NTFS File Information Explained: Metadata, Attributes, and Permissions

Common NTFS File Information Fields Every Admin Should Know

NTFS (New Technology File System) stores rich metadata for files and directories beyond simple names and sizes. For administrators, understanding these fields is essential for tasks like forensics, auditing, system optimization, and troubleshooting. This article summarizes the key NTFS file information fields, what they mean, where to find them, and how admins typically use them.

1. File Name and Namespace

• File name: The human-readable name (supports Unicode).
• Namespace: NTFS supports multiple name namespaces—POSIX, Win32, and Win32+—allowing different name representations for the same file.
• Usage: Useful when tracking files created by different APIs or when recovering files with alternate names.

2. File Reference (MFT Record Number)

• Description: Unique identifier for a file’s Master File Table (MFT) record (also called File Reference Number).
• Usage: Critical in forensic analysis and low-level file system operations; links a file to its MFT entry and to attributes stored there.

3. Parent Directory (Parent File Reference)

• Description: Reference to the MFT record of the file’s parent directory.
• Usage: Reconstructs directory trees, resolves moved/renamed files, and validates filesystem integrity.

4. Timestamps

NTFS stores multiple timestamp fields (all in UTC unless converted):

• Creation Time: When the file was created.
• Last Modified (Write) Time: Last time file content changed.
• Last Access Time: Last time the file was read (can be disabled for performance).
• MFT Entry Modified (Change) Time: When metadata or MFT entry changed (e.g., attribute updates, renames).
• Usage: Vital for timeline analysis, detecting suspicious activity, and backup policies.

5. File Size and Valid Data Length

• Allocated Size (on-disk): Space reserved in the file (including slack).
• File Size (Logical): The logical size as reported to applications.
• Valid Data Length (VDL): Indicates which parts of a sparse or partially allocated file contain valid data.
• Usage: Important for storage planning, handling sparse files, and understanding apparent vs. real disk usage.

6. Attributes and Flags

• Common attributes: Read-only, Hidden, System, Archive, Temporary, Offline, Not Content Indexed, No Scrub, Reparse Point, Compressed, Encrypted.
• Usage: Controls file behavior, visibility, backup and indexing policies; flags like Encrypted and Compressed affect data handling and recovery.

7. Security Descriptor (Permissions)

• Description: Stores NTFS ACLs (DACL/SACL), owner SID, and inheritance info.
• Usage: Governs access control, auditing, and determines whether elevated privileges are needed to access or modify a file.

8. Extended Attributes (EA) and Alternate Data Streams (ADS)

• EA: Legacy POSIX-style extended attributes.
• ADS: Named streams attached to a file (e.g., filename:stream).
• Usage: ADS can hide data or store metadata; admins should inspect ADS for security concerns and backup completeness.

9. Reparse Point and Link Information

• Reparse Point: Marker used for junctions, symbolic links, or other filesystem filter behaviors.
• Link Count: Number of hard links referencing the same MFT record.
• Usage: Important for understanding file redirection, link-based deletion, and storage referencing.

10. Attribute List (Non-resident Attributes)

• Description: For large files or those with many attributes, NTFS stores attributes outside the base MFT record with an attribute list pointing to their locations.
• Usage: Helpful when troubleshooting fragmented MFT entries or diagnosing large/complex files.

11. Cluster Mapping / Data Runs

• Description: For non-resident attributes, data runs map logical file content to physical disk clusters.
• Usage: Used in defragmentation, recovery, and forensic analysis to locate file fragments.

12. File IDs and Object IDs

• File ID: Persistent identifier assigned by the system (used by APIs).
• Object ID: Optional 128-bit GUID stored in an attribute for identifying files across volumes or for replication.
• Usage: Useful for backup/restore, DFS replication, and deduplication tracking.

13. Quota and Owner Information

• Owner SID: Identifies file owner.
• Quota-related metadata: If quotas are enabled, files contribute to user disk usage tracked by the NTFS quota system.
• Usage: For enforcing storage limits and auditing ownership.

Where to Inspect These Fields

• Built-in tools: fsutil, icacls, dir /r (shows ADS), attrib, fsutil usn (Update Sequence Number) queries.
• Forensic and admin tools: NTFSWalker, Sleuth Kit, FTK, X-Ways, EnCase.
• Programmatic access: Windows APIs (GetFileInformationByHandleEx), PowerShell (Get-Item, Get-Acl), and libraries that parse MFT.

Practical Tips for Admins

• Enable/disable last access updates according to performance vs. auditing needs.
• Monitor MFT growth—lots of small files can bloat the MFT and impact performance.
• Check ADS on critical files and incoming files from untrusted sources.
• Use object IDs when implementing replication or deduplication systems.
• Back up ACLs and ADS