Back
Next
Metafiles
Most of the ntfs configuration is controlled by metafiles.
Several of which are kept at specific locations of the volume.
Some of these :
$ATTRDEF - definitions of additional attributes
other than readonly, system, hidden, etc.
$BITMAP - drive's cluster use map.
$BADCLUS - list of discovered bad clusters.
$BOOT - volume bootstrap if volume bootable.
$LOGFILE - logs transactions (Journal for recovery purposes).
* No way to disable.
$MFT - master file table
$MFTMIRR - copy of 1st 26 records of MFT (stored in middle of disk)
$QUOTA - disk quota - only active on 2000, XP, and newer.
$VOLUME - volume (partition) serial number, creation time, and dirty flag.
When shutting down, indicates need to writeout buffers in memory.
Or after crash, indicates need to run scandisk or other recoverery.