파일시스템
2011.03.17 13:35

NTFS MFT 분석

조회 수 1435 추천 수 0 댓글 0
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 댓글로 가기 인쇄 수정 삭제
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 댓글로 가기 인쇄 수정 삭제

NTFS Master File Table (MFT)

Each file on an NTFS volume is represented by a record in a special file called the master file table (MFT). NTFS reserves the first 16 records of the table for special information. The first record of this table describes the master file table itself, followed by a MFT mirror record. If the first MFT record is corrupted, NTFS reads the second record to find the MFT mirror file, whose first record is identical to the first record of the MFT. The locations of the data segments for both the MFT and MFT mirror file are recorded in the boot sector.

Full list of metadata files are presented in the "System Files" chapter.

Figure provides a simplified illustration of the MFT structure:

Figure 5-2 MFT Structure

The master file table allocates a certain amount of space for each file record. The attributes of a file are written to the allocated space in the MFT. Small files and directories (typically 512 bytes or smaller), such as the file illustrated in next figure, can entirely be contained within the master file table record.

Figure 5-2 MFT Record for a Small File or Directory:

This design makes file access very fast. Consider, for example, the FAT file system, which uses a file allocation table to list the names and addresses of each file. FAT directory entries contain an index into the file allocation table. When you want to view a file, FAT first reads the file allocation table and assures that it exists. Then FAT retrieves the file by searching the chain of allocation units assigned to the file. With NTFS, as soon as you look up the file, it's there for you to use.

Directory records are housed within the master file table just like file records. Instead of data, directories contain index information. Small directory records reside entirely within the MFT structure. Large directories are organized into B-trees, having records with pointers to external clusters containing directory entries that could not be contained within the MFT structure.

?

List of Articles
번호 분류 제목 글쓴이 날짜 조회 수
101 똑 부러지게 알아보는 보안의 지식 ingen 2017.06.13 98
100 용산본사 SOLDERING WORKSTATION file master 2017.01.31 99
99 기타 newsletter-2017-04-17 file master 2017.04.17 120
98 Tri-backup 도입사례 4 admin 2014.12.12 125
97 Tri-backup 도입사례 7 admin 2014.12.12 128
96 Tri-backup 도입사례 5 admin 2014.12.12 130
95 Tri-backup 도입사례 6 admin 2014.12.12 130
94 Tri-backup 도입사례 8 admin 2014.12.12 133
93 Tri-backup 도입사례 2 admin 2014.12.12 138
92 Tr-Backup 도입사례 3 admin 2014.12.12 153
91 Tri-backup 도입사례 9 admin 2014.12.12 157
90 Tri-backup 도입사례 1 admin 2014.12.12 161
89 기타 레이드란? master 2017.03.14 164
88 Tri-backup 도입사례 10 admin 2014.12.12 179
87 기타 데이터베이스란? master 2017.03.14 217
86 motor file admin 2008.11.20 220
85 pcb file admin 2008.11.20 233
84 rom file admin 2008.11.20 237
83 ram file admin 2008.11.20 238
82 PC관리 컴퓨터 수리 필수 상식! master 2017.02.01 264
Board Pagination Prev 1 2 3 4 5 6 Next
/ 6