Windows File Systems
What is a File System?
A file system is a means to organize data expected to be retained after a program terminates by providing procedures to store, retrieve and update data, as well as manage the available space on the device(s) which contain it. File system formats define the way that data file is stored on storage media and they affects a file system's structure. A file system organizes data in an efficient manner and is tuned to the specific characteristics of the device. File systems allocate space in a granular manner, usually multiple physical units on the device. The file system is responsible for organizing files and directories and keeping track of which areas of the media belong to which file and which are not being used.
Windows File Systems Formats
CD-ROM File System (CDFS)
CD-ROM File System (implemented in the \Windows\System32\Drivers\Cdfs.sys file), or CDFS, is a read-only file system driver that supports a superset of the ISO-9660 format as well as a superset of the Joliet disk format. While the ISO-9660 format is relatively simple and has limitations such as ASCII uppercase names with a maximum length of 32 characters, Joliet is more flexible and supports Unicode names of arbitrary length. If structures for both formats are present on a disk (to offer maximum compatibility), CDFS uses the Joliet format CDFS has a couple of restrictions: a maximum file size of 4 GB and a maximum of 65535 directories. CDFS is a relatively simple format that was defined in 1988 as the read only formatting standard for CD-ROM media. CDFS is considered a legacy format because the industry has adopted the Universal Disk Format (UDF) as the standard for optical media.
Universal Disk Format (UDF)
Universal Disk Format (UDF) is an implementation of the specification known as ISO/IEC 13346 and ECMA-167 and is an open vendor-neutral file system for computer data storage for a broad range of media. In practice, it has been most widely used for DVDs and newer optical disc formats, supplanting ISO 9660. Due to its design, it is very well suited for incremental updates on both recordable or (re)writable optical media. UDF is developed and maintained by the Optical Storage Technology Association (OSTA). The Windows UDF Driver (implemented in the \Windows\System32\Drivers\Udfs.sys file) supports UDF versions up to 2.60, providing read-write support for DVD-RAM, CD-R/RW, and DVD +-R/RW drives when using UDF 2.50 and read-only support when using UDF 2.60.
File Allocation Table (FAT)
The File Allocation Table (FAT) file system is supported primarily to enable upgrades from previous versions of Windows, for compatibility with other operating systems in multiboot systems and as a format for flash drives or memory cards. The name of each FAT format includes a number that indicates the number of bits the format uses to identify clusters on a disk. The Windows FAT file system driver is implemented in the \Windows\System32\Drivers\Fastfat.sys file.
FAT12’s 12-bit cluster identifier limits a partition to storing a maximum of 2^12 (4,096) clusters; Windows uses cluster sizes from 512 bytes to 8 KB in size, which limits a FAT12 volume size to 32 MB (all FAT file system types reserve the first two clusters and the last 16 clusters of a volume, so the number of usable clusters for a FAT12 volume, for instance, is slightly less than 4,096).
FAT16, with a 16-bit cluster identifier, can address 2^16 (65,536) clusters. On Windows, FAT16 cluster sizes range from 512 bytes (the sector size) to 64 KB, which limits FAT16 volume sizes to 4 GB. The cluster size Windows uses depends on the size of a volume. If you format a volume that is less than 16 MB as FAT by using the format command or the Microsoft Management Console Disk Management snap-in, Windows uses the FAT12 format instead of FAT16. A FAT volume is divided into several regions. The file allocation table (which gives the FAT file system format its name), has one entry for each cluster on a volume; because the file allocation table is critical to the successful interpretation of a volume’s contents, the FAT format maintains two copies of the table so that if a file system driver or consistency-checking program (such as Chkdsk) can’t access one (because of a bad disk sector, for example), it can read from the other. FAT16 is an older file system. It was widely used on Windows NT 4.0 and provides optimal performance on volumes that are less than 2 gigabytes (GB).
In Table 1 you can see the default cluster size corresponding to each volume size in FAT16.
|
Volume size |
Default Cluster Size |
|---|---|
| 0 - 32 MB | 512 bytes |
| 32 - 64 MB | 1 KB |
| 64 - 128 MB | 2 KB |
| 128 - 256 MB | 4 KB |
| 256 - 512 MB | 8 KB |
| 512 - 1024 MB | 16 KB |
| 1024 - 2048 MB | 32 KB |
| 2048 - 4096 MB | 64 KB |
Table 1: Default FAT16 Cluster Sizes in Windows.
FAT32 is the version of FAT introduced with Windows 95 OEM Service Release 2 (OSR2) and Windows 98. FAT32 supports a 32-bit allocation table and supports smaller cluster sizes than FAT16, in order to more efficiently allocate space. FAT32 uses 32-bit cluster identifiers but reserves the high 4 bits, so in effect it has 28-bit cluster identifeers. Because FAT32 cluster sizes can be as large as 32 KB, FAT32 has a theoretical ability to address 8-terabyte (TB) volumes. Although Windows works with existing FAT32 volumes of larger sizes (created in other operating systems), it limits new FAT32 volumes to a maximum of 32 GB. FAT32’s higher potential cluster numbers let it manage disks more efficiently than FAT16: it can handle up to 128-GB volumes with 512-byte clusters. Besides the higher limit on cluster numbers, other advantages FAT32 has over FAT12 and FAT16 include the fact that the FAT32 root directory isn’t stored at a predefined location on the volume, the root directory doesn’t have an upper limit on its size and FAT32 stores a second copy of the boot sector for reliability. A limitation FAT32 shares with FAT16 is that the maximum file size is 4 GB because directories store file sizes as 32-bit values.
In Table 2 you can see the default cluster size corresponding to each volume size in FAT32.
|
Volume size |
Default Cluster Size |
|---|---|
| 32 MB - 8 GB | 4 KB |
| 8 GB - 16 GB | 8 KB |
| 16 GB - 32 GB | 16 KB |
| 32 GB | 32 KB |
Table 2: Default FAT32 Cluster Sizes in Windows.
Extended File Allocation Table (exFAT)
Designed by Microsoft, the Extended File Allocation Table file system (exFAT, also called FAT64) is an improvement over the traditional FAT file systems and is specifically designed for flash drives. The main goal of exFAT is to provide some of the advanced functionality offered by NTFS, but without the metadata structure overhead and metadata logging that create write patterns not suited for many flash media devices. As the FAT64 name implies, the file size limit is increased to 2^64, allowing files up to 16 exabytes; this change is also matched by an increase in the maximum cluster size, which is currently implemented as 32 MB but can be as large as 2^255 sectors. exFAT also adds a bitmap that tracks free clusters, which improves the performance of allocation and deletion operations. Finally, exFAT allows more than 1,000 files in a single directory; these characteristics result in increased scalability and support for large disk sizes. Additionally, exFAT implements certain features previously available only in NTFS, such as support for access control lists (ACLs) and transactions (called Transaction-Safe FAT or TFAT).
The exFAT file system is implemented in the \Windows\System32\Drivers\exfat.sys file.
New Technology File System (NTFS)
New Technology File System (implemented in the \Windows\System32\Drivers\Ntfs.sys file), or NTFS, is the native file system format of Windows: NTFS uses 64-bit cluster numbers and can address volumes of up to 16 exaclusters; however, Windows limits the size of an NTFS volume to that addressable with 32-bit clusters, which is slightly less than 256 TB (using 64-KB clusters; you can override the default when you format an NTFS volume). NTFS also supports 2^32–1 files per volume. The NTFS format allows for files that are 16 exabytes in size, but the implementation limits the maximum file size to 16 TB. NTFS includes a number of advanced features, such as file and directory security, alternate data streams, disk quotas, sparse files, file compression, symbolic (soft) and hard links, support for transactional semantics and encryption. One of its most significant features is recoverability: if a system is halted unexpectedly, the metadata of a FAT volume can be left in an inconsistent state, leading to the corruption of large amounts of file and directory data; NTFS logs changes to metadata in a transactional manner so that file system structures can be repaired to a consistent state with no loss of file or directory structure information (file data can be lost, however). Additionally, the NTFS driver in Windows also implements self-healing, a mechanism through which it makes most minor repairs to corruption of file system on-disk structures while Windows is running and without requiring a reboot.
In Table 3 you can see the default cluster size corresponding to each volume size in NTFS.
|
Volume size |
Default Cluster Size |
|---|---|
| 512 MB or less | 512 bytes |
| 512 MB - 1024 MB | 1 KB |
| 1024 MB - 2048 MB | 2 KB |
| Greater than 2048 MB | 4 KB |
Table 3: Default NTFS Cluster Sizes in Windows.
Protogon
This new file system was seen in the Windows 7 Alpha and again in Windows 8 Alphas, but was removed before the Beta was released.
WinFS
WinFS is the code name for a cancelled (as you can read in the MSDN Blog's post titled "WinFS Update" by Quentin Clark, WinFS Program Manager) data storage and management system project based on relational databases, developed by Microsoft and first demonstrated in 2003 as an advanced storage subsystem for the Microsoft Windows operating system, designed for persistence and management of structured, semi-structured as well as unstructured data. WinFS includes a relational database for storage of information and allows any type of information to be stored in it, provided there is a well defined schema for the type. Individual data items could then be related together by relationships, which are either inferred by the system based on certain attributes or explicitly stated by the user. As the data has a well defined schema, any application can reuse the data; and using the relationships, related data can be effectively organized as well as retrieved. Because the system knows the structure and intent of the information, it can be used to make complex queries that enable advanced searching through the data and aggregating various data items by exploiting the relationships between them.
Resilient File System (ReFS)
The next Windows release (Windows Server 2012) will introduce a newly engineered file system, named ReFS, which stands for Resilient File System. It is built on the foundations of NTFS, so it maintains crucial compatibility while at the same time it has been architected and engineered for a new generation of storage technologies and scenarios. ReFS has been introduced as part of Windows Server 2012.
The current state of the evolution of ReFS along with a description of its key goals and features can be read in the "Building the next generation file system for Windows: ReFS" post by Steven Sinofsky in the MSDN "Building Windows 8" Blog.
Community Resources
Wiki Pages
TechNet Library Pages
- FAT File System
- Compact Disk File System
- The NTFS File System
- Universal Disk Format
- Security
- Working with File Systems
- File Systems Technologies
- Maximum Volume Sizes
- How FAT Works
- How NTFS Works
Technical Articles
- WinFS 101: Introducing the New Windows File System
- Blog: Windows Server 2012: Does ReFS replace NTFS? When should I use it?
Microsoft Knowledge Base Articles
- FAT Type and Cluster Size Depends on Logical Drive Size (KB67321)
- Overview of FAT, HPFS, and NTFS File Systems (KB100108)
- NTFS System Files (KB103657)
- Maximum Partition Size Using FAT16 File System (KB118335)
- Description of the FAT32 File System (KB154997)
- Default cluster size for NTFS, FAT, and exFAT (KB140365)
- Limitations of FAT32 File System (KB184006)
- Description of the FAT32 File System in Windows XP (KB310525)
- Maximum partition size using the FAT16 file system in Windows XP (KB310561)
- Limitations of the FAT32 File System in Windows XP (KB314463)
- The Default Cluster Size for the NTFS and FAT File Systems (KB314878)
- CD-ROM Drive May Not Be Able to Read a UDF-Formatted Disc in Windows XP (KB321640)
White Papers
MSDN Magazine Articles
- Revolutionary File Storage System Lets Users Search and Manage Files Based on Content (MSDN Magazine, January 2004)
**Microsoft Support Article
**
Overview of FAT, HPFS, and NTFS File Systems
This article explains the differences between FAT, HPFS, and NTFS under Windows NT, and their advantages and disadvantages.
See Also
NOTE: this section provides links that are external to the TechNet Wiki.
Documents
- Standard ECMA-119 - Volume and File Structure of CDROM for Information Interchange
- Standard ECMA-167 - Volume and File Structure for Write-Once and Rewritable Media using Non-Sequential Recording for Information Interchange
Books
- Inside Windows 2000, 3rd Edition (Chapter 12, "File Systems") by David A. Solomon and Mark E. Russinovich (Microsoft Press, August 2000)
- Windows Internals, 4th Edition (Chapter 12, "File Systems") by David A. Solomon and Mark E. Russinovich (Microsoft Press, December 2004)
- Windows Internals, 5th Edition (Chapter 11, "File Systems") by David A. Solomon, Mark E. Russinovich and Alex Ionescu (Microsoft Press, June 2009)
Other Languages
This article is also available in the following languages: