Editing NTFS (section)

=== {{Anchor|MFT}} Master File Table === <!--'Master File Table' redirects here-->
In NTFS, all file, directory and [[#Metafiles|metafile]] data—file name, creation date, access permissions (by the use of [[access control list]]s), and size—are stored as metadata in the '''Master File Table'''<!--boldface per WP:R#PLA--> ('''MFT'''). This abstract approach allowed easy addition of file system features during Windows NT's development—an example is the addition of fields for indexing used by the [[Active Directory]] and the [[Windows Search]]. This also enables fast file search software to locate named local files and folders included in the MFT very quickly, without requiring any other index.

The MFT structure supports algorithms which minimize [[file system fragmentation|disk fragmentation]].<ref>{{cite web |url=https://learn.microsoft.com/en-us/windows/win32/fileio/master-file-table |title=Master File Table (Local File Systems) |date=August 28, 2024 |website=[[Microsoft Learn]] |publisher=[[Microsoft]]}}</ref> A directory entry consists of a filename and a "file ID" (analogous to the [[inode number]]), which is the record number representing the file in the Master File Table. The file ID also contains a reuse count to detect stale references. While this strongly resembles the W_FID of [[Files-11]], other NTFS structures radically differ.

A partial copy of the MFT, called the MFT mirror, is stored to be used in case of corruption.<ref>{{Cite web|date=2009-06-05|title=Forensics: What is the MFT Mirror?|url=https://whereismydata.wordpress.com/2009/06/05/forensics-what-is-the-mft-mirror/|access-date=2021-07-30|website=Where is Your Data?|language=en}}</ref> If the first record of the MFT is corrupted, NTFS reads the second record to find the MFT mirror file. Locations for both files are stored in the boot sector.<ref>{{cite web|url=http://ntfs.com/ntfs-mft.htm|title=NTFS Master File Table (MFT)|website=Ntfs.com|access-date=22 September 2018}}</ref>