Exploring NTFS On-disk Structures

Few publicly available tools let you explore the internals of the NTFS on-disk structure. One of those few is DiskEdit, an internal NTFS testing tool that Microsoft inadvertently shipped on the Windows NT 4.0 Service Pack 4 (SP4) CD-ROM and the most powerful NTFS viewer I've seen. DiskEdit, which Figure A shows, provides a detailed look at the structures that make up files and directories, translates file and directory paths to Master File Table (MFT) entry numbers, and lets you look at attribute data. No documentation accompanies DiskEdit, but I provide a tutorial for it in a back issue of my free Sysinternals Newsletter (http://www.sysinternals.com/newsletter.htm). To use DiskEdit on Windows 2000, you must copy the ifsutil.dll, ulib.dll, untfs.dll, and ufat.dll files from an NT 4.0 system's winntsystem32 directory to the directory from which you want to run DiskEdit.

If you're interested in NTFS data structure information but can't get your hands on an SP4 CD-ROM, you can use NFI, the NTFS File Sector Information Utility, which Microsoft includes with its OEM Support Tools package at http://support.microsoft.com/support/kb/articles/q253/0/66.asp. (In addition to NFI, the OEM Support Tools include debugging utilities and kernel debugger extensions to help support personnel and developers analyze crash dumps.)

NFI accepts several command-line forms that let you dump information about a particular file or directory or about all the files on a volume, obtain the file or directory in which a particular logical sector on a drive resides, or obtain the file or directory in which a particular physical disk sector resides. For example, the command

nfi C: 123

reports the name of the file on volume C: that contains the volume's 123rd sector. To examine NTFS data structures, you can use the same command but omit the sector number to tell NFI to dump detailed information about attributes in all the disk's files. You can specify the name of the metadata files I describe in the column to view evidence of the index attributes they contain. For example, executing the command

nfi c:$extend$quota

on a volume that has quota management enabled results in output that shows that the $Quota file contains indexes named $O and $Q:

File 24$Extend$Quota$STANDARD_INFORMATION (resident)$FILE_NAME (resident)$INDEX_ROOT $O (resident)$INDEX_ROOT $Q (resident)

For another source of NTFS on-disk structure information, see Gary Nebbett, Windows NT/2000 Native API Reference (New Riders Publishing, 2000). An appendix lists the definitions for many NTFS on-disk data structures (some of which don't reflect changes in Win2K) and contains the source code for a Win32 program that interprets the data structures to bypass the NTFS file-system driver and dump a volume's contents.