Working with File Systems

On readable/writable disks, Microsoft Windows XP Professional supports the NTFS file system and three file allocation table (FAT) file systems: FAT12, FAT16, and FAT32. On CDROM and DVD media, Windows XP Professional supports two file systems: Compact Disc File System (CDFS) and Universal Disk Format (UDF).

When choosing a file system for readable/writable disks, you must consider the features associated with each file system. You must also consider limitations, such as maximum volume size, cluster size, file size, and compatibility with other operating systems.

For information on how to obtain the Windows XP Professional Resource Kit in its entirety, please see https://www.microsoft.com/mspress/books/6795.asp.

On This Page

Related Information
New in File Systems
Overview
Advantages of Using NTFS
Using the NTFS File System
Comparing FAT File Systems
Compact Disc File System
Universal Disk Format
Using File System Tools
File Naming in Windows XP Professional
Additional Resources

Related Information

• For more information about disks and volumes, see Chapter 12, “Organizing Disks.”

• For more information about sharing folders and shared folder permissions, see Chapter 6, “Managing Files and Folders.”

New in File Systems

Windows XP Professional provides improved file system performance and features. Table 13-1 summarizes the enhancements made from Microsoft Windows 2000 to Windows XP Professional.

Table 13-1 Enhancements Since Windows 2000

Enhancement	Description
NTFS performance is improved.	Some data structures on newly formatted NTFS volumes have been moved to a different location on the physical disk. This new location improves performance from 5 to 8 percent, making NTFS performance similar to FAT.
A quick-format option is available during Windows XP Professional Setup.	If the volume is already formatted and you are sure the disk is not damaged, use this option during Setup to decrease the time necessary to format the volume.
Variable cluster sizes are now available on volumes converted to NTFS.	The format command in Windows XP Professional now aligns FAT data clusters at the cluster size boundary. This alignment improves the conversion of FAT volumes to NTFS because the convert command can now use a variable cluster size, up to a maximum of 4 kilobytes (KB), for converted volumes, instead of a fixed 512-byte cluster size as used in Windows 2000.
Default permissions are applied to volumes converted to NTFS.	Convert.exe now applies default permissions on volumes converted to NTFS. This change ensures that converted NTFS volumes receive the same access control lists (ACLs) as natively formatted NTFS volumes.
A new parameter prevents the master file table (MFT) from becoming fragmented during the conversion to NTFS.	To prevent the MFT from becoming fragmented during the conversion to NTFS, the /cvtarea parameter in Convert.exe allows you to specify a contiguous placeholder file at the root folder to be used for the MFT. Using this parameter improves NTFS performance after the conversion by ensuring that the MFT occupies a contiguous space on the hard disk.
More options are available for defragmenting volumes.	Windows XP Professional offers two choices for defragmenting volumes: the Disk Defragmenter snap-in and a new command-line tool called Defrag.exe. Both tools can defragment NTFS volumes that use any cluster size and files smaller than 16 clusters. Both tools can also defragment the MFT on NTFS volumes.
Portable Operating System Interface (POSIX) support is provided by Windows Services for UNIX v3.5.	The POSIX subsystem included with Microsoft Windows NT and Windows 2000 is not included with Windows XP Professional. The broad functionality found on most UNIX systems beyond the POSIX.1 standard is included as part of Microsoft Windows Services for UNIX v3.5, with the Interix 3.5 subsystem.
Format DVD-RAM discs.	Windows XP Professional supports formatting DVD-RAM discs as FAT32 volumes.
Perform file system tasks at the command line by using Fsutil.exe.	Use Fsutil.exe to perform file system tasks such as disabling long file names, checking whether a volume is flagged as dirty, viewing NTFS-related information about a volume, creating hard links, and managing quotas and sparse files.
Create a Microsoft MS-DOS startup floppy disk.	When formatting a floppy disk by using My Computer, select the Create an MS-DOS startup disk option. An MS-DOS startup disk is useful when you need to update a computer’s BIOS.

If you are migrating from Microsoft Windows NT version 4.0, the enhancements in Table 13-2 apply in addition to those outlined in Table 13-1.

Table 13-2 Enhancements Since Windows NT 4.0

New Feature	Feature Description
An updated version of NTFS provides new features exclusive to NTFS volumes.	NTFS—the recommended native file system for Windows XP Professional—is more functional, robust, and secure than the FAT file systems. The version of NTFS included with Windows 2000 introduced features such as encryption, disk quotas, mounted drives, distributed link tracking, sparse files, and so on. These improvements are also available in Windows XP Professional.
FAT32 support allows greater flexibility for computers that start other versions of Windows.	FAT32 was a new option in Windows 2000 and continues to be supported by Windows XP Professional. FAT32 formats much larger volumes than FAT16 and stores files on large volumes more efficiently than FAT16.

Overview

A file system is the structure in which files are named, stored, and organized. File systems supported by Windows XP Professional include FAT16, FAT32, and NTFS. You can use any combination of these file systems on a hard disk, but each volume on a hard disk can be formatted by using only one file system. When choosing the appropriate file system to use, you need to determine the following:

How the computer is used (dedicated to Windows XP Professional or multiple-boot)

On computers that contain multiple operating systems, file system compatibility becomes more complex because different versions of Windows support different combinations of file systems.

The number and size of locally installed hard disks

Each file system has a different maximum volume size. As volume sizes increase, your choice of file systems becomes limited. For example, to create volumes larger than 32 gigabytes (GB) in Windows XP Professional, you must use NTFS.

Security considerations

NTFS offers security features, such as encryption and file and folder permissions. These features are not available on FAT volumes.

Interest in using advanced file system features

NTFS offers features such as disk quotas, distributed link tracking, compression, and mounted drives. These features are not available on FAT volumes.

Advantages of Using NTFS

NTFS provides performance, reliability, and advanced features not found in any version of FAT. Use NTFS wherever possible to gain the maximum benefits from Windows XP Professional, including the following:

Robust, reliable performance

NTFS guarantees the consistency of the volume by using standard transaction logging and recovery techniques. In the event of a system failure, NTFS uses its log file and checkpoint information to restore the consistency of the file system when the computer is restarted.

In the event of a bad-sector error, NTFS dynamically remaps the cluster containing the bad sector and allocates a new cluster for the data. NTFS also marks the cluster as bad and no longer uses it.

Built-in security features

When you set permissions on a file or folder, you specify the groups and users whose access you want to restrict or allow and then select the type of access. For example, you can let one group read the contents of a file, let another group make changes to the file, and prevent all other groups from accessing the file.

The Encrypting File System (EFS) is the technology used to store encrypted files on NTFS volumes. After you encrypt a file or folder, you work with the encrypted file or folder just as you do with any other files and folders. However, an intruder who tries to access your encrypted files or folders is prevented from doing so, even if the intruder has physical access to the computer.

Supports large volumes

Using the default cluster size (4 KB) for large volumes, you can create an NTFS volume up to 16 terabytes. You can create NTFS volumes up to 256 terabytes using the maximum cluster size of 64 KB. NTFS also supports larger files and more files per volume than FAT.

NTFS manages disk space more efficiently than FAT by using smaller cluster sizes. For example, a 30-GB NTFS volume uses 4-KB clusters. The same volume formatted by using FAT32 uses 16-KB clusters. Using smaller clusters reduces wasted space on hard disks.

Designed for storage growth

By enabling disk quotas, you can track and control disk space usage for NTFS volumes. You can configure whether users are allowed to exceed their limit, and you can also configure Windows XP Professional to log an event when a user exceeds a specified warning level or quota limit.

To create extra disk space, you can compress files on NTFS volumes. Compressed files can be read and written by any Windows-based application without first being decompressed by another program.

If you run out of drive letters or need to create additional space that is accessible from an existing folder, you can mount a volume at any empty folder on a local NTFS volume to create a mounted drive. Mounted drives make data more accessible and give you the flexibility to manage data storage based on your work environment and system usage.

You can increase the size of most NTFS volumes by adding unallocated space from the same disk or from another disk. For more information about increasing the size of NTFS volumes, see Chapter 12, “Organizing Disks,”

Other advanced features found only on NTFS volumes

Distributed link tracking maintains the integrity of shortcuts and OLE links. You can rename source files, move them to NTFS volumes on different computers within a Windows 2000 domain, and change the computer name or folder name that stores the target—all without breaking the shortcut or OLE links.

Sparse files consist of large, consecutive areas of zeros. NTFS manages sparse files by tracking the starting and ending point of the sparse file, as well as its useful (nonzero) data. The unused space in a sparse file is made available as free space.

The NTFS change journal provides a persistent log of changes made to files on a volume. NTFS maintains the change journal by tracking information about added, deleted, and modified files for each volume. Programs such as Indexing Service can take advantage of the change journal to boost search performance.

Hard links are NTFS-based links to a file on an NTFS volume. By creating hard links, you can have a single file in multiple folders without duplicating the file. You can also create multiple hard links for a file in a folder if you use different file names for the hard links. Because all the hard links reference the same file, applications can open any of the hard links and modify the file.

When to Use FAT

If your computer runs only Windows XP Professional and you do not plan to install other operating systems, use NTFS. However, if you have other operating systems installed and want to access the volumes, you must use FAT16 or FAT32, depending on which operating systems are on your computer. For example, to start a Windows XP Professional–based computer in Microsoft MS-DOS, Microsoft Windows 3.x, or Microsoft Windows 95, you must use FAT16. For a multiple-boot configuration that has Microsoft Windows‚ 95 OEM Service Release 2 (OSR2), Microsoft Windows 98, or Microsoft Windows Millennium Edition (Me), use FAT32. Table 13-3 shows the file system formats supported by various operating systems.

Table 13-3 Operating System and File System Compatibility

Operating System	FAT16	FAT32	NTFS
Windows XP	X	X	X
Windows Server™ 2003	X	X	X
Windows 2000	X	X	X
Windows NT 4.0*	X		X
Windows 95 OSR2, Windows 98, and Windows Me	X	X
Windows 95 (prior to OSR2)	X
MS-DOS	X

* Computers running Windows NT 4.0 require Service Pack 4 or later to access NTFS volumes previously mounted by Windows 2000, Windows Server 2003, or Windows XP Professional.

In multiple-boot configurations, use NTFS for the Windows NT 4.0 with Service Pack 4 or later boot volume, Windows 2000 boot volume, or Windows XP boot volume if you do not want to access these volumes from other operating systems. However, you must format the system volume according to Table 13-3 to start other operating systems. For more information about NTFS compatibility in computers running Windows NT 4.0 and Windows XP Professional, see “NTFS Compatibility with Windows NT 4.0” later in this chapter. For more information about the system and boot volumes, see Chapter 12, “Organizing Disks.”

Although NTFS is the preferred file system for hard disks, Windows XP Professional uses FAT12 when you format floppy disks and FAT32 when you format DVD-RAM discs. For removable media that can be ejected unexpectedly, you must use FAT16 or FAT32. NTFS is disabled for some removable media because NTFS does not flush data to the disk immediately, and removing NTFS-formatted media without using the Safe Removal application can result in data loss.

If you do not plan on removing the media and want to use NTFS, change the Safe Removal policy.

To enable NTFS on removable media

1. In Device Manager, right-click the device and then click Properties.

2. On the Policies tab, click Optimize for performance.

For more information about removing disks and the Safe Removal policies, see Chapter 9, “Managing Devices.”

You no longer need to use FAT for the system and boot volumes because Windows XP Professional offers two troubleshooting tools designed to access NTFS volumes:

• Safe Mode starts Windows XP Professional by using only the basic set of device drivers and system services loaded.

• Recovery Console is a special command-line environment that enables you to copy system files from the operating system CD, fix disk errors, and otherwise troubleshoot system problems without installing a second copy of the operating system.

For more information about Safe Mode and the Recovery Console, see Appendix C, “Tools for Troubleshooting.”

Cluster Size

A cluster (or allocation unit) is the smallest amount of disk space that can be allocated to hold a file. All file systems used by Windows XP Professional organize hard disks based on cluster size, which is determined by the number of sectors that the cluster contains. For example, on a disk that uses 512-byte sectors, a 512-byte cluster contains one sector, whereas a 4-KB cluster contains eight sectors.

FAT16, FAT32, and NTFS each use different cluster sizes depending on the size of the volume, and each file system has a maximum number of clusters it can support. The smaller the cluster size, the more efficiently a disk stores information because unused space within a cluster cannot be used by other files. And the more clusters that are supported, the larger the volumes you can create and format by using a particular file system.

Table 13-4 provides a comparison of FAT16, FAT32, and NTFS volume and default cluster sizes.

Table 13-4 Default Cluster Sizes for Volumes with Windows XP Professional File Systems

Volume Size	FAT16 Cluster Size	FAT32 Cluster Size	NTFS Cluster Size
7 MB–16 MB	2 KB	Not supported	512 bytes
17 MB–32 MB	512 bytes	Not supported	512 bytes
33 MB–64 MB	1 KB	512 bytes	512 bytes
65 MB–128 MB	2 KB	1 KB	512 bytes
129 MB–256 MB	4 KB	2 KB	512 bytes
257 MB–512 MB	8 KB	4 KB	512 bytes
513 MB–1024 MB	16 KB	4 KB	1 KB
1025 MB–2 GB	32 KB	4 KB	2 KB
2 GB–4 GB	64 KB	4 KB	4 KB
4 GB–8 GB	Not supported	4 KB	4 KB
8 GB–16 GB	Not supported	8 KB	4 KB
16 GB–32 GB	Not supported	16 KB	4 KB
32 GB–2 terabytes	Not supported	Not supported*	4 KB

* Windows XP Professional formats FAT32 volumes up to 32 GB regardless of cluster size. To format volumes larger than 32 GB, you must use NTFS. However, Windows XP Professional can mount FAT32 volumes larger than 32 GB that were created by other operating systems.

In the Disk Management snap-in, you can specify a cluster size of up to 64 KB when you format a volume. If you use the format command to format a volume but do not specify a cluster size by using the **/a:**size parameter, the default values in Table 13-4 are used. To change the cluster size after the volume is formatted, you must reformat the volume.

Before you choose a cluster size other than the default, note the following important limitations:

• For Microsoft Windows NT, Windows 2000, Windows Server 2003, and Windows XP Professional, the cluster size of FAT16 volumes from 2 GB through 4 GB is 64 KB, which can create compatibility issues with some applications. For example, setup programs do not compute free space properly on a volume with 64-KB clusters and cannot run because of a perceived lack of free space. For this reason, you must use either NTFS or FAT32 to format volumes larger than 2 GB. The format command in Windows XP Professional displays a warning and asks for a confirmation before formatting a volume that has 64-KB clusters using FAT16.

• Windows XP Professional, like Windows NT 4.0 and Windows 2000, supports file compression. Because file compression is not supported on cluster sizes above 4 KB, the default NTFS cluster size for Windows XP Professional never exceeds 4 KB. For more information about NTFS compression, see “File Compression” later in this chapter.

To check the cluster size of an existing volume, use the chkdsk command or the fsutil fsinfo ntfsinfo command. For more information about using Chkdsk, see Chapter 28, “Troubleshooting Disks and File Systems.” For more information about using Fsutil, see Windows XP Professional Help.

Size Limitations in NTFS and FAT File Systems

Each file system supports a maximum volume size, file size, and number of files per volume. Because FAT16 and FAT32 volumes are limited to 4 GB and 32 GB, respectively, you must use NTFS to create volumes larger than 32 GB. If you use FAT16 or FAT32 in computers that start multiple operating systems, you must note the following size limitations:

• FAT volumes smaller than 16 MB are formatted as FAT12.

• FAT16 volumes larger than 2 GB are not accessible from computers running MS-DOS, Windows 95, Windows 98, Windows Me, and many other operating systems. This limitation occurs because these operating systems do not support cluster sizes larger than 32 KB, which results in the 2 GB limit.

• In theory, FAT32 volumes can be about 8 terabytes; however, the maximum FAT32 volume size that Windows XP Professional can format is 32 GB. Therefore, you must use NTFS to format volumes larger than 32 GB. However, Windows XP Professional can read and write to larger FAT32 volumes formatted by other operating systems.

• If you create multidisk volumes such as spanned or striped volumes, the amount of space used on each disk is applied to the total size of the volume. Therefore, to create a multidisk volume that is larger than 32 GB, you must use NTFS.

For more information about FAT16 and FAT32, see “Comparing FAT File Systems” later in this chapter.

Maximum Sizes on NTFS Volumes

In theory, the maximum NTFS volume size is 264 clusters minus 1 cluster. However, the maximum NTFS volume size as implemented in Windows XP Professional is 232 clusters minus 1 cluster. For example, using 64-KB clusters, the maximum NTFS volume size is 256 terabytes minus 64 KB. Using the default cluster size of 4 KB, the maximum NTFS volume size is 16 terabytes minus 4 KB.

Because partition tables on master boot record (MBR) disks support only partition sizes up to 2 terabytes, you must use dynamic volumes to create NTFS volumes over 2 terabytes. Windows XP Professional manages dynamic volumes in a special database instead of in the partition table, so dynamic volumes are not subject to the 2-terabyte physical limit imposed by the partition table. Therefore, dynamic NTFS volumes can be as large as the maximum volume size supported by NTFS.

64-bit computers that use GUID partition table (GPT) disks also support NTFS volumes larger than 2 terabytes.

Note If you use a large number of files in an NTFS folder (300,000 or more), disable short-file name generation, especially if the first six characters of the long file names are similar. For more information, see “Optimizing NTFS Performance” later in this chapter.

Table 13-5 lists NTFS size limits.

Table 13-5 NTFS Size Limits

Description	Limit
Maximum file size	Theory: 16 exabytes minus 1 KB (264 bytes minus 1 KB) Implementation: 16 terabytes minus 64 KB (244 bytes minus 64 KB)
Maximum volume size	Theory: 264 clusters minus 1 cluster Implementation: 256 terabytes minus 64 KB (232 clusters minus 1 cluster)
Files per volume	4,294,967,295 (232 files minus 1 file)

Maximum Sizes on FAT32 Volumes

A FAT32 volume must have a minimum of 65,527 clusters. Windows XP Professional can format FAT32 volumes up to 32 GB, but it can mount larger FAT32 volumes created by other operating systems. Table 13-6 lists FAT32 size limits.

Table 13-6 FAT32 Size Limits

Description	Limit
Maximum file size	4 GB minus 1 byte (232 bytes minus 1 byte)
Maximum volume size	32 GB (implementation)
Files per volume	4,177,920
Maximum number of files and subfolders within a single folder	65,534 (The use of long file names can significantly reduce the number of available files and subfolders within a folder.)

Maximum Sizes on FAT16 Volumes

FAT16 supports a maximum of 65,524 clusters per volume. Table 13-7 lists FAT16 size limits.

Table 13-7 FAT16 Size Limits

Description	Limit
Maximum file size	4 GB minus 1 byte (232 bytes minus 1 byte)
Maximum volume size	4 GB
Files per volume	Approximately 65,536 (216 files)
Maximum number of files and folders within the root folder	512 (Long file names can reduce the number of available files and folders in the root folder.)

Formatting a Volume

You choose a file system when you format a volume. During the format, Windows XP Professional places key file system structures on the volume. These structures include the boot sector, the file allocation table (for FAT volumes), and the master file table (for NTFS volumes). Depending on the program you use to format a volume, you can also choose one or more of the following formatting options.

Volume label

Specifies the name of the volume using up to 11 characters for FAT volumes and 32 characters for NTFS volumes. Volume labels make it easy to identify volumes when you view them in Microsoft Windows Explorer, My Computer, and Disk Management.

Quick format

Creates the file system structure on the volume without verifying the integrity of every sector in the volume, which increases the formatting speed. If the volume is already formatted and you are sure the disk is not damaged, use this option. If quick format fails, perform the format again without using quick format. A full format identifies and tracks bad sectors so that they are not used for storing data.

Note You must use the quick format option if you format a volume created on a third-party hardware-based RAID array that supports pre-allocating space for future use even though the physical disks do not have this space available. In this case, if you do not choose the quick format option, the format does not complete because Windows XP Professional cannot read every sector on the disk.

Enable compression

Compresses all files in the NTFS volume. For more information about compression, see “File Compression” later in this chapter.

Allocation unit (cluster) size

Specifies the cluster size to be used when the volume is formatted. Use the default size unless you want to choose a different cluster size for performance reasons. For more information about the impact of cluster sizes on performance, see “Optimizing NTFS Performance” later in this chapter.

The available formatting options vary according to the program you use to format the volume. Table 13-8 describes the programs that you can use to format a volume as well as the available options for each program.

Table 13-8 Options Available When You Format a Volume

Format Option	Where the Option Is Available	Where the Option Is Available	Where the Option Is Available	Where the Option Is Available
	Setup	My Computer or Windows Explorer	Disk Management	Format Command
Volume label	No option to create a volume label.	Available for all volumes.	Available for all volumes.	Use the /v:label parameter to specify the volume label.
Quick format	Available for all volumes.	Available for all volumes.	Available for all volumes.	Use the /q parameter to specify the quick format option.
Enable compression	No option to compress the volume.	Available for NTFS volumes.	Available for NTFS volumes.	Use the /c parameter to enable compression for NTFS volumes.
Allocation unit (cluster) size	Uses the default cluster size only.	Offers default cluster sizes for FAT volumes and cluster sizes up to 4 KB for NTFS volumes.	Offers all available cluster sizes.	Use the /a:size parameter to specify the cluster size.

When you format a volume during Windows XP Professional Setup, you can choose between NTFS and FAT. The version of FAT that Setup uses depends on the size of the volume. For volumes smaller than 2 GB (2048 MB), Setup uses FAT16. For volumes 2 GB or larger, Setup uses FAT32. For volumes 32 GB or larger, Setup uses NTFS and does not offer FAT.

Disk Management requires you to format volumes on dynamic disks and GPT disks as NTFS. Use the format command to format these volumes as FAT or FAT32. For more information about dynamic disks and GPT disks, see Chapter 12, “Organizing Disks.”

Note The format command is also available in Recovery Console. For more information about using Recovery Console, see Appendix C, “Tools for Troubleshooting.”

You cannot format a volume that contains the paging file. Disk Management disables the Format menu command for paging file volumes. My Computer, Windows Explorer, and the format command display an error message when you try to format a paging file volume. You must move or delete the paging file before formatting the volume. For more information about identifying the volume that contains the paging file, see Chapter 12, “Organizing Disks.”

Using the NTFS File System

NTFS is the preferred file system for all computers running Windows XP Professional. By formatting new volumes as NTFS—or converting existing FAT volumes to NTFS—you can take advantage of features unique to NTFS such as mounted drives, encryption, disk quotas, and file and folder permissions. This section describes many of the features available on NTFS volumes, as well as issues related to recoverability, performance, and compatibility.

Features Available on NTFS Systems

This section describes the following NTFS features that are exclusive to NTFS volumes:

• File and Folder Permissions

• Encryption

• Disk Quotas

• File Compression

• Mounted Drives

• Distributed Link Tracking

• Sparse Files

• Multiple Data Streams

• POSIX Compliance

• NTFS Change Journal

• Indexing Service

File and Folder Permissions

On NTFS volumes, you can set permissions on files and folders that specify which groups and users have access, and what level of access is permitted. NTFS file and folder permissions apply to users on the local computer and to users accessing the file or folder over the network. File and folder permissions are maintained in discretionary access control lists.

Note You can also set shared folder permissions, which operate on shared folders in combination with NTFS file and folder permissions. File attributes (read-only, hidden, and system) also limit file access. For more information about shared folder permissions, see Chapter 6, “Managing Files and Folders.”

File and folder permissions on NTFS volumes are inheritable by default. This feature reduces the time required to change the permissions of many files and subfolders. For example, to change the permissions on a tree of folders, you need only to set permissions for  the top-level folder. You can also disable inherited permissions, allowing a file or subfolder to have permissions different from its parent folder. Permissions that are not inherited, but are instead defined directly on an object, are called explicit permissions.

The individual permission entries assigned to an object can be viewed in the Advanced Security Settings dialog box,  as shown in Figure 13-1.

To open the Advanced Security Settings dialog box

1. Right-click a file or folder on an NTFS volume.

2. Click Properties, click the Security tab, and then click Advanced.

   

   Figure 13-1 Advanced Security Settings dialog box

If the Security tab does not appear, the computer is not part of a domain, and simple file sharing is enabled. To view the Security tab, you must disable simple file sharing.

To disable simple file sharing

1. In My Computer, click the Tools menu, and then click Folder Options.

2. On the View tab, in Advanced settings, clear the Use simple file sharing (Recommended) check box.

   Warning You can back up and restore data on FAT and NTFS volumes. However, if you back up data from an NTFS volume and then restore it to a FAT volume, you lose security settings and other file information specific to NTFS.

Windows XP Professional offers an easy way to view which permissions are effectively granted to any specified user or group for the current object. View this information in the Effective Permissions dialog box.

Effective permissions are the result of combining permissions, both allowed and denied, from all matching entries, whether explicit or inherited. Matching entries name either the user or group directly, or a group in which the specified user or group is a member. The effective permissions are indicated by a check mark next to each permission granted to the user or group. Figure 13-2 shows the permissions assigned to the Art folder for user2.

Figure 13-2 Effective Permissions tab

Although NTFS provides access control to individual files and folders, users can perform certain actions even if permissions are set on a file or folder to prevent access. For example, you have a folder (MyFolder) containing a file (File1), and you grant Full Control to a user for the folder MyFolder. If you deny Full Control for File1, the user can still delete File1 because the Full Control permission for MyFolder consists of a set of special permissions that include Delete Subfolders and Files. This special permission allows the user to delete files within the folder, even if the special permission Delete has been denied (or not granted) to the user for File1. View the special permissions assigned to a file or folder by clicking the Edit button in the Advanced Security Settings dialog box.

To prevent File1 from being deleted, you must ensure that the user is not granted the Delete Subfolders and Files special permission on the parent folder (MyFolder), explicitly or through group membership. To do this, use the Effective Permissions tab to view the folder’s special permissions that are granted to the user. If Delete Subfolders and Files is selected, the user can delete all files within the folder.

To give the user access to the folder and its files without the ability to delete them, clear the Full Control check box and ensure that the user is not also granted Full Control via membership in another group. Although explicit permissions override inherited permissions, you cannot deny Full Control without also denying Modify, Read & Execute, List Folder Contents, Read, and Write. To prevent a user who is granted Full Control, by way of inherited group permissions, from deleting MyFolder and its files, do one of the following:

• Explicitly deny the Delete Subfolders and Files special permission for either the group or for the individual user.

• Remove inheritance from the folder and then reset the permissions for the group.

  Note Anyone who has List Folder Contents permission for a folder can view file properties on any file in the folder, even if file permissions prevent them from seeing the contents of the file.

For more information about file and folder permissions, see Chapter 17, “Managing Authorization and Access Control.”

Encryption

The Encrypting File System (EFS) uses symmetric key encryption in conjunction with public key technology to protect files and folders. Encryption ensures that only the authorized users and designated recovery agents of that file or folder can access it. Users of EFS are issued a digital certificate with a public key and private key pair. EFS uses the key set for the user who is logged on to the local computer where the private key is stored.

Users work with encrypted files and folders just as they do with any other files and folders. Encryption is transparent to any authorized users; the system decrypts the file or folder when the user opens it. When the file is saved, encryption is reapplied. However, intruders who try to access the encrypted files or folders receive an “Access denied” message if they try to open, copy, move, or rename the encrypted file or folder.

To encrypt or decrypt a folder or file, set the encryption attribute for NTFS folders and files just as you set attributes such as read-only or compressed. If you encrypt a folder, all files and subfolders created in the encrypted folder are automatically encrypted.

Tip Encrypt at the folder level to ensure that new files are automatically encrypted and that temporary files created during the editing process remain encrypted.

EFS is not available in Microsoft Windows XP Home Edition. For more information about EFS, see Chapter 18, “Using Encrypting File System.”

You can also encrypt or decrypt a file or folder using the command-line tool Cipher.exe. For more information about Cipher.exe, see Windows XP Professional Help.

Disk Quotas

Disk quotas track and control disk space usage for NTFS volumes. By using disk quotas, you can configure Windows XP Professional to:

• Log an event when a user exceeds a specified disk space warning level. The warning level specifies the point at which a user is nearing the quota limit.

• Prevent further use of disk space or log an event when a user exceeds a specified disk space limit.

Disk quotas are tracked on a per-user, per-volume basis; users are charged only for the files they own. Quotas are tracked per volume, even if the hard disk contains multiple volumes. If you have multiple shared folders on the same volume, the quotas apply to all shared folders equally, and a user’s use of all shared folders cannot exceed the assigned quota on that volume.

The disk space used by each file is charged to the user who owns the file. The file owner is identified by the security identifier (SID) in the security information for the file. The total disk space charged to a user is the sum of the length of all data streams; property set streams and resident user data streams affect the user’s quota. Small files contained entirely within the file’s master file table (MFT) record also affect the user’s quota.

Because disk quotas are based on file ownership, they are independent of the location of the files on the volume. Moving files from one folder to another on the same volume does not change volume space usage. However, copying the files to a different folder on the same volume results in duplicate files in both locations. Thus, the available volume space usage against the user’s quota decreases by the number of bytes copied.

Disk quotas are transparent to the user. When a user views the available disk space for the volume, the system reports only the user’s available quota allowance. If the user exceeds this allowance, the system indicates that the disk is full. To obtain more disk space after exceeding the quota allowance, the user must do one of the following:

• Delete files.

• Reduce the size of existing files.

• Have another user claim ownership of some files.

• Have the administrator increase the quota allowance.

Disk quotas are based on uncompressed file sizes. Users cannot increase the amount of free space by using NTFS compression to compress the files.

For sparse files, disk quotas are based on the nominal size of the sparse file, not the actual allocated amount of disk space. For example, creating a 50-MB file with all zero bytes consumes 50 MB of that user’s quota. This means the user can write data to the sparse file without exceeding the quota limit because the user has already been charged for the space. For more information about sparse files, see “Sparse Files” later in this chapter.

To enable quotas

1. Right-click a volume in Windows Explorer or My Computer.

2. Click Properties, and then click the Quota tab. (See Figure 13-3.)

3. Do the following:

   • Enable or disable disk quotas.

   • Deny disk space to users who have exceeded their quota limit.

   • Set the default warning level and quota limit assigned to new volume users.

   • Specify whether to log an event in the system log when a user reaches the quota or warning level.

     

     Figure 13-3 Quota tab

If the volume is not formatted by using NTFS, or if you are not a member of the Administrators group on the computer, the Quota tab is not displayed on the volume’s Properties dialog box.

Note You can also use the command-line tool Fsutil.exe to manage quotas. For more information about Fsutil.exe, see Windows XP Professional Help.

Disk Quota States

As the administrator, you can turn quota enforcement on and off. There are three quota states, as shown in Table 13-9.

Table 13-9 Disk Quota States

State	Description
Quota disabled	Quota usage changes are not tracked, and the quota limits are not removed. In this state, performance is not affected by disk quotas. This is the default state.
Quota tracked	Quota usage changes are tracked, but quota limits are not enforced. In this state, no quota violation events are generated and no file operations fail because of disk quota violations.
Quota enforced	Quota usage changes are tracked, and quota limits are enforced.

Warning Levels and Disk Quota Limits

When you enable disk quotas, you can set both the warning level and the quota limit.

Warning level

Specifies when a user is nearing the limit. When the disk space charged to the user exceeds the warning level, the system can generate an event in the system log on the computer hosting the volume. The user is not notified when this level is surpassed.

Quota limit

Specifies the amount of disk space allocated to a user. When the disk space charged to the user exceeds the quota limit, the system generates an event in the system log or denies additional disk space to the user. When you set quota limits on a computer that many users share, make sure to set the limit to at least 2 MB, which is greater than the default 1 KB, to ensure that Windows XP Professional can create a user profile when a user logs on to the computer.

For example, you can set a user’s disk quota limit to 500 MB, and the disk quota warning level to 450 MB. The user can store no more than 500 MB of data on the volume. If more than 450 MB are stored on the volume, the disk quota system will log an event in the system log.

Increasing Quotas for Individual Users

Figure 13-4 shows the Quota Entries window, which you open by clicking the Quota Entries button. In the Quota Entries window, view each user’s quota limit, warning level, and quota usage. You can also change the quota limit and warning level for individual users who need more disk space than the default quota.

Figure 13-4 Quota Entries window

For example, on a volume that contains a shared folder named \\Workstation1\Public, you can set a quota of 500 MB per user while giving two users each a 1-GB limit because they work with large files. If both users have files stored on \\Workstation1\Public, their current usage is displayed in the Quota Entries window.

To change the quota for an individual user

1. Open the Properties dialog box for the appropriate volume.

2. Click the Quota tab, and then click Quota Entries.

3. Select the appropriate user, right-click, and then click Properties to set the quota.

   -or-

   For a new user who does not have files stored on the volume, on the Quota menu, click New Quota Entry, and then set the quota higher than the default.

   Note Disk quotas do not prevent you from allocating more space than is available on the disk. For example, on a 40-GB volume used by 50 users, each user might be allocated 1 GB.

Disk Quotas and Administrators

A new Group Policy setting allows you to specify the default owner of objects (such as files) created by members of the Administrators group. Access the Group Policy setting System objects: Default owner for objects created by members of the administrators group in Local Computer Policy\Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options. In Windows XP Professional, the default owner is the object creator. To change the default owner to the Administrators group, use the Group Policy snap-in. For more information about using the Group Policy snap-in, see Chapter 5, “Managing Desktops.”

Although members of the Administrators group do not have quotas enabled by default, you can set quotas for all members of the Administrators group except the built-in Administrator account. In Windows 2000, you cannot set quotas for any member of the Administrators group.

Exceeding Disk Quota Limits

When you select Deny disk space to users exceeding quota limit on the Quota tab of the Properties dialog box, users who exceed their limit receive an “Insufficient disk space” error message and cannot write additional data to the volume without deleting or moving files. Individual programs determine their own error handling for this condition. The program treats the volume as full.

By leaving the Deny disk space to users exceeding quota limit check box cleared, you can let users exceed their quota. This is useful to track use of disk space without denying users access to a volume. You can also specify whether to log an event to the volume host computer’s system log when users exceed either their quota or warning level.

Event Viewer keeps a chronological record of users who exceed their quota or warning level. However, it does not provide information about which users are currently over their quota warning level.

Note Use the fsutil behavior set quotanotify command to set the interval between quota-related events that NTFS records in the system log. For more information about this command, see Windows XP Professional Help.

Deleting Quota Entries

To delete the quota entry for a user, you must first do any of the following:

• Permanently delete the files.

• Take ownership of the files and folders.

• Move the files to a different volume.

You cannot delete quota entries if a user owns files or folders on the volume. If you try to delete a quota entry for a user who still owns files or folders on the volume, a dialog box appears as shown in Figure 13-5.

Figure 13-5 The Disk Quota dialog box

If the user owns files on the volume, use the Disk Quota dialog box to delete the files, take ownership of them, or move them to another volume. However, if the user owns folders on the volume, you can use the Disk Quota dialog box only to take ownership of the folders, not delete or move them. To make it easier to take ownership of folders, click the Show folders only check box.

Local and Remote Implementations of Disk Quotas

You can enable disk quotas on local computers and remote computers. On local computers, use quotas to do the following:

• Prevent users from using excessive disk space on a shared folder on your computer.

• Limit the amount of space available to users who log on to the local computer.

On remote computers, quotas can ensure the following:

• Disk space on public servers is not monopolized by one or a few users.

• Information technology (IT) budget for mass storage is managed efficiently by making users account for the use of shared disk space by using public disk space only for necessary files.

You can manage NTFS volumes on remote computers running Windows XP Professional, Windows 2000, and Windows Server 2003. The volumes must be formatted by using NTFS and be shared from the root folder of the volume. Set quotas on the remote volume by mapping to it using Windows Explorer or My Computer.

To set quotas on a mapped remote volume

1. Right-click the mapped remote volume.

2. Click Properties, and then click the Quota tab.

   Note You must be a member of the Administrators group on the remote computer to enable, disable, or manage quotas.

Auditing Disk Space Use

Enabling quotas causes a slight decrease in file system performance. By periodically enabling and disabling quotas, you can take advantage of the auditing capabilities provided by Windows XP Professional disk quotas without permanently affecting performance.

To create a record of the audit, save a copy of the system log data from Event Viewer to a comma-delimited file that can be read by programs such as Microsoft Excel. These files can be useful for analyzing the data captured.

Note When you disable quotas, the tracking information displayed in the Quota Entries window is no longer updated. To refresh this information (including the current disk space used by each user), enable disk quotas again.

Disk Quotas in Multiple-Boot Configurations

Disk quotas are not enforced and can be exceeded in multiple-boot configurations when an NTFS volume is mounted by using Windows NT 4.0. However, when that computer resumes running Windows XP Professional, users who exceeded their quotas must delete or move files to a different volume—that is, until they are under their limit—before they can store new files to the quota volume. Disk quotas are enforced on computers configured as a multiple-boot system with Windows XP Professional and Windows 2000 or Windows Server 2003.

Using WMI to Script Disk Quotas

Microsoft Windows Management Instrumentation (WMI) is the application programming interface (API) that allows all system components to be monitored and controlled, either locally or remotely. Using the WMI classes Win32_DiskQuota, Win32_QuotaSettings, and Win32_VolumeQuotaSetting, you can create scripts that help you to do the following:

• View and modify the quota settings for users for all disks on a computer by:

  • Viewing the status of the quota

  • Reporting or setting the warning level

  • Reporting or setting the quota limit

  • Reporting how much space is being used for a specified user

• View and modify the quota settings and defaults for each disk on a computer by:

  • Reporting or setting the operational state of quotas on a disk (disabled, tracked, or enforced)

  • Reporting or setting the default warning level

  • Reporting or setting the default quota limit

  • Enabling or disabling the logging of warning levels being exceeded

  • Enabling or disabling the logging of quota limits being exceeded

Using these classes, you can take advantage of other standard WMI features such as WMI Query Language (WQL) query support and event generation based on changes in the data in these classes. For example, a program can request that it be notified when a user is within 2 MB of the quota limit. When this criterion is met, WMI sends an event notification to the program, allowing an action such as increasing the quota or sending an e-mail message to the user.

Note WQL is a subset of Structured Query Language (SQL) with minor changes to support WMI.

For more information about WMI, see the Microsoft Windows Management Instrumentation (WMI) SDK link on the Web Resources page at https://www.microsoft.com/windows/reskits/webresources.

File Compression

NTFS supports compression on individual files, all files within a folder, and all files within NTFS volumes. Because compression is implemented within NTFS, any Windows-based program can read and write compressed files without determining the compression state of the file. When a program opens a compressed file, NTFS decompresses only the portion of the file being read and then copies that data to memory. By leaving data in memory uncompressed, NTFS performance is not affected when it reads or modifies data in memory. NTFS compresses the modified or new data in the file when the data is later written to disk.

The compression algorithms in NTFS support cluster sizes of up to 4 KB. When the cluster size is greater than 4 KB on an NTFS volume, none of the NTFS compression features are available.

Using Windows Explorer or My Computer to compress files

Using Windows Explorer or My Computer, you can set the compression state of a file on an NTFS volume. You can also set the compression state of a folder or volume without changing the compression state of existing files in that folder.

If you have Modify permission for a file or folder, you can change its compression state locally or across a network.

To set the compression state of a volume

1. In My Computer or Windows Explorer, right-click the volume to compress or uncompress.

2. Click Properties to display the Properties dialog box.

3. On the General tab, select or clear the Compress drive to save disk space check box, and then click OK.

4. In the Confirm Attribute Changes dialog box, select whether to make the compression apply to the entire volume or only to the root folder.

Any change to the compression attribute is applied to the files you specified. If you compress all files in the volume, the process might take a few minutes to finish, depending on the size of the volume, the number of files to compress, and the speed of the computer. The delay occurs because Windows XP Professional must change the compression state of every folder on the volume and compress or uncompress every file on the volume. Changing the compression state of folders is relatively fast because for each folder Windows XP Professional changes only the compression attribute. However, compressing or uncompressing every file on the volume takes longer because NTFS must read data in its current form (compressed or uncompressed) from the disk, convert the data to its new form in memory, and then write the data back to disk.

To set the compression state of a folder or file

1. In My Computer or Windows Explorer, right-click the file or folder to compress or decompress.

2. Click Properties to display the Properties dialog box.

3. On the General tab, click Advanced.

4. In the Advanced Attributes dialog box, select or clear the Compress contents to save disk space check box and then click OK.

5. In the Properties dialog box, click OK.

6. If the compression state was altered for a folder, in the Confirm Attribute Changes dialog box, select whether to make the compression apply only to the selected folder or to the selected folder and all its files and subfolders. Click OK when done.

   Note Windows XP Professional can compress closed paging files. However, when you restart Windows XP Professional, the paging files revert to an uncompressed state. For information about paging files, see the topics on virtual memory in Windows XP Professional Help.

You can set Windows Explorer to display alternate colors for compressed files and folders by using the following procedure:

To display alternate colors for compressed files and folders

1. In My Computer or Windows Explorer, click the Tools menu, and then click Folder Options.

2. On the View tab, select the Show encrypted or compressed NTFS files in color check box.

3. Click OK to return to Windows Explorer or My Computer.

Using Compact to compress a volume

Compact.exe is the command-line version of the compression feature in Windows Explorer and My Computer. Compact displays and alters the compression of folders and files on NTFS volumes. It also displays the compression state of folders.

Three reasons to use Compact instead of Windows Explorer or My Computer follow:

• You can use Compact in a batch script.

• If the system fails during compression or decompression, the operation might not have finished. Use the /f parameter to force the operation to finish in the background.

• You can compress or uncompress files that match certain criteria. For example, to compress all .txt files in the current folder, type:

  compact /c *.txt

The following list provides examples of Compact syntax.

• To compress a volume, from the root folder of the volume, type:

  compact /c /i /s:\

  The preceding example sets the compression state of the root folder and all folders on the volume and compresses every file on the volume. Using the /i parameter ensures that error messages do not interrupt the compression process.

• To set the compression state of the current folder and its subfolders and existing files, from the current folder, type:

  compact /c /s

• To set the compression state of files in the current folder, subfolders in the current folder, and files within all subfolders—without altering the compression state of the current folder—from the current folder, type:

  compact /c /s *.*

For more information about Compact, see Windows XP Professional Help.

Effects of compression on moving and copying files

Moving and copying files and folders can change their compression state. The resulting compression state depends on whether you move or copy the files and whether you move files between NTFS volumes or to FAT volumes.

Note The default behavior for dragging and dropping files and folders in Windows Explorer and My Computer depends on the relationship between the source and the target location. If the selected item is dragged to a folder on the same volume, the item is moved. If the selected item is dragged to a folder on a different volume, the item is copied. To force a copy, press Ctrl as you drag and drop the item to its new location. To force a move, press Shift as you drag and drop it to the new location. If you right-click and drag the selected item, a shortcut menu appears so that you can choose to copy the item, move the item, create a shortcut to the item, or cancel the task.

Moving files or folders within an NTFS volume

When you move an uncompressed file or folder to another folder on the same NTFS volume, the file remains uncompressed, regardless of the compression state of the folder to which it was moved, as shown in Figure 13-6.

Figure 13-6 Moving an uncompressed file to a compressed folder

When you move a compressed file or folder to another folder, the file remains compressed after the move, regardless of the compression state of the folder, as shown in Figure 13-7.

Figure 13-7 Moving a compressed file to an uncompressed folder

Copying files or folders on NTFS volumes

When you copy a file to a folder, the file takes on the compression attribute of the target folder. For example, if you copy a compressed file to an uncompressed folder, the file is uncompressed when it is copied to the folder, as shown in Figure 13-8.

Figure 13-8 Copying a compressed file to an uncompressed folder

When you copy a file to a folder that already contains a file of the same name, the copied file takes on the compression attribute of the target file, regardless of the compression state of the folder, as shown in Figure 13-9.

Figure 13-9 Copying a file to a folder that contains a file of the same name

Copying files between FAT and NTFS volumes

Like files copied between NTFS folders, files copied from a FAT folder to an NTFS folder take on the compression attribute of the target folder. Because Windows XP Professional supports compression only on NTFS volumes, compressed NTFS files copied to a FAT volume are uncompressed. Similarly, compressed NTFS files copied to a floppy disk are uncompressed.

Caution When you copy a file from an NTFS volume to a FAT volume, any NTFS-specific properties associated with that file, such as permissions and data streams, are permanently lost.

Adding files to an almost full NTFS volume

As a best practice for using compression, ensure that you have at least 15 percent free space on the volume. If you copy files to a compressed NTFS folder that does not have room for the files in an uncompressed state, an error message indicates the disk lacks adequate space. A message might also appear if you attempt to read a compressed file on a volume that is almost full. These messages appear because NTFS must reserve enough space to support the possibility that any file that is read into memory might be modified and that the modified data might be written uncompressed to disk.  After the files are flushed to disk, NTFS releases any remaining reserved space.

Regain space that NTFS has reserved for open files by dismounting and then remounting the volume or by restarting the computer. Temporarily dismount a volume by using the fsutil volume dismount command. The volume is remounted the next time you access it.

NTFS compression performance

Workstations are good candidates for compression because compression and decompression are performed locally. Heavily loaded servers that have substantial input/output (I/O) traffic are poor candidates for data compression. Because the server must decompress files before sending them across the network, the decompression workload can cause performance degradation on the server. However, read-only servers, read-mostly servers, or servers that store infrequently accessed files might not get performance degradation. For example, if 50 percent of the files on a server are frequently accessed and are close to 100 percent of the server’s I/O workload, do not compress those files. If the other 50 percent of files are accessed once every few days and account for less than 1 percent of the server workload, you might want to compress them.

If your workload involves asynchronous I/O, do not use compression. Compression converts all I/O to synchronous.

If you have programs that use transaction logging and constantly write to a database or log, have the programs store their files on an uncompressed volume. If a program modifies data by using mapped sections in a compressed file, it can produce dirty pages faster than the mapped writer can write them. (A dirty page is a page that has been modified in the cache but is not yet written to disk.) For example, programs such as Microsoft Message Queue cannot function on compressed NTFS volumes.

Avoid placing user home folders and roaming profiles on compressed NTFS volumes because of the large number of read and write operations performed in these folders.

For information about the effect of compression on NTFS performance, see “Optimizing NTFS Performance” later in this chapter.

Other compression methods

In addition to using NTFS compression, you can use the Compressed (zipped) Folders feature in Windows XP Professional and other compression tools.

Using the Compressed (zipped) Folders feature

Use the Compressed (zipped) Folders feature in Windows XP Professional to create, add files to, and extract files from zipped files. In Windows Explorer and My Computer, a zipper on the folder icon identifies Compressed (zipped) Folders. Unlike in NTFS compression, you can create Compressed (zipped) Folders on any FAT or NTFS volume. In addition, Compressed (zipped) Folders are compatible with other programs that create zipped files, so you can share them with users who use other compression programs that support zipped files.

To create a Compressed (Zipped) Folder

• In Windows Explorer or My Computer, click the File menu, point to New, and then click Compressed (zipped) Folder.

Compress files, programs, or other folders by dragging them to a Compressed Folder.  To use files inside a compressed folder, select Extract All from the File menu or right-click a file and select Open from the shortcut menu.

For more information about using the Compressed (zipped) Folders feature, see Windows XP Professional Help.

Other compression tools

Other compression tools are available to compress files on computers running Windows XP Professional. These tools differ from NTFS compression in the following ways:

• They typically run from either the command line or as a stand-alone application.

• They can be used to compress files on FAT volumes as well as NTFS volumes.

• Files cannot be opened when they are in a compressed state; the file must first be decompressed. When you close the file, it is saved in an uncompressed state, and you must use a program to compress it.

NTFS compression differs from DoubleSpace, DriveSpace, and DriveSpace 3 compression in several ways. For example, NTFS provides faster compression and decompression with minimal loss of compression for a typical text file. Another difference is that these programs compress the entire volume, including the metadata associated with each file and folder. Using NTFS compression, you can compress individual files or folders instead of the entire volume and compress only files you use infrequently.

Note Use the Disk Cleanup tool to compress files that have not been accessed for a specified number of days. For more information about Disk Cleanup, see Windows XP Professional Help.

Mounted Drives

Mounted drives, also known as volume mount points or drive paths, are volumes attached to an empty folder on an NTFS volume. Mounted drives function the same way as any other volume, but they are assigned a label or name instead of a drive letter. Mounted drives are robust against system changes that occur when devices are added or removed from a computer. They are not subject to the 26-volume limit imposed by drive letters, so you can use them for access to more than 26 volumes on your computer.

The version of NTFS included with Windows XP Professional and Windows 2000 must be used on the host volume. However, the volume to be mounted can be formatted in any file system supported by Windows XP Professional, including NTFS, FAT16, FAT32, CDFS, or UDF.

One volume can host multiple mounted drives, providing a way for you to easily extend the storage capacity of any particular volume on a Windows XP Professional system. Users on the local system or users who connect to it over a network can continue to use the same drive letter for access to the volume, but multiple volumes can be in use simultaneously from that drive letter.

Note To identify and manage mounted drives from the command line, use the Mountvol.exe tool. For more information about Mountvol.exe, see Windows XP Professional Help.

The following scenario is an example of mounted drives. A user recently installed Windows XP Professional on volume C, an NTFS volume. She is concerned about storage space on this volume because she uses her computer extensively to create and edit digital photos, graphic art, and desktop publishing (DTP) files. The user knows that the default document folder, My Documents, is on volume C, but she wants to use the E volume on her second hard disk to store her work. She creates a mounted drive on volume C under the My Documents folder labeled Art. Any subfolder of the Art folder actually resides on volume E, thus saving space on volume C.

To create a mounted drive, you must be a member of the Administrators group on the local computer.

To create a mounted drive under C:\My Documents

1. Log on to the computer using an account that is a member of the Administrators group.

2. Click Start, click Run, type diskmgmt.msc, and then click OK.

3. Right-click volume E, and then click Change Drive Letter and Paths.

4. In the Change Drive Letter and Paths dialog box, click Add, click Mount in the following empty NTFS folder, and then click Browse.

5. In the Browse for Drive Path dialog box, expand drive C, go to the C:\Documents and Settings\username\My Documents folder, and then click New Folder.

6. In the folder name placeholder in the Explorer tree, type the name Art over the default name New Folder and then close the dialog boxes.

7. In My Computer or Windows Explorer, go to volume E and create new folders such as Photos, LineArt, and DTP for the graphic arts documents.

As shown in Figure 13-10, all files stored in the My Documents\Art folder are stored in the root folder of volume E, the mounted drive. Any other folder created within Windows Explorer or My Computer under the My Documents folder still resides on volume C.

Figure 13-10 A mounted drive in My Documents

Hard Links

Use the fsutil hardlink create command to create hard links. A hard link is an NTFS-based link to a given file. When you create a hard link to a file on an NTFS volume, NTFS adds a directory entry for the hard link without duplicating the original file. You can create hard links that

• Use the same file name as the original file but appear in different folders.

• Use different file names from the original file but appear in the same folder.

• Use different file names from the original file and appear in different folders.

Because a hard link is a directory entry for a file, an application can modify a file by using any of its hard links. Applications that use any other hard link can detect the changes. However, directory entries for hard links are updated only when a user accesses a file by using the hard link. For example, if a user opens and modifies a file by using its hard link, and the size of the original file changes, the hard link that is used to access the file also shows the new size.

Warning NTFS updates the properties of a hard link only when a user accesses the original file by using the hard link, not every time a user makes a change to the original file.

Hard links do not have security descriptors; instead, the security descriptor belongs to the original file to which the hard link points. Thus, if you change the security descriptor of any hard link, you actually change the underlying file’s security descriptor. All hard links that point to the file allow the newly specified access. You cannot give a file different security descriptors based on different hard links.

When creating hard links, consider the following:

• You can create hard links only on NTFS volumes; not on FAT volumes.

• You cannot create a hard link on one volume that refers to a file on another volume.

To delete a file that has multiple hard links, you must delete the file and all its associated hard links.

For more information about using the fsutil hardlink create command, see Windows XP Professional Help.

Distributed Link Tracking

Distributed link tracking ensures that shell shortcuts and OLE links continue to work after the target file is renamed or moved. When you create a shortcut to a file on an NTFS volume, distributed link tracking stamps a unique object identifier (ID) into the target file, known as the link source. Information about the object ID is also stored within the referring file, known as the link client. Distributed link tracking uses this object ID to locate the link source in any combination of the following events that occur on NTFS volumes within a Windows 2000-based domain:

• The link source is renamed.

• The link source is moved to another folder on the same volume or to a different volume on the same computer.

• The link source is moved from one shared network folder to another shared network folder on other computers within the same domain.

• The computer containing the link source is renamed.

• The name of the shared network folder containing the link source has changed.

• The volume containing the link source is moved to another computer within the same domain.

  Note Distributed link tracking works only on NTFS volumes in computers running Windows 2000, Windows Server 2003, or Windows XP. The NTFS volumes cannot be on removable media.

Distributed link tracking attempts to maintain links even when they do not occur within a domain, such as cross-domain, within a workgroup, or on a single computer that is not connected to a network. Links can always be maintained in these events when a link source is moved within a computer, or when the network shared folder on the link source computer is changed. Typically, links can be maintained when the link source is moved to another computer; however, this form of tracking is less reliable over time.

Distributed link tracking uses different services for client and server:

• The Distributed Link Tracking Client service runs on all Windows 2000 and Windows XP Professional computers. (On Windows Server 2003 computers, this service is stopped and has its startup type set to Manual by default.) In computers that are not part of a network, the Client service performs all activities related to link tracking.

• The Distributed Link Tracking Server service is installed on servers running Windows 2000 and Windows Server 2003. (On Windows Server 2003, this service is stopped and has its startup type set to Disabled by default.) The Server service maintains information relating to the movement of link sources. Because of this service and the information it maintains, links within a domain are more reliable than those outside a domain. For computers that run in a domain, the Distributed Link Tracking Client service takes advantage of this information by communicating with the Distributed Link Tracking Server service.

The Distributed Link Tracking Client service monitors activity on NTFS volumes and stores maintenance information in a file called Tracking.log, which is located at the root of each volume in a hidden folder called System Volume Information. This folder is protected by permissions that allow only the system to have access to it. The System Volume Information folder is also used by other Windows XP Professional services such as Indexing Service.

Sparse Files

Sparse files provide a method of saving disk space for files that contain meaningful data as well as large sections of data composed of zeros. If an NTFS file is marked as sparse, NTFS allocates disk clusters only for the data explicitly specified by the application. Nonspecified ranges of the file are represented by nonallocated space on the disk. When a sparse file is read from allocated ranges, the data is returned as it was stored. Data read from nonallocated ranges is returned as zeros. An example of a program that uses sparse files is Indexing Service, which stores its catalogs as sparse files on NTFS volumes.

File system application programming interfaces (APIs) allow for the file to be copied or backed as actual bits and sparse stream ranges. File system APIs also allow for querying allocated ranges. Programs that implement these APIs then need only to read allocated ranges to recover all data in the file. The result is efficient file system storage and access. Figure 13-11 shows how data is stored with and without the sparse file attribute set.

Figure 13-11 Sparse data storage

Figure 13-12 shows the properties of a 1-GB sparse file. Although the file is 1 GB, it occupies only 64 KB of disk space.

Figure 13-12 Properties of a sparse file

Warning Only NTFS volumes mounted by Windows 2000, Windows Server 2003, or Windows XP support sparse files. If you copy or move a sparse file to a FAT volume or an NTFS volume mounted by an operating system other than Windows XP, Windows Server 2003, or Windows 2000, the file is built to its originally specified size. If the required space is not available, the operation fails.

Multiple Data Streams

A data stream is a sequence of bytes. An application populates the stream by writing data at specific offsets within the stream. The application can then read the data by reading the same offsets in the read path. Every file has a main, unnamed stream associated with it, regardless of the file system used. However, NTFS supports additional named data streams in which each data stream is an alternate sequence of bytes as illustrated in Figure 13-13. Applications can create additional named streams and access the streams by referring to their names. This feature permits related data to be managed as a single unit. For example, a graphics program can store a thumbnail image of a bitmap in a named data stream within the NTFS file containing the image.

Figure 13-13 Unnamed and named streams for StreamExample.doc

To see how data streams work, create a file that contains multiple data streams by adding summary information to a file on an NTFS volume.

To create a data stream for a file on an NTFS volume

1. Right-click a text file or Wordpad document, and then click Properties.

2. On the Summary tab, add information about the file, such as the title, subject, and author.

The file information is stored in separate named streams. Figure 13-14 shows the Summary tab of the file StreamExample.doc.

Figure 13-14 Creating alternate data streams by using the Summary tab

FAT volumes support only the main, unnamed stream, so if you try to copy or move StreamExample.doc to a FAT volume or floppy disk, you receive an error message as shown in Figure 13-15. If you copy the file, all named data streams and other attributes not supported by FAT are lost.

Figure 13-15 Message that confirms loss of named data streams

POSIX Compliance

NTFS provides several features to support the Portable Operating System Interface (POSIX) standard, which is defined by the Institute of Electrical and Electronic Engineers (IEEE) standard 1003.1-1990 (also known as ISO/IEC 9945-1:1990).

NTFS includes the following POSIX-compliant features.

Case-sensitive naming

For example, POSIX interprets README.TXT, Readme.txt, and readme.txt as separate files.

Hard links

A file can have more than one name. This allows two different file names, which can be in different folders on the same volume, to point to the same data.

Additional time stamps

These show when the file was last accessed or modified.

The POSIX subsystem included with Windows NT and Windows 2000 is not included with Windows XP Professional. A new subsystem supporting the broad functionality found on most UNIX systems beyond the POSIX.1 standard is shipped as part of Interix 2.2. The Interix subsystem can be certified to the NIST FIPS 151-2 POSIX Conformance Test Suite.

For more information about Interix 2.2, see the Windows Interix 2.2 link on the Web Resources page https://www.microsoft.com/windows/reskits/webresources.

Caution You must use Interix-based programs to manage file names that differ only in case. You cannot use standard Windows XP Professional command-line tools (such as copy, del, and move, or their equivalents in Windows Explorer or My Computer) to manage file names that differ only in case.

NTFS Change Journal

The change journal provides a persistent log of changes made to files on a volume. NTFS uses the change journal to track information about added, deleted, and modified files for each volume. The change journal describes the nature of any changes to files on the volume. When any file or folder is created, modified, or deleted, NTFS adds a record to the change journal for that volume.

The total size of all the records currently in the journal varies, but there is a configurable maximum size. The change journal can exceed the maximum size until the size reaches an outer threshold, at which point a portion of the oldest records are deleted until the change journal is restored to its maximum size. The maximum size of the change journal is configurable but cannot be reduced, only increased.

The change journal conveys significant scalability benefits to applications that might otherwise need to scan an entire volume for changes. File system indexing, replication managers, virus scanners, and incremental backup applications can benefit from using the change journal.

The change journal is much more efficient than time stamps or file notifications for determining changes in a particular namespace. Applications that must rescan an entire volume to determine changes can now scan once and subsequently refer to the change journal. The I/O cost depends on how many files have changed, not on how many files exist on the volume.

The APIs are fully documented and can be leveraged by independent software vendors (ISVs). Microsoft uses the change journal in Windows XP Professional components such as the Indexing Service and File Replication Service. ISVs can use this feature to enhance the scalability and robustness of a range of products including backup, antivirus, and auditing tools.

For more information about the change journal, see the Microsoft Platform SDK link on the Web Resources page at https://www.microsoft.com/windows/reskits/webresources.

Indexing Service

Indexing Service extracts information from a set of documents and organizes it for easy access through the Windows XP Professional Search function, the Indexing Service query form, or a Web browser. After the index is created, users can query the index for documents that contain key words, phrases, or properties. For example, a user can query all documents containing the word “product” or query for all Microsoft Office documents written by a specific author. Indexing Service returns a list of all documents that meet the search criteria.

Although you can run Indexing Service on volumes formatted using any supported file system, Indexing Service works best on NTFS volumes because it uses several NTFS advanced features.

Change journal

After you enable Indexing Service and it completes the first scan of the NTFS volume, additional time-intensive disk scans are not required because Indexing Service uses the change journal to detect file additions, deletions, and modifications. On NTFS volumes, the disk I/O required to update the index is proportional to the number of files that have actually changed. On FAT volumes, Indexing Service must periodically scan all files to locate changes, making the disk I/O proportional to the number of files on the computer that are marked for indexing. Without using Indexing Service, Windows XP Professional must open, read, and close every file in the search, resulting in thousands of disk I/Os per search.

Sparse files

Indexing Service stores the index as a sparse file on NTFS volumes, reducing the size of the index by half when compared to the index size on FAT volumes.

Permissions

Indexing Service does not compromise information security. On NTFS volumes, if a user does not have Read permission for a file, Indexing Service does not return that file in the results list to the user. Similarly, Indexing Service does not indicate that a match was found if the file cannot be accessed.

Encryption

Indexing Service never indexes encrypted documents. If a document is encrypted after it is indexed, it is removed from the catalog.

Indexing Service is disabled by default. For more information about enabling Indexing Service, see Windows XP Professional Help.

Converting Volumes to NTFS

Windows XP Professional can convert FAT16, FAT32, and previous versions of NTFS to the new version of NTFS used in Windows XP.

Converting NTFS Volumes Formatted by Using Windows 2000

When Windows XP Professional first mounts an NTFS volume that was formatted in Windows 2000, Windows XP Professional converts the NTFS volume to NTFS 3.1. The conversion consists of changing the NTFS version from 3.0 to 3.1. No other changes are made to existing metadata or files on the volume. However, Windows XP Professional uses a different header style for new files created on NTFS 3.1 volumes. As a result, some older third-party imaging programs cannot create images of NTFS 3.1 volumes. Contact the manufacturer of your imaging program to find out if a version is available that supports NTFS 3.1 volumes in Windows XP Professional.

Computers running Windows NT 4.0 with Service Pack 4 or later or Windows 2000 can access NTFS 3.1 volumes without any conversion or additional service packs.

Converting NTFS Volumes Formatted by Using Windows NT 4.0 and Earlier

When you upgrade from Windows NT 4.0 to Windows XP Professional, all local volumes formatted by using the version of NTFS used in Windows NT 4.0 and earlier are upgraded to NTFS 3.1. The upgrade occurs when Windows XP Professional mounts the volume for the first time after Windows XP Professional Setup is completed. (The upgrade does not take place during Setup.) Any NTFS volumes that are removed or turned off during Setup, or added after Setup, are converted when Windows XP Professional mounts the volumes.

The Ntfs.sys driver performs the conversion by determining which version of NTFS is used on the volume and converting the volume if necessary. The conversion takes only a few seconds on any size volume and consists of the following new records in the master file table:

• $Secure, which contains unique security descriptors for all files within a volume.

• $Extend, which is used for extensions such as quotas, reparse point data, and object identifiers. The conversion process also adds three new files the to $Extend directory:

  • $Quota, used for disk quotas.

  • $Reparse, used for reparse points.

  • $ObjID, used for distributed link tracking.

Both $Secure and $Extend take the place of previously unused master file table (MFT) records, so sufficient space always exists in the volume for these two records. However, $Quota, $Reparse, and $ObjID are new additions to the MFT, and you must have enough free space in the volume to contain these files, or the conversion fails.

If the conversion fails, the volume is still available, but you can perform only NTFS-related tasks that were available in Windows NT 4.0 or earlier. To convert the volume to the version of NTFS used in Windows XP Professional, you must free disk space by deleting or moving files and then dismount the volume by using the fsutil volume dismount command. When Windows XP Professional mounts the volume and enough space exists, the conversion is completed. (You can also restart the computer to dismount the volume and complete the conversion.)

Note Removable media formatted by using the previous version of NTFS is upgraded after the installation or upgrade process, or when you insert the media and Windows XP Professional mounts it.

NTFS Conversion Issues for FAT Volumes

Before you convert a FAT or FAT32 volume to NTFS, you must consider the following issues:

• You cannot uninstall Windows XP Professional if you convert any volume to NTFS. For more information, see Chapter 4, “Supporting Installations.”

• Despite a minimal chance of corruption or data loss during the conversion from FAT to NTFS, perform a full backup of the data on the volume to be converted before you execute the convert command. Verify the integrity of the backup before proceeding.

• The conversion is a one-way process. After you convert a volume to NTFS, you cannot reconvert the volume to FAT without backing up your data, reformatting the volume as FAT, and then restoring your data.

• The first step of the conversion process is running the Chkdsk tool. Because Chkdsk can increase the time required to complete the conversion, you must take this factor into account when you plan the conversion. Until the conversion is completed, the FAT volume and its data are unavailable. For more information about determining how long Chkdsk will run, see Chapter 28, “Troubleshooting Disks and File Systems.”

• To convert the file system, the Convert tool requires a certain amount of free space on the volume and sufficient memory to update the cache. For a detailed description of the amount of free space required for a conversion, see article 156560, “Free Space Required to Convert FAT to NTFS,” in the Microsoft Knowledge Base. To find this article, see the Microsoft Knowledge Base link on the Web Resources page at https://www.microsoft.com/windows/reskits/webresources.

• In multiple-boot configurations, NTFS volumes are accessible only by using Windows NT 4.0 with Service Pack 4 or later, Windows 2000, Windows Server 2003, or Windows XP. For more information about using NTFS in multiple-boot configurations, see “NTFS Compatibility with Windows NT 4.0” later in this chapter.

• When you install Recovery Console onto a volume that is formatted for either the FAT16 or FAT32 file systems and then use Convert.exe to convert the volume to NTFS, the Recovery Console no longer runs. This problem occurs because the file-system-specific boot files (in the \cmdcons folder of the system volume) that are used to run Recovery Console are not valid for a volume that has been converted to NTFS. To resolve this problem, re-install Recovery Console from the Windows XP Professional operating system CD after the conversion. You can also use the Windows XP Professional operating system CD to start Recovery Console.

• Because the format command in Windows XP Professional aligns FAT data clusters at the cluster size boundary, Convert.exe can preserve the cluster size for the size of the volume (up to 4 KB) instead of using the 512-byte cluster size used in Windows 2000 for converted volumes. Table 13-10 lists the cluster sizes used for volumes converted to NTFS.

  Table 13-10 Cluster Sizes for Volumes Converted to NTFS

  Original FAT Cluster Size	Converted NTFS Cluster Size
  512 bytes	512 bytes
  1 KB	1 KB
  2 KB	2 KB
  4 KB and larger	4 KB

  Note If the FAT volume was formatted using an operating system other than Windows XP, the cluster size of the converted volume is usually 512 bytes. However, if the FAT clusters happen to be aligned at the cluster size boundary, Windows XP Professional can use the variable cluster size for the converted volume.

Using Convert.exe to Convert FAT Volumes to NTFS

To convert FAT16 and FAT32 volumes to NTFS, use Convert.exe from the command line. The syntax of Convert follows:

Note: Some parts of the following code snippet have been displayed in multiple lines only for better readability. These should be entered in a single line.

convert volume: /fs:ntfs [/v] [/x] 
[/cvtarea:filename] [/nosecurity] [/?]

Table 13-11 describes the parameters available with Convert.

Table 13-11 Convert Parameters

Parameter	Description
volume	Specifies drive letter (followed by a colon), mounted drive, or volume name to convert.
/fs:ntfs	Specifies conversion of the volume to NTFS.
/v	Specifies verbose mode. All messages are displayed during conversion.
/x	Causes the volume to dismount, if necessary, before it is formatted. Any open handles to the volume become invalid.
/cvtarea:filename	Specifies that the MFT and other NTFS metadata files are written to an existing, contiguous placeholder file. This file must be in the root folder of the volume to be converted.
/nosecurity	Specifies that default NTFS permissions will not be applied to the volume. Using the convert command together with the /nosecurity parameter mimics the behavior of the convert command in Windows 2000.
/?	Displays user help.

Converting Volumes in Use

When you use the convert command, you might see the following messages:

Convert cannot run because the volume is in use by another process. Convert may run if this volume is dismounted first. ALL OPEN HANDLES TO THIS VOLUME WOULD THEN BE INVALID. Would you like to force a dismount on this volume (Y/N)?

-or-

Convert cannot gain exclusive access to the [driveletter] drive, so it cannot convert it now. Would you like to schedule it to be converted the next time the system restarts (Y/N)?

Caution Forcefully dismounting a volume can cause data loss if files are open when the volume is dismounted. To safely convert a volume that cannot be locked, schedule the conversion to take place when the computer restarts.

These messages appear if one of the following conditions exists.

The current folder (where you run the Convert command) is on the volume to be converted

For example, you cannot immediately convert the F volume if you type convert f: / fs:ntfs at the F:\> prompt. If you have multiple volumes, solve this problem by changing to a folder on another volume (by typing c: for example) and retyping the command to start the conversion. If you have only one volume, you must schedule the conversion to occur the next time you start Windows XP Professional.

A program has a file open on the volume to be converted

To solve this problem, close all programs that might be accessing the volume and ensure that remote users are not accessing files on the volume from across the network. If this does not work, run the command again and type Y to dismount the volume. If you do not want to dismount the volume, type N. Convert then prompts you to schedule the conversion to occur the next time you restart the computer.

Windows XP Professional is installed on the volume to be converted, or the volume contains the paging file

You cannot convert the Windows XP Professional boot volume while Windows XP Professional is running, nor can you force a dismount of the volume that contains the paging file. In these situations, you must schedule the conversion to occur the next time you start Windows XP Professional.

If you must restart the computer to complete the conversion, Windows XP Professional provides a 10-second delay before the conversion begins.

If necessary, cancel the conversion before the computer restarts by editing the registry.

Caution Do not edit the registry unless you have no alternative. The Registry Editor bypasses standard safeguards, allowing settings that can damage your system, or even require the reinstallation of Windows. If you must edit the registry, back it up first.

To edit the registry and cancel an NTFS conversion before the computer restarts

1. Click Start, click Run, and then type regedit.exe.

2. Click OK.

3. In the Registry Editor, navigate to HKEY_LOCAL_MACHINE\SYSTEM\
   CurrentControlSet\Control\Session Manager.

4. Delete the following value from the BootExecute entry, where x is the volume that is to be converted:

   autocheck autoconv \??\x: /FS:NTFS

5. Close the Registry Editor.

Using the /CVTAREA Parameter

For optimal performance after the conversion, use the /cvtarea parameter to prevent the MFT from becoming fragmented during the conversion. Before you use the /cvtarea parameter, you must first use the fsutil file createnew command to create a large file (typically 1/8th of the total volume size) in the root folder. This file is overwritten by the MFT during the conversion. If the file is larger than the space required for the MFT, the unused space becomes available space. If the file does not reside in contiguous clusters, an error message appears and the conversion fails. Defragment the volume, and then try running the conversion again. For more information about the fsutil file createnew command, see Windows XP Professional Help.

If you do not use the /cvtarea parameter, volumes that are converted from FAT to NTFS (instead of being initially formatted using NTFS) lack some performance benefits because the MFT becomes fragmented after the conversion. Use Disk Defragmenter to defragment the MFT after the conversion. For more information, see “Defragmenting NTFS Volumes” later in this chapter.

How Convert.exe Safeguards Data During the Conversion

To guard against the possibility of corruption caused by failure during conversion, Convert.exe must build the NTFS metadata files by using only the space designated as free space by the FAT file system. Then, if the conversion does not finish, the FAT representation of the user files remains valid. A complication is that one sector of NTFS data must occupy a specific location on the disk, and a small number of other structures must occupy contiguous sectors.

During the conversion process, Convert.exe performs the following steps:

1. Runs Chkdsk or Autochk to verify the integrity of the file system. Chkdsk runs when the conversion takes place while Windows XP Professional is running. If Chkdsk encounters an error, the conversion stops. You must use the chkdsk /f command to fix any file system errors, and then run Convert again. Autochk runs when you schedule the conversion to take place when the computer restarts. If Autochk encounters an error, Autochk attempts to repair the error, and the conversion continues. For more information about Chkdsk and Autochk, see Chapter 28, “Troubleshooting Disks and File Systems.”

2. Relocates FAT clusters for the fixed-location NTFS structure and other contiguous data (if necessary) and saves the new file allocation table. If the necessary sectors cannot be made available because they are unreadable, for example, the conversion process fails and the FAT volume remains in the same state it was in before the attempted conversion.

3. Creates NTFS elementary data structures in FAT free space. These are the fixed-size tables and structures common to any NTFS volume. The size of these tables varies depending on the size of the volume, but it does not depend on the number of files on the volume.

4. Creates the NTFS master file table and directory listings in the FAT free space. The space required for this step is variable and depends on the total number of files and folders on the FAT volume.

5. Marks as free, in the NTFS bitmap, those NTFS clusters being used by FAT-specific structures. After the conversion is complete, the FAT metadata overhead can be reclaimed as free space to NTFS.

6. Writes the NTFS boot sector. This is the final action that causes the volume to be recognized as NTFS instead of FAT. If the conversion fails at any step prior to this, the volume is still a valid FAT volume and is recognized as such.

Almost all writes are to FAT free space, so a failure preserves the FAT intact. The following situations are the only times when a failure might cause problems.

At the end of Step 2, when Convert.exe overwrites the FAT

The algorithm for relocating clusters guarantees that if a failure occurs during this stage, Chkdsk can fix the disk without any loss of data.

In Step 6, when Convert.exe writes the boot sector

If a failure occurs during this step and the volume being converted is the system volume (the active, primary partition used to start the system), there is a chance that the system could be left in a state where it would not start. In the unlikely event that this takes place, start the system by using a Windows XP Professional startup floppy disk. For more information about creating a Windows XP Professional startup floppy disk, see article 119467, “How to Create a Bootable Disk for an NTFS or FAT Partition.” To find this article, see the Microsoft Knowledge Base link on the Web Resources page at https://www.microsoft.com/windows/reskits/webresources.

Defragmenting NTFS Volumes

Windows XP Professional provides two methods of defragmenting NTFS volumes: the Disk Defragmenter snap-in and the new defrag command-line tool. Use either tool as part of a frequent and regular maintenance program to maintain the optimum performance of NTFS volumes.

Disk defragmentation is improved in Windows XP Professional. Both tools in Windows XP Professional can now defragment the following:

NTFS volumes that use any cluster size

In Windows 2000, you can defragment only NTFS volumes that have cluster sizes smaller than or equal to 4 KB. Using Disk Defragmenter in Windows XP Professional, you can defragment volumes that use any cluster size.

Files smaller than 16 clusters

Disk Defragmenter in Windows 2000 cannot move files smaller than 16 clusters, so free space smaller than 16 clusters is ignored. In Windows XP Professional, Disk Defragmenter can defragment files of any cluster size.

The MFT

The master file table (MFT) is defragmented along with other files on the volume. Because the first fragment of the MFT cannot be moved, the MFT is typically contained within two fragments when sufficient space is available on the volume. In this case, the MFT is considered defragmented. If the MFT is contained within three or more fragments, Disk Defragmenter looks for free space where the MFT might fit. If sufficient free space exists, the MFT is moved as a whole (minus the first fragment). If space is not available, the MFT is not defragmented.

Note Windows XP Professional reserves a portion of the volume for the MFT known as the MFT zone. Neither Disk Defragmenter nor the defrag command moves files into this area. For more information about the MFT Zone, see “MFT Zone” later in this chapter.

For more information about using Disk Defragmenter on FAT and NTFS volumes, see Chapter 28, “Troubleshooting Disks and File Systems.”

Optimizing NTFS Performance

NTFS performance is affected by many factors, such as cluster size, fragmentation level, and the use of programs such as antivirus software. In addition, NTFS features such as compression and Indexing Service can also affect performance. Optimize the performance of NTFS volumes by using the following guidelines.

Determine Cluster Size

Before you format an NTFS volume, evaluate the types of files to be stored on the volume to determine whether to use the default cluster size. Some important questions to answer include:

• Are the files typically the same size?

• Are the files smaller than the default cluster size?

• Do the files remain the same size or grow larger?

If the files are typically smaller than the default cluster size (for example, 4 KB) and do not increase, use the default cluster size to reduce wasted disk space. However, smaller clusters can increase fragmentation, especially when files grow to fill more than one cluster. Therefore, adjust the cluster size accordingly when you format the volume. If the files you store tend to be large or increase in size, use 16-KB or 32-KB clusters instead of the default 4-KB cluster size.

Note Compression is supported only on volumes that use 4-KB or smaller clusters.

Cluster size is also an issue for volumes that were converted from FAT to NTFS in Windows 2000 or earlier because the default cluster size for converted volumes is 512 bytes, and the MFT was most likely fragmented during the conversion. For optimum performance, back up the data on the volume, reformat the volume, specify the appropriate cluster size, and then restore the data.

For more information about choosing a cluster size, see “Cluster Size” earlier in this chapter.

Use Short File Names

Every time you create a file with a long file name, NTFS creates a second file entry that has a similar 8.3 short file name. A file with an 8.3 short file name has a file name containing 1 to 8 characters and a file name extension containing 1 to 3 characters. The file name and file name extension are separated by a period.

If you have a large number of files (300,000 or more) in a folder, and the files have long file names with the same initial characters, the time required to create the files increases. The increase occurs because NTFS bases the short file name on the first six characters of the long file name. In folders with more than 300,000 files, the short file names start to conflict after NTFS uses all the 8.3 names that are similar to the long file names. Repeated conflicts between a generated short file name and existing short file names cause NTFS to regenerate the short file name from 6 to 8 times.

To reduce the time required to create files, use the fsutil behavior set disable8dot3 command to disable the creation of 8.3 short file names. (You must restart your computer for this setting to take effect.) For more information about disabling 8.3 short file names, see “MS-DOS-Readable File Names on NTFS Volumes” later in this chapter.

If you want NTFS to generate 8.3 names, improve performance by using a naming scheme in which long file names differ at the beginning of the name instead of at the end.

For more information about short file names, see “File Names in Windows XP Professional” later in this chapter.

Determine Folder Structure

NTFS supports volumes with large numbers of files and folders, so create a folder structure that works best for your organization. Some guidelines to consider when designing a folder structure include:

• Avoid putting a large number of files into a folder if you use programs that create, delete, open, or close files quickly or frequently. The better solution is to logically separate the files into folders to distribute the workload on multiple folders at the same time.

• If there is no way to logically separate the files into folders, put all the files into one folder and then disable 8.3 file name generation. If you must use 8.3 names, use a file-naming scheme that ensures that the first six characters are unique.

  Warning The time required to run Chkdsk.exe increases with larger folders. For more information about determining how long Chkdsk takes to complete, see Chapter 28, “Troubleshooting Disks and File Systems.”

Fragmentation

Heavily fragmented volumes do not perform as well as volumes that are defragmented regularly. Run the Disk Defragmenter snap-in or the command-line tool Defrag.exe weekly during idle times. For more information about defragmenting NTFS volumes, see “Defragmenting NTFS Volumes” earlier in this chapter.

Evaluate Antivirus Programs

Antivirus programs add overhead to the system to scan for viruses, thus affecting file system performance. However, the impact varies among antivirus programs. When you evaluate antivirus programs, measure baseline performance to determine which programs have the least impact in your environment. Many antivirus software vendors offer tuning guides to customize the software for your organization while minimizing performance impact.

Evaluate Use of Compression

Compression adds overhead to the system because a compressed NTFS file is decompressed, copied, and then recompressed as a new file even when the file is copied in the same computer. If your server is CPU-bound, avoid using compression. For more information about compression, see “File Compression” earlier in this chapter.

Enable Indexing Service

If users frequently search for files on NTFS volumes in computers running Windows XP Professional, reduce search times dramatically by enabling Indexing Service. Indexing Service also works well when users search for content inside documents.

After you enable Indexing Service, it uses system resources to build and maintain its index, and NTFS begins tracking all file changes in the NTFS change journal. Both of these actions result in a slight performance decrease. However, for volumes that contain frequently searched files, the benefits gained from increased search speed outweigh the performance impact caused by enabling Indexing Service.

For more information about Indexing Service, see “Indexing Service” earlier in this chapter.

Check Last Access Time

Each file and folder on an NTFS volume contains an attribute called Last Access Time. This attribute shows when the file or folder was last accessed, such as when a user performs a folder listing, adds files to a folder, reads a file, or makes changes to a file. The most up-to-date Last Access Time is always stored in memory and is eventually written to disk within two places:

• The file’s attribute, which is part of its MFT record.

• A directory entry for the file. The directory entry is stored in the folder that contains the file. Files with multiple hard links have multiple directory entries.

The Last Access Time on disk is not always current because NTFS looks for a one-hour interval before forcing the Last Access Time updates to disk. NTFS also delays writing the Last Access Time to disk when users or programs perform read-only operations on a file or folder, such as listing the folder’s contents or reading (but not changing) a file in the folder. If the Last Access Time is kept current on disk for read operations, all read operations become write operations, which affects NTFS performance.

Note File-based queries of Last Access Time are accurate even if all on-disk values are not current. NTFS returns the correct value on queries because the accurate value is stored in memory.

NTFS eventually writes the in-memory Last Access Time to disk as follows.

Within the file’s attribute

NTFS typically updates a file’s attribute on disk if the current Last Access Time in memory differs by more than an hour from the Last Access Time stored on disk, or when all in-memory references to that file are gone, whichever is more recent. For example, if a file’s current Last Access Time is 1:00 P.M., and you read the file at 1:30 P.M., NTFS does not update the Last Access Time. If you read the file again at 2:00 P.M., NTFS updates the Last Access Time in the file’s attribute to reflect 2:00 P.M. because the file’s attribute shows 1:00 P.M. and the in-memory Last Access Time shows 2:00 P.M.

Within a directory entry for a file

NTFS updates the directory entry for a file during the following events:

• When NTFS updates the file’s Last Access Time and detects that the Last Access Time for the file differs by more than an hour from the Last Access Time stored in the file’s directory entry. This update typically occurs after a program closes the handle used to access a file within the directory. If the program holds the handle open for an extended time, a lag occurs before the change appears in the directory entry.

• When NTFS updates other file attributes, such as Last Modify Time, and a Last Access Time update is pending. In this case, NTFS updates the Last Access Time along with the other updates without having an additional impact on performance.

  Note NTFS does not update a file’s directory entry when all in-memory references to that file are gone.

If you have an NTFS volume with a high number of folders or files, and a program is running that briefly accesses each of these in turn, the I/O bandwidth used to generate the Last Access Time updates can be a significant percentage of the overall I/O bandwidth. To increase the speed of access to a folder or file, use the fsutil behavior set disablelastaccess command to disable updating the Last Access Time. After you use this command and restart the computer, the Last Access Time is no longer updated. If you create a new file, the Last Access Time remains the same as the File Creation Time. For more information about using the fsutil behavior set disablelastaccess command, see Windows XP Professional Help.

NTFS Compatibility with Windows NT 4.0

Your ability to access your NTFS volumes when you use a multiple-boot configuration to start Windows NT and Windows XP Professional depends on which version of Windows NT you are using. If you are running Windows NT 4.0 Service Pack 4 or later, you can read basic volumes formatted by using the new version of NTFS. Computers running Windows 2000 (or Windows Server 2003) and Windows XP Professional can read the new version of NTFS on both basic and dynamic volumes.

Note Computers accessing NTFS volumes across the network are not affected.

When a Windows XP Professional volume is mounted in a computer running Windows NT 4.0 Service Pack 4 or later, most of the new NTFS features are not available. However, most read and write operations are permitted if they do not make use of any new NTFS features. The following features are affected by this configuration.

Reparse points

Windows NT cannot perform any operations that make use of reparse points.

Disk quotas

When you run Windows NT on a multiple-boot configuration that also runs Windows XP Professional, Windows NT ignores disk quotas implemented by Windows XP Professional, allowing you to use more disk space than your quota allows.

Encryption

Windows NT cannot perform any operations on files encrypted by Windows XP Professional.

Sparse files

Windows NT cannot perform any operations on sparse files.

Change journal

Windows NT ignores the change journal. No entries are logged when a user accesses files.

Warning Because NTFS data structures are not the same for Windows NT 4.0 and Windows XP Professional, Windows NT 4.0 disk tools such as Chkdsk and Autochk do not work on NTFS volumes formatted or upgraded by Windows XP Professional. These tools check the version stamp of NTFS. After installing Windows XP Professional, you must run the updated version of these disk tools on their NTFS volumes.

Cleanup Operations on Windows NT Volumes

Because files on volumes formatted by using the version of NTFS included with Windows XP Professional can be read and written to by Windows NT 4.0 Service Pack 4 or later, Windows XP Professional might need to perform cleanup operations to ensure the consistency of the data structures of a volume after it is mounted on a computer running Windows NT.

Windows XP Professional does not perform cleanup operations on volumes previously mounted by using Windows 2000.

Cleanup operations affect the following features.

Reparse points

Computers running Windows NT 4.0 or earlier cannot access files that have reparse points, so no cleanup operations are necessary.

Disk quotas

If disk quotas are turned off, Windows XP Professional performs no cleanup operations. If disk quotas are turned on, Windows XP Professional cleans up the quota information by rebuilding the index. If a user exceeds the disk quota while the NTFS volume is mounted by a Windows NT 4.0 Service Pack 4 or later system, and disk quotas are strictly enforced, all further disk allocations of data by that user using Windows XP Professional fail. The user can still read and write data to any existing file but cannot increase the size of a file. However, the user can delete and shrink files. When usage falls below the assigned disk quota, disk allocations of data can resume.

Encryption

Encrypted files cannot be accessed by computers that are running Windows NT 4.0 or earlier, so no cleanup operations are necessary.

Sparse files

Computers running Windows NT 4.0 or earlier cannot access sparse files, so no cleanup operations are necessary.

Change journal

Computers that are running Windows NT 4.0 or earlier do not log file changes in the change journal. When Windows XP Professional starts, the change journals on volumes accessed by Windows NT are reset to indicate that the journal history is incomplete. Applications that use the change journal must be able to accept incomplete journals.

Object identifiers

Windows XP Professional maintains two references to the object identifier: one on the file and one in the volume-wide object identifier index. If you delete a file that has an object identifier, Windows XP Professional must scan and clean up the entry in the index.

NTFS Recoverability

NTFS is a recoverable file system that guarantees the consistency of the volume by using standard transaction logging and recovery techniques. In the event of a system failure, NTFS runs a recovery procedure that accesses information stored in a transaction log file. The NTFS recovery procedure guarantees that the volume is restored to a consistent state. Transaction logging requires very little overhead.

NTFS ensures the integrity of all NTFS volumes by performing disk recovery operations whenever a volume is mounted after the computer is restarted or after the volume is dismounted.

NTFS also uses a technique called cluster remapping to minimize the effects of a bad sector on an NTFS volume.

Warning If either the MBR or boot sector is corrupted, you might not be able to access data on the volume. For more information about recovering from MBR or boot sector errors, see Chapter 28, “Troubleshooting Disks and File Systems.”

Recovering Data with NTFS

NTFS views each operation that modifies a file on a volume as a transaction and manages each one as an integral unit. NTFS might also break a single complex operation into multiple transactions. After a transaction is started, it is either completed or rolled back if an event occurs that causes the operation to fail, and the NTFS volume returns to its state before the transaction began. Events that can cause an operation to fail include bad sectors, transient low-memory conditions, and disconnected devices.

To ensure that a transaction can either be completed or rolled back, NTFS performs the following steps for each transaction:

1. Records the metadata operations of a transaction in a log file cached in memory.

2. Records the actual metadata operations in memory.

3. Marks the transaction in the cached log file as committed.

4. Flushes the log file to disk.

5. Flushes the actual metadata operations to disk.

The preceding steps 4 and 5 occur in a lazy fashion after the transaction is completed, meaning that the flush operations are not tied to the transaction itself. Instead, NTFS modifies the log and metadata quickly in memory, and then flushes later at a convenient time to boost performance.

NTFS guarantees that the log records containing the metadata operations of the transaction are written to disk before the metadata that is modified in the transaction is written to disk. After NTFS updates the cache, NTFS commits the transaction by recording in the cached log file that the transaction is complete. After the cached log file is flushed to disk, all committed transactions are guaranteed to be completed, even if the system crashes before the changes are written to disk.

Note Applications can specify the FILE_FLAG_WRITE_THROUGH Win32 flag to instruct the system to write through any intermediate cache and go directly to disk. The system can still cache write operations, but it cannot lazily flush them.

If a system failure occurs, NTFS has enough information in the log to complete or abort any partial NTFS transaction. During recovery operations, NTFS redoes each committed transaction found in the log file. Then NTFS locates in the log file the transactions that were not committed at the time of the system failure and undoes each metadata operation recorded in the log file. Because NTFS flushes the log to disk before any metadata changes are written to disk, NTFS has complete information available about any metadata changes that need to be rolled back during recovery.

Caution NTFS uses transaction logging and recovery to guarantee that the volume structure is not corrupted. For this reason, all file system data is accessible after a system failure. NTFS guarantees user data only if the program used to create the data uses the FILE_FLAG_WRITE_THROUGH Win32 flag. If the program does not use this flag, user data can be lost because of a system failure. If a system failure does occur, NTFS shows either the previous data, the new data, or zeros. Users do not see random data on the volume as the result of a crash.

Caching and Data Recovery

The cache is the area of RAM that contains the most recently used data. When you write data to disk, the lazy-write technique in Windows XP Professional indicates that the data is written when it is still in the cache. Cache memory can also be on the disk controller, such as cache memory available on SCSI controllers or on the disk unit, such as cache memory available on Advanced Technology Attachment (ATA) disks. The following information can help you decide whether to enable the disk or the controller cache:

• Write caching improves disk performance, particularly if large amounts of data are being written to the disk.

• Control of the write-back cache is a firmware function provided by the disk manufacturer. See the documentation supplied with the disk or disk controller. You cannot configure the write-back cache from Windows XP Professional.

• Write caching does not affect the reliability of the file system’s own metadata. NTFS instructs the disk device driver to ensure that metadata is written whether or not write caching is enabled. Non-metadata is typically written to disk and can be cached.

• Read caching in the disk does not affect the reliability of a file system.

Cluster Remapping

When NTFS detects a bad sector, NTFS dynamically remaps the cluster containing the bad sector—a recovery technique called cluster remapping—and allocates a new cluster for the data. If the error occurred during a read, NTFS returns a read error to the calling program and the data is lost. If the error occurs during a write, NTFS writes the data to the new cluster and no data is lost.

NTFS puts the address of the cluster containing the bad sector in the bad cluster file, $BadClus, in the MFT so that the bad sector is not reused.

Warning Cluster remapping is not a backup alternative. After errors are detected, the disk must be monitored closely and replaced if the detect list grows. This type of error is displayed in the system log of Event Viewer.

FAT uses a form of cluster remapping, but only when the volume is initially formatted. If a bad sector occurs on a FAT volume after it is formatted, data stored within the associated cluster can be permanently lost. NTFS handles cluster remapping dynamically and continuously, ensuring the integrity of your data.

NTFS Data Structures

This section is useful for administrators who need information about the on-disk structures of NTFS volumes. These structures give NTFS basic advantages over other file systems used in Windows XP Professional.

Master File Table and Metadata Files

When you format a volume using NTFS, Windows XP Professional creates a master file table (MFT) and metadata files. The MFT is a relational database that consists of rows of file records and columns of file attributes. It contains at least one entry for every file on an NTFS volume, including the MFT itself.

Because the MFT stores information about itself, NTFS reserves the first 16 records of the MFT for metadata files (approximately 16 KB), which are used to describe the MFT. Metadata files that begin with a dollar sign ($) are described in Table 13-12. The remaining records of the MFT contain the file and folder records for each file and folder on the volume.

Table 13-12 Metadata Files Stored in the Master File Table

System File	File Name	MFT Record	Purpose of the File
Master file table	$Mft	0	Contains one base file record for each file and folder on an NTFS volume. If the allocation information for a file or folder is too large to fit within a single record, other file records are allocated as well.
Master file table mirror	$MftMirr	1	Guarantees access to the MFT in case of a single-sector failure. It is a duplicate image of the first four records of the MFT.
Log file	$LogFile	2	Contains a list of transaction steps used for NTFS recoverability. The log file is used by Windows XP Professional to restore consistency to NTFS after a system failure. The size of the log file depends on the size of the volume, but you can increase the size of the log file by using the Chkdsk command. For more information about the log file, see “NTFS Recoverability” earlier in this chapter. For more information about Chkdsk, see Chapter 28, “Troubleshooting Disks and File Systems.”
Volume	$Volume	3	Contains information about the volume, such as the volume label and the volume version.
Attribute definitions	$AttrDef	4	Lists attribute names, numbers, and descriptions.
Root file name index	.	5	The root folder.
Cluster bitmap	$Bitmap	6	Represents the volume by showing free and unused clusters.
Boot sector	$Boot	7	Includes the BPB used to mount the volume and additional bootstrap loader code used if the volume is bootable.
Bad cluster file	$BadClus	8	Contains bad clusters for a volume.
Security file	$Secure	9	Contains unique security descriptors for all files within a volume.
Upcase table	$Upcase	10	Converts lowercase characters to matching Unicode uppercase characters.
NTFS extension file	$Extend	11	Used for various optional extensions such as quotas, reparse point data, and object identifiers.
		12–15	Reserved for future use.

The data segment locations for both the MFT and the backup MFT—$Mft and $MftMirr, respectively—are recorded in the boot sector. The $MftMirr is a duplicate image of either the first four records of the $Mft or the first cluster of the $Mft, whichever is larger. If any MFT records in the mirrored range are corrupted or unreadable, NTFS reads the boot sector to find the location of the $MftMirr. NTFS then reads the $MftMirr and uses the information in $MftMirr instead of the information in the MFT. If possible, the correct data from the $MftMirr is written back to the corresponding location in the $Mft. For more information about the NTFS boot sector, see Chapter 28, “Troubleshooting Disks and File Systems.”

Note To improve NTFS performance, the $LogFile and $Bitmap metadata files on newly formatted NTFS volumes are located in a different position on the disk than they were in Windows 2000. (The MFT record numbers do not change.) This new location improves performance by 5 to 8 percent, making NTFS performance similar to FAT.

NTFS creates a file record for each file and a folder record for each folder created on an NTFS volume. The MFT includes a separate file record for the MFT itself. These file and folder records are 1 KB each and are stored in the MFT. The attributes of the file are written to the allocated space in the MFT. Besides file attributes, each file record contains information about the position of the file record in the MFT. Figure 13-16 shows the contents of an MFT record for a small file or folder. Small files and folders (typically, 900 bytes or smaller) are entirely contained within the file’s MFT record.

Figure 13-16 MFT record for a small file or folder

Typically, each file uses one file record. However, if a file has a large number of attributes or becomes highly fragmented, it might need more than one file record. If this is the case, the first record for the file, the base file record, stores the location of the other file records required by the file.

Folder records contain index information. Small folder records reside entirely within the MFT structure, while large folders are organized into B-tree structures and have records with pointers to external clusters that contain folder entries that cannot be contained within the MFT structure.

The benefit of using B-tree structures is evident when NTFS enumerates files in a large folder. The B-tree structure allows NTFS to group, or index, similar file names and then search only the group that contains the file, minimizing the number of disk accesses needed to find a particular file, especially for large folders. Because of the B-tree structure, NTFS outperforms FAT for large folders because FAT must scan all file names in a large folder before listing all the files.

MFT Zone

To prevent the MFT from becoming fragmented, NTFS reserves 12.5 percent of a volume by default for exclusive use of the MFT. This space, known as the MFT zone, is not used to store data unless the remainder of the volume becomes full.

Depending on the average file size and other variables, as the disk fills to capacity, either the MFT zone or the unreserved space on the disk becomes full first.

• Volumes that have a small number of large files exhaust the unreserved space first.

• Volumes with a large number of small files exhaust the MFT zone space first.

In either case, fragmentation of the MFT occurs when one region or the other becomes full. Change the size of the MFT zone for newly created volumes by using the fsutil behavior set mftzone command. This command has four settings, 1 through 4, which correspond to a percentage of the disk to be used as the MFT zone. The MFT zone sizes follow:

• Setting 1, the default, reserves approximately 12.5 percent of the disk.

• Setting 2 reserves approximately 25 percent.

• Setting 3 reserves approximately 37.5 percent.

• Setting 4 reserves approximately 50 percent.

In most computers, the default setting of 1 is adequate. The default setting accommodates volumes with an average file size of 8 KB. To store a large number of smaller files (between 2 KB and 7 KB), use the fsutil behavior set mftzone command to increase the size of the MFT zone for new volumes. You must restart the computer before the new MFT zone size takes effect.

After you increase the size of the MFT zone, NTFS does not immediately allocate space to accommodate the size of the new MFT zone. Instead, NTFS exhausts the original reserved space before increasing the size of the MFT zone. When the original space is exhausted, NTFS looks for the next contiguous space large enough to hold the additional MFT zone, which can cause the MFT to become fragmented. Therefore, the fsutil behavior set mftzone command works best when you use the command to set the zone size, reboot, and then create the volume.

To determine the current size of the MFT zone on a Windows XP Professional–based computer, use the fsutil behavior query mftzone command. If you have not modified the size of the MFT zone, a message appears that indicates the MFT zone is not currently set, which means that the default setting of 1 is used. Otherwise, the command returns the current value, either 1, 2, 3, or 4. The current setting applies to all NTFS volumes in the computer.

NTFS File Attributes

Every allocated sector on an NTFS volume belongs to a file. Even the file system metadata is part of a file. NTFS views each file (or folder) as a set of file attributes. File elements such as its name, its security information, and even its data are file attributes. Each attribute is identified by an attribute type code and an optional attribute name.

When a file’s attributes can fit within the MFT file record for that file, they are called resident attributes. Attributes such as file name and time stamp are always resident. When the amount of information for a file does not fit in its MFT file record, some file attributes become nonresident. Nonresident attributes are allocated one or more clusters of disk space. A portion of the nonresident attribute remains in the MFT and points to the external clusters. NTFS creates the Attribute List attribute to describe the location of all attribute records. Table 13-13 lists the file attributes currently defined by NTFS.

Table 13-13 NTFS File Attribute Types

Attribute Type	Description
Standard Information	Information such as timestamp and link count.
Attribute List	Locations of all attribute records that do not fit in the MFT record.
File Name	A repeatable attribute for both long and short file names. The long name of the file can be up to 255 Unicode characters. The short name is the 8.3, case-insensitive name for the file. Additional names, or hard links, required by POSIX can be included as additional file name attributes.
Data	File data. NTFS supports multiple data attributes per file. Each file typically has one unnamed data attribute. A file can also have one or more named data attributes, each using a particular syntax.
Object ID	A volume-unique file identifier. Used by the distributed link tracking service. Not all files have object identifiers.
Logged Tool Stream	Similar to a data stream, but operations are logged to the NTFS log file just like NTFS metadata changes. This attribute is used by EFS.
Reparse Point	Used for mounted drives. This is also used by Installable File System (IFS) filter drivers to mark certain files as special to that driver.
Index Root	Used to implement folders and other indexes.
Index Allocation	Used to implement the B-tree structure for large folders and other large indexes.
Bitmap	Used to implement the B-tree structure for large folders and other large indexes.
Volume Information	Used only in the $Volume system file. Contains the volume version.
Volume Name	Used only in the $Volume system file. Contains the volume label.

MS-DOS-Readable File Names on NTFS Volumes

By default, Windows XP Professional generates MS-DOS-readable file names on all NTFS volumes for use by 16-bit programs that run under Windows XP Professional. To improve performance on volumes with many long, similar names, use the fsutil behavior set command to disable 8.3 name creation. For more information about using this command, see Windows XP Professional Help.

Warning Although disabling 8.3 name creation increases NTFS performance under Windows XP Professional, some 16-bit applications might not be able to access files and folders that have long file names. Also, some third-party programs cannot be installed on NTFS volumes if 8.3 names are disabled. In this case, use the fsutil behavior set command to enable short file names, restart the computer, and then try installing the program again.

Windows XP Professional does not generate short (8.3) file names for files created by POSIX-based applications on an NTFS volume—whether short file names are disabled or not. This means that MS-DOS-based and 16-bit Windows-based applications cannot view these file names if they are not valid 8.3 file names. Therefore, you must use standard MS-DOS 8.3 naming conventions if you want to use MS-DOS-based or 16-bit Windows-based applications to work with files that are created by POSIX applications.

Comparing FAT File Systems

The FAT file system locates the file allocation table near the beginning of the volume. FAT16 works best on small disks with simple folder structures. FAT32 works well on large disks with complex folder structures. Both FAT file systems store two copies of the file allocation table on the volume. If one copy of the file allocation table is corrupted, the other is used. The location of the file allocation table is specified in the FAT boot sector’s BIOS Parameter Block (BPB). For more information about the FAT boot sectors, see Chapter 28, “Troubleshooting Disks and File Systems.”

Note Windows XP Professional uses the Fastfat.sys driver to mount and fully support FAT volumes.

Comparing FAT File Systems

The numerals in the names FAT12, FAT16, and FAT32 refer to the number of bits required for a file allocation table entry as follows:

• FAT12 uses a 12-bit file allocation table entry (212 clusters).

• FAT16 uses a 16-bit file allocation table entry (216 clusters).

• FAT32 uses a 32-bit file allocation table entry. However, FAT32 reserves the first 4 bits of a FAT32 file allocation table entry, which means FAT32 has a theoretical maximum of 228 clusters.

  Note In Windows XP Professional, FAT12 is used only on floppy disks and on volumes smaller than 16 megabytes.

There are additional advantages and disadvantages between FAT16 and FAT32.

Advantages of FAT16

Advantages of FAT16 include:

• MS-DOS, Windows 95, Windows 98, Windows Me, Windows NT, Windows 2000, Windows Server 2003, Windows XP, and some UNIX operating systems can use FAT16.

• Many older software tools can address problems and recover data on FAT16 volumes.

• If you have a startup failure, start the computer by using an MS-DOS bootable floppy disk to troubleshoot the problem.

• FAT16 is efficient, in speed and storage, on volumes smaller than 256 MB.

Disadvantages of FAT16

Disadvantages of FAT16 include:

• The root folder can contain a maximum of 512 entries. The use of long file names can significantly reduce the number of available entries.

• FAT16 is limited to 65,536 clusters, but because certain clusters are reserved, it has a practical limit of 65,524. Therefore, the largest FAT16 volume on Windows XP Professional is limited to just under 4 GB and uses a cluster size of 64 KB. To maintain compatibility with MS-DOS, Windows 95, Windows 98, and Windows Me, a FAT16 volume cannot be larger than 2 GB.

• FAT16 is inefficient on larger volume sizes because the cluster size is much larger when compared to NTFS and FAT32 cluster sizes. For example, a 10-KB file stored on a 1.2-GB FAT16 volume, which uses a 32-KB cluster, wastes 22 KB of disk space. FAT32 and NTFS use 4-KB and 2-KB clusters, respectively, for a 1.2-GB volume.

• The boot sector, a critical disk structure for starting your computer, is not backed up.

• FAT16 has no built-in file system security or compression scheme.

Advantages of FAT32

FAT32 has the following enhancements:

• The root folder on a FAT32 volume is an ordinary cluster chain and can be located anywhere on the volume. For this reason, FAT32 does not restrict the number of entries in the root folder.

• FAT32 uses smaller clusters (4 KB for volumes up to 8 GB), so it allocates disk space more efficiently than FAT16. Depending on the size of your files, FAT32 creates the potential for tens and even hundreds of megabytes of additional free disk space on larger volumes compared to FAT16.

• The boot sector is backed up at a specified location on the volume, so FAT32 volumes are less susceptible to single points of failure than FAT16 volumes.

Disadvantages of FAT32

Disadvantages of FAT32 include:

• Windows XP Professional is designed to format FAT32 volumes up to 32 GB. To format volumes larger than 32 GB in Windows XP Professional, you must use NTFS.

• MS-DOS, Windows 95 (prior to OSR2), and Windows NT 4.0 and earlier cannot access FAT32 volumes.

• If you have a startup failure, you cannot start the computer by using an MS-DOS or Windows 95 bootable floppy disk because these operating systems cannot read FAT32 volumes. You must use a floppy disk created by Windows 95 OSR2, Windows 98, or Windows Millennium Edition.

• FAT32 has no built-in file system security or compression scheme.

FAT16 File System

FAT16 is included in Windows XP Professional for the following reasons:

• It provides backward compatibility in the form of an upgrade path for earlier versions of Windows-compatible products.

• It is compatible with most other operating systems.

When relatively small files are placed on a FAT16 volume, FAT16 manages disk space inefficiently. Therefore, FAT16 is not recommended for volumes larger than 511 MB, and you cannot use FAT16 on volumes larger than 4 gigabytes (GB).

Using FAT12 in Windows XP Professional

On volumes with fewer than 32,680 sectors, the cluster sizes can be up to 8 sectors per cluster. In this circumstance, the format program creates a 12-bit FAT. Typically, volumes less than 16 MB in size are formatted for a 12-bit FAT, but the exact size depends on the disk geometry. The disk geometry also determines when a larger cluster size is needed because the number of clusters on the volume must fit into the number of bits used by the file system managing the volume. Therefore, you might have a 33-MB volume that has only 1 sector (512 bytes) per cluster.

FAT12 is the original implementation of FAT and is intended for very small media. The file allocation table for FAT12 is smaller than the file allocation table for FAT16 and FAT32 because it uses less space for each entry, leaving more space for data. All 1.44-MB 3.5-inch floppy disks are formatted by using FAT12.

Figure 13-17 illustrates how FAT16 maps clusters on a volume. The file allocation tables (labeled FAT1 and FAT2) identify each cluster in the volume as one of the following:

• Unused

• Cluster in use by a file

• Bad cluster

• Last cluster in a file

  

  Figure 13-17 Organization of a FAT16 volume

The root folder has the maximum number of available entries fixed at 512. The maximum number of entries on a floppy disk depends on the size of the disk.

Note Each folder and 8.3 file name in the root folder counts as an entry. For example, because the maximum number of entries is fixed at 512, if you have 100 folders in the root folder, you can create only 412 more files or folders in the root folder. If those folders or files use names longer than the 8.3 format, fewer files and folders can be created.

Folders contain a 32-byte entry for each file and folder they contain. The entry includes the following information:

• Name in 8.3 format (11 bytes)

• Attribute (1 byte, described later in this section)

• Create time (3 bytes)

• Create date (2 bytes)

• Last access date (2 bytes)

• Last modified time (2 bytes)

• Last modified date (2 bytes)

• Starting cluster number in the file allocation table (2 bytes)

• File size (4 bytes)

  Note Three bytes in each 32-byte folder entry are held in reserve.

In the file allocation table of a FAT16 volume, files are given the first available location on the volume. The starting cluster number is the address of the first cluster used by the file. Each cluster contains a pointer to the next cluster in the file, or an end-of-file indicator at (0xFFFF), which indicates that this cluster is the end of the file. These pointers and end-of-file indicators are shown in Figure 13-18.

Figure 13-18 Files on a FAT volume

Figure 13-18 shows three files in a folder. File1.txt uses three clusters. File2.txt is a fragmented file that requires three clusters. File3.txt fits in one cluster. In each case, the file allocation table entry points to the first cluster of the file.

The information in the folder is used by all operating systems that support FAT. Windows XP Professional can store additional timestamps in a FAT folder entry. These timestamps show when the file was created or last accessed.

The attribute byte for each entry in a folder describes what kind of entry it is. For example, one bit indicates that the entry is for a subfolder, and another bit marks the entry as a volume. Typically, the operating system controls the settings of these bits.

The attribute byte includes four bits that can be turned on or off by the user: archive, system, hidden, and read-only.

FAT32 File System

The FAT32 on-disk format and features on Windows XP Professional are similar to those on Windows 95 OSR2, Windows 98, and Windows Me.

The size of a FAT32 cluster is determined by the system and can range in size from 1 sector (512 bytes) to 128 sectors (64 KB), incremented in powers of 2.

Note Using 64-KB clusters in FAT32 can lead to compatibility problems with certain programs. The maximum cluster size recommended for a FAT32 volume is 32 KB.

Because FAT32 requires 4 bytes to store cluster values, many internal and on-disk data structures have been revised or expanded. Most programs are unaffected by these changes; however, disk tools that read the on-disk format must be updated to support FAT32.

The most significant difference between FAT16 and FAT32 is the maximum number of clusters supported, which in turn affects a volume’s maximum size and storage efficiency. FAT32 breaks the 4-GB volume limitation of FAT16 by extending the maximum number of clusters.

Because of the greater number of available clusters within FAT32, each cluster can be made smaller for a particular volume, increasing the efficiency of data storage. For example, FAT16 volumes between 2 and 4 GB use a 64-KB cluster, whereas FAT32 volumes between 16 GB and 32 GB use a 16-KB cluster.

Note The 127.5-GB limit on FAT32 volumes imposed in Windows 98 no longer applies to Windows Me. In Windows Me, using a cluster size of 32 KB, a FAT32 volume can theoretically be about 8 terabytes. However, the 32-bit fields in the partition table (and in the FAT32 boot sector) limit the size of an individual volume (regardless of file system) on a basic MBR disk using a sector size of 512 bytes to approximately 2 terabytes.
Although Windows 2000, Windows Server 2003, and Windows XP Professional can mount FAT32 volumes of any size, these operating systems can format FAT32 volumes up to 32 GB only. Use NTFS to format larger volumes. For more information about the benefits of formatting Windows XP Professional volumes by using NTFS, see “Advantages of Using NTFS” earlier in this chapter.

The largest possible file for a FAT32 volume is 4 GB minus 1 byte. FAT32 contains 4 bytes per cluster in the file allocation table; FAT16 contains 2 bytes per cluster; and FAT12 contains 1.5 bytes per cluster. A FAT32 volume must have at least 65,527 clusters. For more information about clusters, see “Cluster Size” earlier in this chapter.

File Names on FAT Volumes

Files created or renamed on FAT volumes use attribute bits to support long file names in a way that does not interfere with how MS-DOS gains access to the volume.

When you create a file that has a long file name, Windows XP Professional creates a conventional 8.3 name for the file and one or more secondary folder entries for the file, one for each set of 13 characters in the long file name. Each secondary folder entry stores a corresponding part of the long file name in Unicode. MS-DOS accesses the file by using the conventional 8.3 file name contained in the folder entry for the file.

Windows XP Professional marks the secondary folder entries as part of a long file name by setting the volume ID, read-only, system, and hidden attribute bits. MS-DOS typically ignores folder entries with all these attribute bits set.

Figure 13-19 shows all the folder entries for the file Thequi~1.fox, which has a long name of “The quick brown.fox”. The long name is in Unicode, so each character in the name uses 2 bytes in the folder entry. The attribute field for the long-name entries has the value 0x0F. The attribute field for the short name has the value 0x20.

Figure 13-19 Long file name on a FAT volume

Note Windows NT and Windows XP Professional do not use the same algorithm to create long and short file names as Windows 95, Windows 98, and Windows Me. However, on computers that use a multiple-boot configuration to start these operating systems, files that you create while running one operating system can be accessed while running another.

For more information about how Windows XP Professional creates short file names, see “File Names in Windows XP Professional” later in this chapter.

By default, Windows XP Professional supports long file names on FAT volumes. You can disable long file names on FAT volumes if you use MS-DOS–based disk tools regularly on the computer. These tools might either eliminate the long file names created by Windows XP Professional or delete the files that have long file names.

To prevent a FAT file system from creating long file names, set the value of the Win31FileSystem registry entry (in the subkey HKEY_LOCAL_MACHINE\SYSTEM\
CurrentControlSet\Control\FileSystem) to 1. This value prevents Windows XP Professional from creating new long file names on all FAT volumes. However, existing long file names remain intact but are not displayed in My Computer, in Windows Explorer, or at the command prompt.

Caution Do not edit the registry unless you have no alternative. The Registry Editor bypasses standard safeguards, allowing settings that can damage your system or even require you to reinstall Windows. If you must edit the registry, back it up first.

Compact Disc File System

The Windows XP Professional Compact Disc File System (CDFS) can read compact discs (CDs) formatted according to the ISO 9660 file system standard. The ISO 9660 specification defines three methods, or interchange levels, for recording and naming files on a CD. Windows XP Professional supports up to interchange level 3.

Windows XP Professional also supports Joliet, an extension to ISO 9660, which supports CDs that are recorded using file names containing Unicode characters. Joliet supports file and folder names on CDs as follows:

• File and folder names can contain up to 64 Unicode characters.

• Folder names can contain file name extensions.

• Folder hierarchy can be recorded deeper than 8 levels.

  Note CDFS does not support the Rock Ridge Interchange Protocol extensions to ISO 9660 and reads only the ISO 9660 structures on such discs.

If the computer uses a compatible CD-ROM drive, Windows XP Professional can also read CDs recorded by using the following standards:

• Red Book (CD-Audio), including Enhanced CD

• Yellow Book (CD-ROM)

• CD-XA

• White Book (Video CD)

• Photo CD

• Orange Book Part II (CD-recordable, including multisession) and Part III (CD-Rewritable)

• Blue Book (CD Extra)

  Note You might need a special program or player to interpret the information on CD-XA, White Book, and Photo CDs. Also, Windows XP Professional cannot read CD-R or CD-RW discs that have not been closed by the writing software.

Windows XP Professional provides integrated support for writing data to CD-R and CD-RW. When writing data to CD, Windows XP Professional automatically uses the Joliet and ISO 9660 formats. When writing audio files to CD, Windows XP Professional uses the Red Book format. For more information about burning CDs, see Windows XP Professional Help.

Universal Disk Format

Universal Disk Format (UDF) is a file system defined by the Optical Storage Technology Association. UDF is based on the ISO 13346 (ECMA-167) standard and is the successor to the ISO 9660 (CDFS) format.

UDF is used for removable media such as DVD, CD, compact disc–recordable (CD-R), compact disc–rewritable (CD-RW), write once, read many (WORM), and magneto-optical (MO) discs. Because UDF is based on open standards, it is intended to facilitate data interchange between operating systems and between consumer devices. The standard supports a number of advanced features, including:

• Long and Unicode file names

• Deep directory trees

• Sparse files

• Large (64-bit) file sizes

• Access control lists (ACLs)

• Named streams

Windows XP Professional reads UDF versions 1.02, 1.50, 2.0, and 2.01 on CD, CD-R, CD-RW, DVD, DVD-RAM, and magneto-optical discs. Support is implemented in the Udfs.sys driver. If you have a DVD-RAM drive, you can use Windows XP Professional to format DVD-RAM discs by using FAT32. Windows XP Professional does not include built-in support for formatting DVD-RAM discs by using NTFS, although some third-party tools might enable this capability.

Windows XP Professional does not support writing to UDF volumes. In addition, Windows XP Professional does not implement the following UDF features:

• Named streams

• Access control lists

• Extended attributes

  Note Windows XP Professional reads the File Create Time from an embedded FileTimes extended attribute recorded in a basic file entry.

Using File System Tools

The tools described in this chapter are installed along with Windows XP Professional in the systemroot\System32 folder. Table 13-14 describes these tools. For more information about tools found in systemroot\System32, see Windows XP Professional Help.

Table 13-14 Summary of File System Tools

Tool	Description
Cacls.exe	Displays and modifies ACLs of files or folders.
Chkdsk.exe	Verifies the logical integrity of a file system on a volume and optionally fixes errors.
Chkntfs.exe	Displays or specifies whether automatic system checking is scheduled to be run on a FAT, FAT32, or NTFS volume when the computer is started.
Cipher.exe	Displays or alters the encryption of folders and files on NTFS volumes.
Compact.exe	Displays and alters the compression of files or directories on NTFS volumes.
Convert.exe	Converts a FAT16 or FAT32 volume to NTFS.
Defrag.exe	Locates and consolidates fragmented boot files, data files, and folders on local or remote volumes.
Diskpart.exe	Manages disks and partitions using scripts or direct input from a command prompt.
Expand.exe	Extracts a file from a compressed file. Use this command to extract a file from a cabinet (.cab) or compressed file.
Format.exe	Prepares a volume to accept files.
Fsutil.exe	Performs many tasks related to file systems—such as managing reparse points, sparse files, and file system behavior—and more.
Mountvol.exe	Creates, deletes, or lists a mounted drive.

File Naming in Windows XP Professional

File names in Windows XP Professional can be up to 255 characters and can contain spaces, multiple periods, and special characters that are not allowed in MS-DOS file names. Windows XP Professional makes it possible for other operating systems to access files that have long names by generating an MS-DOS-readable (8.3) name for each file. These MSDOS-readable names also enable MS-DOS-based and Windows 3.x–based applications to recognize and load files that have long file names. When a program saves a file on a computer running Windows XP Professional, both the 8.3 file name and long file name are retained.

Note The 8.3 format means that files can have between 1 and 8 characters in the file name. The name must start with a letter or a number and can contain any characters except the following:
. “ / \ [ ] : ; | = , * ? (space)
An 8.3 file name typically has a file name extension that is from one to three characters long and has the same character restrictions. A period separates the file name from the file name extension.
Several special file names are reserved by the system and cannot be used for files or folders:
CON, AUX, COM1, COM2, COM3, COM4, LPT1, LPT2, LPT3, PRN, NUL

To see both the long and short file names for each file in the folder, at the command line, type dir /x.

Long File Names at the Command Prompt

At the command prompt, if you type the long name of a file or folder that contains spaces, you must enclose the name in quotation marks. For example, if you have a program called Dump Disk Files and you enter the name without quotation marks at the command line, you will see the error message “Cannot find the program Dump or one of its components.”

You must also use quotation marks around each referenced set of long file names when a path typed at the command line includes spaces, as in the following example:

move “c:\This month’s reports\*.*” “c:\Last month’s reports”

Caution Use wildcard characters such as the asterisk (*) and question mark (?) carefully in conjunction with the del and copy commands. Windows XP Professional searches both long and short file names for matches to the wildcard character combination you specify, which can cause additional files to be deleted or copied. It is always a good idea to run the dir command first on the specified files to make sure you are affecting only the files you intend to use.

Generating Short File Names

In Windows XP Professional, both FAT and NTFS use the Unicode character set, which contains several prohibited characters that MS-DOS cannot read, for their names. To generate a short MS-DOS-readable file name, Windows XP Professional deletes all these characters from the long file name and removes any spaces. Because an MS-DOS-readable file name can have only one period, Windows XP Professional also removes extra periods from the file name. If necessary, Windows XP Professional truncates the file name to six characters and appends a tilde (~) and a number. For example, each nonduplicate file name is appended with ~1. Duplicate file names end with ~2, then ~3, and so on. After the file names are truncated, the file name extensions are truncated to three or fewer characters. Finally, when displaying file names at the command line, Windows XP Professional translates all characters in the file name and extension to uppercase.

Note You can permit extended characters by using the fsutil behavior set command. You must restart the computer before this setting takes effect. For more information about using the fsutil behavior set command, see Windows XP Professional Help.

When five or more files exist that can result in duplicate short file names, Windows XP Professional uses a slightly different method for creating short file names. For the fifth and subsequent files, Windows XP Professional:

• Uses only the first two letters of the long file name

• Generates the next four letters of the short file name by mathematically manipulating the remaining letters of the long file name

• Appends ~1 (or another number, if necessary, to avoid a duplicate file name) to the result

This method substantially improves performance when Windows XP Professional must create short file names for a large number of files with similar long file names. Windows XP Professional uses this method to create short names for files on both FAT and NTFS volumes.

Table 13-15 shows the short file names for files created by six tests.

Table 13-15 Short File Names Created by Windows XP Professional—Example One

Long File Name	Short File Name
This is test 1.txt	THISIS~1.TXT
This is test 2.txt	THISIS~2.TXT
This is test 3.txt	THISIS~3.TXT
This is test 4.txt	THISIS~4.TXT
This is test 5.txt	THA1CA~1.TXT
This is test 6.txt	THA1CE~1.TXT

If the long file names in Table 13-15 are created in a different order, their short file names are different, as shown in Table 13-16.

Table 13-16 Short File Names Created by Windows XP Professional—Example Two

Long File Name	Short File Name
This is test 2.txt	THISIS~1.TXT
This is test 3.txt	THISIS~2.TXT
This is test 1.txt	THISIS~3.TXT
This is test 4.txt	THISIS~4.TXT
This is test 5.txt	THA1CA~1.TXT
This is test 6.txt	THA1CE~1.TXT

When you delete a file, its short file name is also deleted. When you create new files in the same folder, Windows XP Professional might re-use short file names that have been deleted. For instance, in Example 1, if you delete the file “This is test 1.txt,” and then create a new file called “This is test 7.txt,” its short file name becomes THISIS~1.TXT.

Additional Resources

These resources contain additional information related to this chapter.

Related Information

• Chapter 6, “Managing Files and Folders,” for more information about shared folders and shared folder permissions

• Chapter 12, “Organizing Disks”

• Inside Microsoft Windows 2000, Third Edition by David A. Solomon and Mark E. Russinovich, 2000, Redmond: Microsoft Press