NTFS
[12] NTFS adds several features that FAT and HPFS lack, including: access control lists (ACLs); filesystem encryption; transparent compression; sparse files; file system journaling and volume shadow copy, a feature that allows backups of a system while in use.
[1] In the mid-1980s, Microsoft and IBM formed a joint project to create the next generation of graphical operating system; the result was OS/2 and HPFS.
[16] The original NTFS developers were Tom Miller, Gary Kimura, Brian Andrew, and David Goebel.
[17] Probably as a result of this common ancestry, HPFS and NTFS use the same disk partition identification type code (07).
Algorithms identifying the file system in a partition type 07 must perform additional checks to distinguish between HPFS and NTFS.
The maximum NTFS volume size implemented in Windows XP Professional is 232 − 1 clusters, partly due to partition table limitations.
[update][34][32] Linux kernel versions 2.1.74 and later include a driver written by Martin von Löwis which has the ability to read NTFS partitions;[35] kernel versions 2.5.11 and later contain a new driver written by Anton Altaparmakov (University of Cambridge) and Richard Russon which supports file read.
[38] Paragon's NTFS driver (see below) has been merged into kernel version 5.15, and it supports read/write on normal, compressed and sparse files, as well as journal replaying.
[39] NTFS-3G is a free GPL-licensed FUSE implementation of NTFS that was initially developed as a Linux kernel driver by Szabolcs Szakacsits.
It was built as a Filesystem in Userspace (FUSE) program and released under the GPL but work on Captive NTFS ceased in 2006.
[44] Native NTFS write support is included in 10.6 and later, but is not activated by default, although workarounds do exist to enable the functionality.
[45] Paragon Software Group sells a read-write driver named NTFS for Mac,[46] which is also included on some models of Seagate hard drives.
[47] The NetDrive package for OS/2 (and derivatives such as eComStation and ArcaOS) supports a plugin which allows read and write access to NTFS volumes.
In NTFS, each file or folder is assigned a security descriptor that defines its owner and contains two access control lists (ACLs).
The second ACL, called system access control list (SACL), defines which interactions with the file or folder are to be audited and whether they should be logged when the activity is successful, failed or both.
For example, auditing can be enabled on sensitive files of a company, so that its managers get to know when someone tries to delete them or make a copy of them, and whether they succeed.
Starting with Windows PowerShell 3.0, it is possible to manage ADS natively with six cmdlets: Add-Content, Clear-Content, Get-Content, Get-Item, Remove-Item, Set-Content.
[64][65] Without deep modifications to the source code, all Chromium (e.g. Google Chrome) and Firefox-based web browsers also write the Zone.Identifier stream to downloaded files.
[67] NTFS Streams were introduced in Windows NT 3.1, to enable Services for Macintosh (SFM) to store resource forks.
[77] This design is meant purely for read-only access, so any writes to compressed files result in an automatic decompression.
[citation needed] CompactOS file compression is an improved version of WIMBoot feature introduced in Windows 8.1.
Windows Vista also introduced persistent shadow copies for use with System Restore and Previous Versions features.
Transactional NTFS allows, for example, the creation of network-wide consistent distributed file systems, including with their local live or offline caches.
They allow the administrator of a computer that runs a version of Windows that supports NTFS to set a threshold of disk space that users may use.
[91] This boot partition format is roughly based upon the earlier FAT filesystem, but the fields are in different locations.
[c] As of Windows 7, the NTFS driver completely prohibits user access, resulting in a BSoD whenever an attempt to execute a metadata file is made.
For files on a multi-GB volume, each entry can be encoded as 5 to 7 bytes, which means a 1 KB MFT record can store about 100 such data runs.
[100] The NTFS file system driver will sometimes attempt to relocate the data of some of the attributes that can be made non-resident into the clusters, and will also attempt to relocate the data stored in clusters back to the attribute inside the MFT record, based on priority and preferred ordering rules, and size constraints.
This means that when files are copied or moved between NTFS and FAT partitions, the OS needs to convert timestamps on the fly.
As a result, especially shortly after one of the days on which local zone time changes, users may observe that some files have timestamps that are incorrect by one hour.
