Back
Next
The size of a record in the MFT 1 K (according to Microsoft site).
Some other sources indicate 2K may be possible.
NTFS stores the data contents or "attributes" of each record
Resident in an MFT entry, up to 900 bytes
Primary filename (required)
Basic attributes (ms-dos r,h,s,a) (required)
Allocation map of non-resident portion (required)
Permissions (used with/by access control list)
Other attributes if they can fit.
Could include the file's contents if small enough.
And if needed, non-resident attributes.
Information that didn't fit in mft record.
Mainly, file's data.
Additional attributes (those not required in record, and that didn't fit)
If file is encrypted, sparse file, or compressed, its "data" contents
will always be non-resident.
If the allocation map it too large (file large or highly fragmented)
NTFS uses tiered pointer (similar to Unix) to provide resident
allocation entries that point to additional non-resident allocation
pointers.
Access control list.
Like file attributes on steroids.
Use cacls to view/modify file's access control list.