]s (ACLs); filesystem encryption; transparent compression; [[sparse file]]s; [[Journaling file system|file system journaling]] and [[shadow copy|volume shadow copy]], a feature that allows backups of a system while in use.

Starting with [[Windows NT 3.1]], it is the default file system of the [[Windows NT]] family superseding the [[File Allocation Table]] (FAT) file system.<ref name="Custer, Helen">{{cite book |last=Custer |first=Helen |url=https://archive.org/details/insidewindowsntf00cust |title=Inside the Windows NT File System |publisher=[[Microsoft Press]] |year=1994 |isbn=978-1-55615-660-1}}</ref> NTFS read/write support is available on [[Linux]] and [[Berkeley Software Distribution|BSD]] using [[NTFS3]] in [[Linux kernel|Linux]] and [[NTFS-3G]] in [[BSD]].<ref>{{Cite web|title=NTFS3 — The Linux Kernel documentation|url=https://www.kernel.org/doc/html/latest/filesystems/ntfs3.html|access-date=2021-12-02|website=www.kernel.org}}</ref><ref>{{Cite web|title=ntfs-3g|url=https://www.freebsd.org/cgi/man.cgi?query=ntfs-3g&format=html|access-date=2021-12-02|website=www.freebsd.org}}</ref> 

NTFS uses several files hidden from the user to store metadata about other files stored on the drive which can help improve speed and performance when reading data.<ref name="karresand2019" />

NTFS was slated to be replaced by [[WinFS]], one of the anchor features of the [[Development of Windows Vista|Longhorn]] platform, however WinFS was cancelled after Microsoft was unable to resolve performance problems with the filesystem.