Section 3: Files, Directories, and Metadata

The Big Picture: The Data and the Label

Picture a book in a library. There is the book itself (the words), and there is the catalogue card (title, size, date added, shelf number, who may borrow it). The card is not the book, but without the card you could never find or manage the book.

A file works the same way. A file is really two things:

This section is about the card (metadata) and about the folder, which turns out to be a special kind of file.

3.1 File Metadata (Size, Timestamps, Attributes)

What it is: Metadata is everything the file system knows about a file other than its contents. It is stored by the file system, not inside the file's data.

The four NTFS timestamps:

NTFS stores each time as a count of tiny steps (100 billionths of a second) since January 1, 1601, in a standard world clock called UTC. Windows converts it to your local time when it shows it.

Note on "Accessed": Updating this time on every read would cause a lot of extra writes, so on modern Windows it is often delayed or switched off. Do not rely on it as an exact record.

Names have rules too. On Windows, a file name cannot contain \ / : * ? " < > |. A few names such as CON, NUL and PRN are reserved because they are old device names. NTFS keeps the capital letters you typed (Notes.TXT) but ignores case when looking up (so notes.txt finds the same file) by default.

See metadata yourself:

dir /a
dir /t:c

dir /a lists everything, including hidden files. dir /t:c shows the created date instead of the modified date. In PowerShell:

Get-Item C:\Windows\notepad.exe | Format-List Name, Length, CreationTime, LastWriteTime, LastAccessTime, Attributes

(Length is the size in bytes.) In File Explorer, right-click any file and choose Properties to see the General and Details tabs.

3.2 Directory as a Special File (List of Entries)

What it is: A directory (folder) is not a physical box that files sit inside. It is a special file whose contents are a list of entries. Each entry says: "a file with this name can be found at this record number".

Directory "Pictures" (it is just a file holding a list)

 ┌───────────────────┬──────────────────────────┐
 │ Name              │ Where to find it         │
 ├───────────────────┼──────────────────────────┤
 │ Cat.jpg           │ record 51,204            │
 │ Dog.jpg           │ record 51,377            │
 │ Holiday           │ record 52,010 (a folder) │
 └───────────────────┴──────────────────────────┘

Why does this matter? It explains several everyday things:

Opening C:\Users\Sam\Cat.jpg, step by step: The file system starts at the root folder and reads its list to find Users. It reads Users to find Sam, reads Sam to find Cat.jpg, and now has the record number. Each step is a lookup in a list. Windows keeps recently used lists in memory (cached, see Chapter 3), so this is very fast.

How NTFS keeps big lists fast. A folder with 100,000 files would be slow to search from top to bottom. NTFS keeps names sorted in a tree-shaped index (a B-tree, named $I30 in NTFS), which lets it find a name in a few jumps, like opening a dictionary near the right page. Section 4 shows where this lives.

3.3 Alternate Data Streams (A Hidden Extra)

What it is: On NTFS, a file's data is stored in a stream. The normal content is the default (unnamed) stream. NTFS also allows extra named streams attached to the same file name. They do not change the size shown in Explorer, which is why they can surprise people.

File: report.txt
  ├── main stream (unnamed):  "Quarterly numbers..."   ← what you normally see
  └── stream named "secret":  "hello"                  ← hidden extra

A real use: When you download a file from the internet, Windows can attach a small stream named Zone.Identifier. It records "this came from the Internet", which is why you sometimes see a "this file came from another computer" warning.

Try it safely (in a temporary folder):

echo hello > report.txt:secret
dir /r
more < report.txt:secret

dir /r lists the streams. Notice that report.txt itself still looks like it has 0 bytes. In PowerShell you can use Get-Item report.txt -Stream *.

Warning: Streams exist only on NTFS. If you copy the file to a FAT32 or exFAT USB stick, the hidden stream is lost.

3.4 Three Everyday Questions

Summary