|
System File |
File Name |
MFT Record |
Purpose of the File |
|
Master file table |
$Mft |
0 |
Contains one base file record for each file and folder on an NTFS
volume. If the allocation information for a file or folder is too large to
fit within a single record, other file records are allocated as
well. |
|
Master file table 2 |
$MftMirr |
1 |
A duplicate image of the first four records of the MFT. This file
guarantees access to the MFT in case of a single-sector failure. |
|
Log file |
$LogFile |
2 |
Contains a list of transaction steps used for NTFS recoverability. Log
file size depends on the volume size and can be as large as 4 MB. It
is used by Windows NT/2000 to restore consistency to NTFS after a
system failure. |
|
Volume |
$Volume |
3 |
Contains information about the volume, such as the volume label and
the volume version. |
|
Attribute definitions |
$AttrDef |
4 |
A table of attribute names, numbers, and descriptions. |
|
Root file name index |
$ |
5 |
The root folder. |
|
Cluster bitmap |
$Bitmap |
6 |
A representation of the volume showing which clusters are in
use. |
|
Boot sector |
$Boot |
7 |
Includes the BPB used to mount the volume and additional bootstrap
loader code used if the volume is bootable. |
|
Bad cluster file |
$BadClus |
8 |
Contains bad clusters for the volume. |
|
Security file |
$Secure |
9 |
Contains unique security descriptors for all files within a volume.
|
|
Upcase table |
$Upcase |
10 |
Converts lowercase characters to matching Unicode uppercase
characters. |
|
NTFS extension file |
$Extend |
11 |
Used for various optional extensions such as quotas, reparse point
data, and object identifiers. |
| |
|
12–15 |
Reserved for future use. |
