$MFT (0) - File - NTFS Documentation
Description: NTFS Documentation

Home | Files | Attributes | Concepts | Glossary

# File - $MFT (0)

Previous Next

## Overview

In NTFS, everything on disk is a file. Even the metadata is stored as a set of files. The Master File Table (MFT) is an index of every file on the volume. For each file, the MFT keeps a set of records called attributes and each attribute stores a different type of information.

## Attributes

Type | Description | Name
--- | --- | ---
0x10 | $STANDARD_INFORMATION |
0x30 | $FILE_NAME | $MFT
0x80 | $DATA | [Unnamed]
0xB0 | $BITMAP | [Unnamed]

## Layout of the File

### Unnamed Data Stream

The description of each file is packed into FILE records. If one record is not large enough (this is unusual), then an $ATTRIBUTE_LIST attribute is needed.

The first 24 FILE records are reserved for the system files. For a full list see the Files page.

Inode | Filename | Description
--- | --- | ---
0 | $MFT | Master File Table - An index of every file
1 | $MFTMirr | A backup copy of the first 4 records of the MFT
2 | $LogFile | Transactional logging file
3 | $Volume | Serial number, creation time, dirty flag
... | ... | ...

## Notes

### MFT Zone

To prevent the MFT becoming fragmented, Windows maintains a buffer around it. No new files will be created in this buffer region until the other disk space is used up. The buffer size is configurable and can be 12.5%, 25%, 37.5% or 50% of the disk. Each time the rest of the disk becomes full, the buffer size is halved.

### Other Information

The MFT is self-referencing.

The MFT has some space reserved for future expansion. MFT records 12 - 15 are marked as in use, but are empty. MFT records 16 - 23 are marked as not in use, however they are never used.

Under Windows, the MFT cannot shrink whilst the system is running.

Copyright (C) Validate HTML Validate CSS