From ISTP Computing
Jump to navigation Jump to search

New Technology Filesystem (NTFS) is a journalling filesystem first introduced with Windows NT 3.1. It features access control lists for security, transparent compression, encryption and supports larger disks. On any modern Windows operating system, you can expect to see the main C: drive formatted as NTFS. Small files are embedded inside the master file table (MFT) and larger files are stored in one or more areas of the disk called clusters.

Drive Specifications

Cluster size

The default cluster size for a newly-formatted NTFS drive is 4,096 bytes (4KB).[1] Drives larger than 15TB have cluster sizes between 8KB and 16KB.


The NTFS filesystem begins at an arbitrary sector located on the disk. The start sector of the filesystem is usually found within the volume boot record (VBR) on the partition. In the absence of this information, the start sector can be found by reading every sector until a matching signature is found indicating an NTFS filesystem. As a result, the filesystem can be located and recovered even if all of the partitions have been deleted and the drive has been reformatted.