Master file table

$Mft

0

Contains one base file record for each file and folder on an NTFS volume. If the allocation information for a file or folder is too large to fit within a single record, other file records are allocated as well.

Master file table 2

$MftMirr

1

A duplicate image of the first four records of the MFT. This file guarantees access to the MFT in case of a single-sector failure.

Log file

$LogFile

2

Contains a list of transaction steps used for NTFS recoverability. Log file size depends on the volume size and can be as large as 4 MB. It is used by Windows NT/2000 to restore consistency to NTFS after a system failure.

Volume

$Volume

3

Contains information about the volume, such as the volume label and the volume version.

Attribute definitions

$AttrDef

4

A table of attribute names, numbers, and descriptions.

Root file name index

$

5

The root folder.

Cluster bitmap

$Bitmap

6

A representation of the volume showing which clusters are in use.

Boot sector

$Boot

7

Includes the BPB used to mount the volume and additional bootstrap loader code used if the volume is bootable.

Bad cluster file

$BadClus

8

Contains bad clusters for the volume.

Security file

$Secure

9

Contains unique security descriptors for all files within a volume.

Upcase table

$Upcase

10

Converts lowercase characters to matching Unicode uppercase characters.

NTFS extension file

$Extend

11

Used for various optional extensions such as quotas, reparse point data, and object identifiers.

12-15

Reserved for future use.

Quota management file

$Quota

24

Contains user assigned quota limits on the volume space.

Object Id file

$ObjId

25

Contains file object IDs.