NTFS Component (Cont)

B) Master File Table

Every file that exists in NTFS volume must be recorded in Master File Table (MFT). MFT consist of 16 records that describe MFT itself (metadata) , MFT minor record , log file and or folder records for each file or folder exists in NTFS volume. Figure 5 illustrated MFT metadata files stores in MFT.

System File	File Name	MFT Record	Description
Master file table	$Mft	0	Allocates at least one file record for each file or folder here. If the file or folder is too large to fit within a single record, other file records are allocated too.
Master file table copy	$MftMirr	1	This is a duplicate copy of first four records of the MFT as a backup if failure happened in MFT.
Log file	$LogFile	2	Contain information that can restore metadata consistency after a system failure.
Volume	$Volume	3	Contain information about volume
Attribute definitions	$AttrDef	4	Contain information about attribute name, numbers, and description.
Root file name index	.	5	The root folder
Cluster bitmap	$Bitmap	6	Identify the free and unused cluster in the volume.
Boot sector	$Boot	7	Contain BPB used to mount the volume.
Bad cluster file	$BadClus	8	Identify bad cluster for the volume
Security file	$Secure	9	Contain unique security descriptor for all files
Up case table	$Upcase	10	Converts lowercase characters to matching Unicode uppercase characters.
NTFS extension file	$Extend	11	Used for optional extension
		12-15	Reserved for future use.

Figure 5 MFT metadata files

Both $Mft and $MftMrr data segment location are recorded in the boot sector . If the $Mft data corrupted, NTFS read the boot sector to find where is the location of $Mftmrr and use the $Mftmrr information. Mft is not located at a predefined sector and because of that, it can be relocated if the current location identified as bad sector. Normally a duplicate Mft are located at the logical center of the NTFS volume.

C) Master File Table Copy

NTFS duplicate file $Mft record in the volume as Mftmrr and located the file in the logical center of the hard disk. However not all of the info are duplicated; only first four records of the Mft are recorded. If Mft record corrupted , NTFS reads the boot sector to find where the Mftmrr located in the hard disk. After located it, NTFS read the information and correct the data by written back information from Mftmrr to corrupted Mft record.

Technorati : metadata, mft, mft copy
Del.icio.us : metadata, mft, mft copy
Ice Rocket : metadata, mft, mft copy
Flickr : metadata, mft, mft copy
Zooomr : metadata, mft, mft copy
Buzznet : metadata, mft, mft copy
Riya : metadata, mft, mft copy
43 Things : metadata, mft, mft copy