파일시스템
2011.03.17 13:35

NTFS MFT 분석

조회 수 1451 추천 수 0 댓글 0
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 댓글로 가기 인쇄 수정 삭제
?

단축키

Prev이전 문서

Next다음 문서

크게 작게 위로 아래로 댓글로 가기 인쇄 수정 삭제

NTFS Master File Table (MFT)

Each file on an NTFS volume is represented by a record in a special file called the master file table (MFT). NTFS reserves the first 16 records of the table for special information. The first record of this table describes the master file table itself, followed by a MFT mirror record. If the first MFT record is corrupted, NTFS reads the second record to find the MFT mirror file, whose first record is identical to the first record of the MFT. The locations of the data segments for both the MFT and MFT mirror file are recorded in the boot sector.

Full list of metadata files are presented in the "System Files" chapter.

Figure provides a simplified illustration of the MFT structure:

Figure 5-2 MFT Structure

The master file table allocates a certain amount of space for each file record. The attributes of a file are written to the allocated space in the MFT. Small files and directories (typically 512 bytes or smaller), such as the file illustrated in next figure, can entirely be contained within the master file table record.

Figure 5-2 MFT Record for a Small File or Directory:

This design makes file access very fast. Consider, for example, the FAT file system, which uses a file allocation table to list the names and addresses of each file. FAT directory entries contain an index into the file allocation table. When you want to view a file, FAT first reads the file allocation table and assures that it exists. Then FAT retrieves the file by searching the chain of allocation units assigned to the file. With NTFS, as soon as you look up the file, it's there for you to use.

Directory records are housed within the master file table just like file records. Instead of data, directories contain index information. Small directory records reside entirely within the MFT structure. Large directories are organized into B-trees, having records with pointers to external clusters containing directory entries that could not be contained within the MFT structure.

?

List of Articles
번호 분류 제목 글쓴이 날짜 조회 수
101 파일시스템 $EFS Attribute admin 2011.03.17 1537
100 하드디스크 ATA/ATAPI-5 — the fifth revision of the ATA standard released in 2000 file admin 2011.03.16 1181
99 하드디스크 ATA/ATAPI-6 — the sixth revision of the ATA standard released in 2001 file admin 2011.03.16 1125
98 하드디스크 ATA/ATAPI-7 — the seventh revision of the ATA standard released in 2003 file admin 2011.03.16 1146
97 하드디스크 ATA/ATAPI-8 revision 2b — AT Attachment — 8 ATA/ATAPI Command Set (January 10, 2006, draft) file admin 2011.03.16 2044
96 파일시스템 Data Integrity and Recoverability with NTFS admin 2011.03.17 1512
95 포렌식 Digital Forensic 의 정의 admin 2011.03.19 102826
94 PC관리 DISK MAINTENANCE admin 2013.06.29 8958
93 파일시스템 EFS - Encrypting File System admin 2011.03.17 1610
92 파일시스템 EFS Internals admin 2011.03.17 112929
91 파일시스템 EXFAT 개요 admin 2011.09.26 2400
90 파일시스템 ext2 개요 admin 2011.03.19 6070
89 파일시스템 EXT3 개요 admin 2011.03.19 2579
88 파일시스템 FAT 파일시스템 admin 2011.03.16 1174
87 파일시스템 FAT 파일시스템 FAT32 테이블 살펴보기 admin 2011.03.16 19213
86 파일시스템 FAT 파일시스템의 FAT 테이블 살펴보기 admin 2011.03.16 1239
85 파일시스템 FAT 파일시스템의 디렉토리 정보 살펴보기 admin 2011.03.16 1193
84 파일시스템 FAT 파일시스템의 부트섹터 살펴보기 admin 2011.03.16 1413
83 파일시스템 FAT32 파일시스템의 MBR 살펴보기 admin 2011.03.16 1792
82 파일시스템 hfs+ 개요 admin 2011.03.19 173522
Board Pagination Prev 1 2 3 4 5 6 Next
/ 6