Chapter 19 · File Systems

Practical Lab: File System Exploration

7 min read

Objective

See a real file system at work on your own PC: find out which file system each drive uses, watch clusters and "size on disk", read permissions, make hard links and junctions, flip file attributes, and meet an alternate data stream. You work only inside a new folder called FSLab in your Documents folder, and you delete it at the end.

Time: 30–40 minutes
You need: A Windows PC. No extra software. A few steps are marked (admin); they are optional, and you can skip them.

Safety: Do not run any command from this lab on C:\Windows or other system folders, except the read-only ones shown. Never use /f with chkdsk.

What to Open

ToolHow to open it
Command PromptPress Win, type cmd, press Enter (normal, not admin)
PowerShellPress Win, type PowerShell, press Enter (normal, not admin)
File ExplorerPress Win + E
Disk ManagementPress Win + X, choose Disk Management
Admin Command Prompt (only for steps marked admin)Press Win, type cmd, right-click, Run as administrator

Part 1: Which File System Is Each Drive Using?

1A. Disk Management. Open Disk Management. In the top list, read the File System column for each volume.

  1. File system of C:: ________________
  2. Any other volume (EFI System Partition, a USB stick, a recovery partition)? List their file systems: ________________

(The small EFI System Partition is normally FAT32 (Section 2.2).)

1B. PowerShell.

Get-Volume | Format-Table DriveLetter, FileSystemLabel, FileSystem, Size, SizeRemaining

1C. Command Prompt.

fsutil fsinfo volumeinfo C:

If this refuses to run, repeat it from an admin Command Prompt. Find:

  1. File System Name: ________________
  2. Does the flags list include supports Named Streams, supports Hard Links, supports Reparse Points? (Those are NTFS features from Sections 3.3 and 6.) ________________
  3. Maximum Component Length (the longest single file name): ________________ (NTFS: 255.)

1D. NTFS details (admin, optional).

fsutil fsinfo ntfsinfo C:
  1. Bytes Per Cluster: ________________ (commonly 4096)
  2. Bytes Per FileRecord Segment: ________________ (commonly 1024: the MFT record size from Section 4.1)

Part 2: Create the Lab Folder and Two Files

In Command Prompt:

cd %USERPROFILE%\Documents
mkdir FSLab
cd FSLab
echo hello > small.txt

Now make a bigger file (about 5,000 bytes) in PowerShell:

cd $env:USERPROFILE\Documents\FSLab
('x' * 5000) | Set-Content -NoNewline big.txt
Get-Item small.txt, big.txt | Select-Object Name, Length
  1. small.txt length: ________________ (about 7 or 8 bytes: "hello" plus a line break)
  2. big.txt length: ________________ (5000)

Size vs size on disk. In File Explorer open the FSLab folder, right-click each file → Properties.

  1. small.txt Size on disk: ________________ (often 0 bytes: the data lives inside the MFT record, Section 4.1)
  2. big.txt Size on disk: ________________ (expected 8.00 KB: two 4 KB clusters, if your cluster size is 4 KB)

Compare: 5,000 bytes of data in 8,192 bytes of clusters. The gap is slack space (Section 1.3).

Part 3: Look at Permissions

3A. The Security tab. Right-click small.txt → Properties → Security. Click each name in the top box and read the Allow ticks.

  1. Which names are listed? ________________ (you will probably see SYSTEM, Administrators and your own account)
  2. What does your own account have? ________________ (often Full control, because you own the file)

Click Advanced. In the Permission entries list:

  1. Is Inherited from filled in? What does it say? ________________ (the parent folder; Section 5.4)
  2. Who is the Owner? ________________

Close the windows with Cancel. Do not change anything.

3B. Command line.

icacls small.txt
  1. Find a line with (I). What does it mean? ________________
  2. Which code stands for Full control? ________________ (F)
(Get-Acl .\small.txt).Access | Format-Table IdentityReference, FileSystemRights, AccessControlType, IsInherited
  1. Is IsInherited True for most rows? ________________

In Command Prompt, inside FSLab:

4A. A hard link (a second name for the same file; Section 6.1):

mklink /H hard.txt small.txt
dir
echo more >> hard.txt
type small.txt
  1. Did small.txt show the new line "more" too? ________________ (yes: one file, two names)

4B. A junction (a folder link; Section 6.3):

mkdir realfolder
echo inside > realfolder\note.txt
mklink /J junc realfolder
dir
dir junc
  1. In dir, how is junc labelled? ________________ (<JUNCTION>)
  2. Does dir junc show note.txt? ________________ (yes: it leads into realfolder)

4C. A symbolic link (Section 6.2). This may need an admin prompt, or Developer Mode on. If you see "You do not have sufficient privilege", skip it. It is not a mistake.

mklink symlink.txt big.txt
dir
  1. How is symlink.txt labelled? ________________ (<SYMLINK>)

Part 5: File Attributes with attrib

attrib small.txt
attrib +r small.txt
attrib small.txt
echo test >> small.txt
  1. After +r, what letters appear? ________________ (R, and A)
  2. What happened on the echo ... >> small.txt line? ________________ (Access is denied: the file is read-only)
attrib -r small.txt
attrib +h small.txt
dir
dir /a
  1. Is small.txt in the first dir? In dir /a? ________________
attrib -h small.txt

In PowerShell, Get-ChildItem -Force also shows hidden files. Remember: Hidden is not security (Section 7.1).

Part 6: Meet an Alternate Data Stream

In Command Prompt, inside FSLab:

echo secret text > small.txt:hidden
dir small.txt
dir /r small.txt
more < small.txt:hidden
  1. Did the size of small.txt in plain dir change? ________________ (no)
  2. What extra line does dir /r show? ________________ (a line ending with :hidden:$DATA)

PowerShell can do the same: Get-Item small.txt -Stream *.

A stream exists only on NTFS. Copying the file to a FAT32 or exFAT stick would silently drop it.

Part 7 (Optional): Peek at the Journal and Health (admin)

In an admin Command Prompt:

fsutil usn queryjournal C:
chkdsk C:
  • The first prints the settings of the NTFS change journal (Section 4.4).
  • chkdsk with no switches on a mounted drive reports only; it does not repair. It reads the structures from Section 4. If it says it cannot run because the drive is in use, or offers to schedule a scan at restart, say no and skip this step. Never add /f.

Part 8: Clean Up

Remove the links first, so deleting cannot follow them into other folders. In Command Prompt:

cd %USERPROFILE%\Documents
rmdir FSLab\junc
del FSLab\symlink.txt
rmdir /s /q FSLab

(If you did not create symlink.txt, del just says it was not found.) Check that the folder is gone:

dir FSLab

You should get "File Not Found".

What Should Happen

  • Part 1 shows NTFS for C:, and FAT32 for the small boot partition.
  • Part 2 shows that a 5-byte file may take no clusters, while a 5,000-byte file takes two.
  • Part 3 shows an ACL with inherited entries.
  • Part 4 shows one hard-linked file with two names, and a junction labelled <JUNCTION>.
  • Part 5 shows Read-only blocking writes and Hidden hiding a file.
  • Part 6 shows a stream that does not change the visible size.

Interpretation Guide

What you seeWhat it means
File System Name: NTFSFull Windows file system with ACLs, journal, links
Bytes Per Cluster: 4096Default NTFS cluster size (4 KB)
Small file shows 0 bytes on diskIts data is resident inside the MFT record
big.txt shows 8 KB on diskTwo 4 KB clusters; the rest is slack
(I) in icaclsPermission inherited from the parent folder
Hard link edit shows in both namesOne MFT record, two directory entries
<JUNCTION> / <SYMLINK> in dirReparse points (links)
Access is denied after attrib +rRead-only attribute is working
:hidden:$DATA in dir /rAn alternate data stream is attached

Follow-Up Questions

  1. Why did small.txt show 0 bytes on disk but big.txt show 8 KB?
  2. After the hard-link test, you delete small.txt. Can you still read the data through hard.txt? Why?
  3. How is a junction different from a shortcut (.lnk) file?
  4. Why is attrib +h not a good way to protect a secret?
  5. What would happen to the alternate data stream if you copied small.txt to a USB stick formatted FAT32?