1

I was reading up on the NTFS structure here, the major question I wanted to answer for myself was how are the blocks in fragmented streams strung together.

The page explains that in the Master File Table files have information about their streams, but the precise explanation of what information is there and how the streams know what blocks belong to them is absent.

My question:

How exactly does NTFS associate strings of blocks to fragmented streams? Is it block headers with pointers to the next block? a stream-block association table? something even cleverer I didn't think of?

Roman R.
  • 68,205
  • 6
  • 94
  • 158
Geordi
  • 33
  • 2

1 Answers1

0

See the section on "NTFS File Record Attributes". Attribute data (which includes data, streams, names, security info, etc.) can either live in the file record itself ("resident attribute") or be stored in an ordered collection of extents on disk ("non-resident attribute"). In the former case, the data is in the attribute record itself; the latter case has a compressed representation of the extent list is in the attribute record.

MJZ
  • 1,074
  • 6
  • 12