What is NTFS and How Does It Improve on FAT?
Learn how NTFS works — the Master File Table, journaling, and ACL permissions — with examples and OS interview questions answered.
Expected Interview Answer
NTFS (New Technology File System) is Windows' journaling file system that stores nearly all metadata — including tiny files themselves — as records in a Master File Table, and adds transaction logging, access control lists, and large-volume support that FAT never had.
Every file and directory on an NTFS volume gets a record in the Master File Table (MFT); small files can be stored entirely within their MFT record as “resident” data, while larger files use the record to hold pointers (extents) to external clusters, avoiding the pure linked-list overhead of FAT. NTFS journals metadata changes in a $LogFile before committing them, so after a crash the file system can replay or roll back incomplete transactions instead of requiring a full disk scan — this is the core reliability upgrade over FAT. NTFS also supports per-file/directory access control lists (ACLs) for fine-grained permissions, alternate data streams, compression, encryption (EFS), disk quotas, and sparse files, none of which FAT provides. The tradeoff is added complexity and metadata overhead, but for a general-purpose primary OS volume the reliability and permission model are essential.
- Journaling avoids full-disk scans after an unclean shutdown
- Master File Table unifies metadata and small-file storage in one structure
- Access control lists enable per-user, per-group fine-grained permissions
- Supports large volumes, compression, encryption, and sparse files
AI Mentor Explanation
NTFS is like a modern cricket board database where every player, official, and even short memo has one master record in a central registry, and short memos are stored directly inside the record itself rather than needing a separate locker. Every change to a record is first written to an audit log before being applied, so if the system crashes mid-update, the board can replay or discard the incomplete change instead of re-auditing every record from scratch. The registry also supports fine-grained access rules — a scorer can edit overs but not disciplinary notes — something the old paper scorebook system never offered.
Step-by-Step Explanation
Step 1
MFT record lookup
The OS locates the file's record in the Master File Table by its file reference number.
Step 2
Resident vs non-resident check
If the file is small, its data sits directly inside the MFT record; otherwise the record holds extent pointers to external clusters.
Step 3
Data read
The OS reads resident data directly, or follows the extent pointers to fetch data clusters for larger files.
Step 4
Journaled writes
Any metadata change is first appended to the $LogFile transaction log before being committed, enabling crash recovery.
What Interviewer Expects
- Understanding of the Master File Table as the central metadata structure
- Knowledge that NTFS journals metadata changes for crash recovery
- Awareness of ACL-based permissions as a key upgrade over FAT
- Ability to name at least one advanced NTFS feature (compression, EFS, sparse files, alternate data streams)
Common Mistakes
- Saying NTFS journals all file data, not just metadata (by default it journals metadata only)
- Confusing NTFS's MFT with FAT's allocation table
- Not knowing NTFS supports ACL-based permissions, unlike FAT
- Assuming NTFS never needs any consistency check after a crash
Best Answer (HR Friendly)
“NTFS is the file system Windows uses that keeps a detailed master record for every single file, and importantly, it writes down what it is about to change before actually changing it. That means if the power goes out mid-write, it can look at that log and cleanly finish or undo the change instead of needing a lengthy full-disk repair, and it also lets administrators set much more detailed permissions than older systems like FAT could.”
Code Example
struct mft_record {
unsigned long long file_ref; /* unique file reference number */
unsigned char resident; /* 1 = data stored inline, 0 = uses extents */
unsigned char data[512];/* inline data if resident */
struct extent extents[8]; /* cluster runs if non-resident */
};
/* Write-ahead logging: log the intended change BEFORE applying it */
void update_mft_record(struct mft_record *rec, struct change *chg) {
write_to_logfile(chg); /* durable log entry describing the change */
apply_change(rec, chg); /* now safe to mutate the actual record */
mark_logfile_entry_committed(chg);
}
/* On boot after a crash: replay committed-but-unflushed log entries */
void recover_from_logfile(void) {
for_each_uncommitted_entry(replay_or_discard);
}Follow-up Questions
- What is the difference between resident and non-resident NTFS attributes?
- How does NTFS journaling differ from full data journaling in ext4?
- What are NTFS alternate data streams used for?
- How do NTFS access control lists differ from traditional Unix permission bits?
MCQ Practice
1. What central structure does NTFS use to store file metadata?
NTFS stores a record for every file and directory in the Master File Table, which can also hold small files' data inline.
2. What does NTFS journal by default?
NTFS uses write-ahead logging of metadata changes so it can recover cleanly from an unclean shutdown without a full scan.
3. What NTFS feature allows per-user, per-group fine-grained permissions that FAT lacks?
NTFS supports ACLs attached to files and directories, enabling much finer permission control than FAT ever offered.
Flash Cards
What does NTFS stand for? — New Technology File System.
What central table does NTFS use for metadata? — The Master File Table (MFT).
How does NTFS recover from a crash without a full scan? — It journals metadata changes in $LogFile and replays/rolls back on recovery.
What permission model does NTFS add over FAT? — Access control lists (ACLs) for fine-grained per-user/group permissions.