| TABLE 2: NTFS Metadata Files |
| NameMFT |
Record |
Description |
| $MFT |
0 |
Master File Table—NTFS's command central |
| $MFTMIRR |
1 |
Copy of the first 16 records of the MFT |
| $LOGFILE |
2 |
Transactional logging file |
| $VOLUME |
3 |
Contains volume serial number, creation time, and dirty flag |
| $ATTRDEF |
4 |
Attribute definitions |
| . |
5 |
Root directory of the disk |
| $BITMAP |
6 |
Contains drive's cluster map (in-use vs. free) |
| $BOOT |
7 |
Boot record of the drive |
| $BADCLUS |
8 |
Lists bad clusters on the drive |
| $QUOTA |
9 |
Contains user quota information—unused before NT 5.0 NTFS |
| $UPCASE |
10 |
Maps lowercase characters to their uppercase version |