NTFS

NTFS (New Technology File System) is the default journaling file system of Windows, which organizes a volume around a central Master File Table and stores every file, folder and piece of metadata as a set of attributes. Among Windows file systems, it is the format that Windows installs itself on and the reference point against which FAT32, exFAT and APFS are usually compared.

Introduced with Windows NT in 1993, NTFS was designed for reliability, security and large volumes rather than for portability. It adds access control lists, a metadata journal, transparent compression, encryption, hard links and alternate data streams, features that simpler FAT-family file systems do not offer.

How NTFS organizes a volume

NTFS treats everything on the volume as a file, including its own structures. The core is the Master File Table (MFT), a database in which each file or directory has at least one record of typically 1 KB. A record holds attributes such as the file name, timestamps, the security descriptor and the data itself.

Small files of roughly up to 700-900 bytes fit entirely inside their MFT record as resident data, so reading them needs no extra disk seek. Larger files become non-resident: the record then stores data runs, compact lists of cluster ranges that describe where the content lies on disk.

Several metadata files keep the volume consistent. The table below lists the most important ones and their roles.

Directories are indexed with B+ tree structures, which keeps lookups fast even in folders that contain hundreds of thousands of entries. This is one reason NTFS scales far better than FAT32, where directory searches are linear.

Journaling, permissions and advanced features

NTFS is a metadata-journaling file system. Before it changes structures such as the MFT or the free-space bitmap, it writes the intended change to $LogFile. After a power loss, Windows replays or rolls back the logged transactions, so the volume returns to a consistent state within seconds instead of requiring a full scan.

The journal protects structure, not file contents. A document that was being written during a crash can still be truncated or contain old data, which is why applications rely on their own safe-save techniques.

Beyond journaling, NTFS offers a set of administrative features that matter in daily work. The following table summarizes what each one does and where it is typically used.

Full-disk protection is normally handled by BitLocker, which works below the file system, while EFS encrypts selected files inside NTFS itself.

Key limits and parameters

NTFS limits are set by the cluster size and by implementation choices in Windows rather than by the on-disk format alone. The default cluster size is 4 KB for typical volumes, and larger clusters raise the maximum volume size.

A practical warning: compression does not work with clusters larger than 4 KB, so formatting with 64 KB clusters for a media archive disables it. The cluster size cannot be changed later without reformatting.

NTFS compared with other desktop file systems

NTFS is the most capable choice for internal Windows drives, but it is a poor fit for removable media shared across platforms. The comparison below places it beside its neighbors in desktop storage.

macOS can read NTFS but not write to it without third-party drivers, while current Linux kernels include a full read-write NTFS driver. This asymmetry is the main reason external drives used on both Windows and Mac are usually formatted as exFAT.

Fragmentation, maintenance and common mistakes

NTFS allocates space in clusters and tries to keep files contiguous, but fragmentation still occurs as files grow and are deleted. On hard disks this slows sequential reads, so Windows runs scheduled disk defragmentation. On SSDs, the same optimization task sends TRIM commands instead of moving data.

• Filling a volume completely slows allocation because NTFS reserves an MFT zone; keeping roughly 10-15% free space helps on hard disks.
• Treating the journal as a backup is a mistake, because it protects metadata only and cannot restore deleted files.
• Copying files to FAT32 or exFAT silently drops permissions, alternate data streams and EFS encryption.
• Running chkdsk with repair options on a failing disk can make data recovery harder; imaging the disk first is the safer order.
• Assuming NTFS permissions protect a stolen drive is wrong, because another operating system can ignore them; only encryption protects data at rest.

The simple explanation

A disk on its own is just a huge row of numbered storage boxes. NTFS is the filing system Windows uses to keep order in those boxes. It keeps a detailed index card for every file, noting its name, size, date, owner and exactly which boxes hold its contents.

Before NTFS rearranges anything important, it first writes a short note about what it is about to do. If the power suddenly goes out, Windows reads the note and finishes or undoes the job, so the disk does not end up in a confused state. It also remembers who is allowed to open each file, which is why one user cannot simply browse another user’s documents.

How it is used in practice

A small accounting office runs a Windows file server with a 4 TB data volume formatted as NTFS. The administrator creates a folder per department and uses NTFS permissions so that only payroll staff can open the payroll folder, while everyone can read the shared templates folder.

Every evening, volume shadow copies capture the state of the volume. When an employee overwrites a spreadsheet by mistake, the employee restores yesterday’s version from the Previous Versions tab in a few clicks. During a later power cut, the server reboots and the NTFS journal restores consistency in seconds, so no lengthy disk check is needed.

For exchanging files with a partner who uses a Mac, the office keeps a separate USB drive formatted as exFAT, because macOS cannot write to NTFS by default.