Chapter 19 · File Systems

Knowledge Check

10 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. What is the job of a file system?
  2. What is a cluster, and what is the default cluster size on NTFS?
  3. What is slack space?
  4. What is the biggest single file that FAT32 can hold?
  5. Name two things NTFS has that FAT32 and exFAT do not.
  6. What does the MFT hold, and how big is one record?
  7. What does resident data mean?
  8. What is the difference between $LogFile and $Bitmap?
  9. What does mklink /J create?
  10. Is the Hidden attribute a security feature?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. File system

It organizes raw storage blocks into named files and folders: it keeps track of names, where each file's data is, free space, and metadata such as size, dates and permissions.

2. Cluster

A group of sectors that the file system gives out as one unit (also called an allocation unit). NTFS defaults to 4 KB.

3. Slack space

The unused rest of a file's last cluster. No other file can use it.

4. FAT32 file limit

4 GB minus 1 byte.

5. NTFS extras

Any two of: journaling, permissions (ACLs), compression, encryption (EFS), hard links and junctions, alternate data streams.

6. MFT

The Master File Table holds one record per file and folder, with its metadata and either its data or the location of its data. Each record is 1 KB (1,024 bytes).

7. Resident data

The file's content is stored inside the MFT record itself, so a tiny file needs no clusters.

8. $LogFile vs $Bitmap

$LogFile is the journal (a log of planned changes for crash recovery). $Bitmap is the map of free and used clusters, one bit per cluster.

A junction: a folder link that points to another folder on a local drive.

10. Hidden

No. It only hides the file from normal views. Anyone can show hidden files. Use permissions for protection.

UNDERSTANDING QUESTIONS

Q1. Why does moving a file to another folder on the same drive happen instantly, even for a 10 GB file?

Answer A folder is just a list of names and file reference numbers. Moving within one volume only removes the entry from one list and adds it to another. The data clusters are not touched or copied. (Moving to a different drive does need a real copy, because it must be written to a different volume.)

Q2. Why did NTFS add a journal? What exactly does it protect?

Answer Saving a file needs several linked changes (MFT record, folder list, bitmap). A power cut between them could leave the structure inconsistent. The journal records the plan first, so on restart NTFS can finish or undo the operation. It protects the **file system's structure**; it does not promise that your latest unsaved file contents survive.

Q3. Why can a hard link not point to a file on another drive, but a symbolic link can?

Answer A hard link is just another directory entry pointing to the **same MFT record**, and MFT record numbers only mean something inside one volume. A symbolic link stores a **path as text** and Windows follows it, so it can lead to any volume or even a network path.

Q4. Why does a deny rule beat an allow rule, and why is deny used sparingly?

Answer Windows checks deny entries first, so a matching deny always wins. This makes it a strong tool but dangerous: if a group you belong to is denied, you lose access even if another group allows it, which makes accidental lock-outs easy. Usually it is better to simply not allow something.

Q5. Why is EFS not the same as BitLocker, and when would each help?

Answer EFS encrypts individual files and ties the key to your user account, so it protects them from other users of the same PC. BitLocker encrypts the whole volume and protects against a stolen laptop or drive. EFS is not in Windows Home editions.

SCENARIO QUESTIONS (Troubleshooting)

S1. You try to copy a 6 GB video onto a USB stick and Windows says the file is too large, though the stick has 20 GB free. What is the likely cause and fix?

Answer The stick is formatted **FAT32**, which cannot hold a single file of 4 GB or more. Back up the stick, then reformat it as **exFAT** (works on PCs and Macs) or NTFS (best for Windows only), or split the video into smaller parts.

S2. A folder holds 50,000 tiny text files. The folder shows 40 MB of data but File Explorer says the "size on disk" is 200 MB. Why?

Answer Each file occupies at least whole clusters (4 KB each), so every small file wastes most of its last cluster as slack. Very tiny files may be resident in the MFT instead, but files above a few hundred bytes use at least one full cluster each. Many small files multiply the waste.

S3. A user gets "Access is denied" on a file, yet they are in the Users group, which is allowed Read. What would you check?

Answer Look at the **Security tab and the Advanced view**. There may be a **Deny** entry for the user or for another group they belong to (deny beats allow), or inheritance may have been disabled. Also check who the **owner** is. `icacls ` shows the full list.

S4. After a sudden power loss, Windows runs a disk check on restart, but the disk comes up with no folder damage. Which NTFS feature helped, and what might still be lost?

Answer The **`$LogFile` journal** let NTFS finish or undo half-completed metadata changes, so the file system structure is consistent. A document you were typing but had not saved, or data still waiting in the cache, may still be lost.

S5. You deleted a folder that contained a junction, and later you discover files from another folder are gone. What probably happened, and how do you avoid it?

Answer Some tools that delete recursively **follow the junction** into its target and delete the files there. To remove a junction or directory link safely, use `rmdir linkname` without `/s` first, so only the link is removed.

INTERVIEW QUESTIONS

I1. Explain what the Master File Table is and what happens for very small files.

Answer The MFT is NTFS's central table: one 1 KB record per file or folder, made of attributes (`$STANDARD_INFORMATION`, `$FILE_NAME`, `$DATA`, and so on). For very small files, the data attribute is **resident**: the content is stored inside the record itself, so no clusters are used. Larger files have **non-resident** data: the record holds a list of extents (start cluster and length) that point to clusters elsewhere on the volume.

I2. Compare hard links, symbolic links and junctions.

Answer A **hard link** is another name for the same MFT record: same volume, files only, no separate identity. A **symbolic link** is a separate small file (a reparse point) that stores a path; it works across volumes and networks, and can point to files or folders, but breaks if the target is removed. A **junction** is a directory-only link to a local folder using an absolute path and needs no special privilege to create.

I3. How does NTFS decide whether a user may open a file?

Answer When the file is opened, the kernel takes the caller's **access token** (identity plus group SIDs) and checks the file's **security descriptor**. It walks the **DACL**'s ACEs in order; the first matching deny stops the check, and allow entries accumulate the rights until all requested rights are granted. If the requested rights are not all granted, access is denied. Permissions are often inherited from the parent folder, and the descriptors are stored once in `$Secure`.

I4. Describe the path of a "create file" request from an application to the disk.

Answer The app calls `CreateFileW`; this reaches `NtCreateFile` in `ntdll`, which makes a system call into the kernel. The **I/O Manager** builds an IRP and sends it through filter drivers to `ntfs.sys`. NTFS checks permissions, allocates an MFT record, writes its attributes, adds an entry to the parent's `$I30` index and logs the change in `$LogFile`. The Cache Manager holds the changes in memory; the lazy writer later sends write requests down through the volume manager, partition manager, disk class driver, storage port and miniport drivers to the SSD or hard drive.

I5. What are alternate data streams, and why can they be a concern?

Answer NTFS allows a file to have additional named data streams besides its normal content. They are used legitimately (for example the `Zone.Identifier` stream recording that a file came from the Internet). Because they do not change the size shown in a normal folder listing, they can hide data, and they are silently lost when the file is copied to a file system without stream support (FAT32, exFAT). `dir /r` or `Get-Item -Stream *` reveals them.

PRACTICAL TASK

Draw a one-page "life of a file" poster. Choose any real file on your PC (for example a photo in your Pictures folder). Using what you saw in the Practical Lab, write down: its full path, its Size and Size on disk, its Created and Modified dates, its attributes (from attrib), and three entries from its permissions (from icacls). Then draw the folder tree from C:\ down to the file, and label the file system type of the drive it lives on.

Why This Matters

When a drive is full, a file will not open, or a program says "access denied", you now know where to look: the cluster math, the permissions or the attributes. The poster ties the names you see (folders and paths) to the structures underneath (records, clusters and ACLs).

CHAPTER SUMMARY

  • A file system turns raw numbered storage blocks into named files and folders, using clusters (4 KB by default on NTFS) and leaving some slack space.
  • NTFS is the Windows default (journaling, ACLs, compression, EFS, links, streams). FAT32 (4 GB file limit) and exFAT (flash drives) have no permissions. ReFS targets resilience on servers and Dev Drive.
  • Metadata is information about a file; a directory is a special file listing names and record numbers, stored in a B-tree index ($I30).
  • NTFS keeps a Master File Table: one 1 KB record per file, with resident data for tiny files or extents for larger ones; $Bitmap tracks free clusters; hidden $ files hold metadata.
  • The $LogFile journal keeps the file system consistent after a crash; $UsnJrnl records what changed.
  • Permissions are ACLs made of ACEs, inherited from parent folders; deny beats allow.
  • Links: hard links (same record, same volume), symbolic links (store a path), junctions (local folder links); .lnk shortcuts are just files.
  • Attributes (R, H, S, A, compressed, encrypted, not-indexed) are switches; Hidden and Read-only are not real security.
  • Creating a file passes through Explorer, CreateFileW, NtCreateFile, the I/O Manager, ntfs.sys, the journal, the cache, the volume and disk drivers, and finally the device.