What is NTFS and how does it work?

How is NTFS used?

NTFS continues to be the primary file system for Windows 10, Windows 11 and Windows Server versions 2016, 2019, 2022 and 2025. These Windows OSes use NTFS to organize, name and store files on SSDs and HDDs.

NTFS can be used with Cluster Shared Volumes (CSV) to easily manage a large number of logical unit numbers (LUNs) in a Windows Server failover cluster. Additionally, the CSV provides continuously available volumes in these clusters. The NTFS volumes can be simultaneously accessed by multiple cluster nodes in a failover cluster. Multiple nodes in Azure Local (versions 23H2 and 22H2) can also use NTFS and CSV to access the same disk (LUN) that's provisioned as an NTFS volume.

The clustered roles can fail over quickly from one node to another without requiring a volume to be dismounted and then remounted. There's also no need to take a volume offline or use the disruptive chkdsk.exe tool to correct transient corruption issues of disk volumes. Instead, NTFS includes a self-healing capability by default to automatically, efficiently, and reliably eliminate corruption in the background. If there is a major issue that NTFS cannot automatically fix, it will notify users along with possible solutions.

Authorized users, such as system admins, can use NTFS to restore a system after a failure event, such as a server crash. In addition, NTFS uses its log file and checkpoint information to recover data and maintain file system consistency. Admins can also use the chkdsk utility to scan and analyze the drive while the volume is online.

NTFS is very useful when the space on a volume is limited because it allows flexible capacity allocations. Disk quotas can be used to control disk space usage, while many files can be compressed to store more data on NTFS volumes. Volume space can also be increased by adding unallocated space.

NTFS can be used to set permissions and access controls on files and folders. Also, data can be encrypted using BitLocker Drive Encryption. These approaches help to secure files and lower the possibility of corruption by malicious users like hackers and data thieves.

NTFS is frequently used for large volumes up to 8 petabytes (PB), where older file systems like file allocation table (FAT) and High-Performance File System (HPFS) are unsuitable. For large VDHX files larger than 1 terabyte (TB), users must use the Format-Volume cmdlet in Windows PowerShell with specific Windows-defined parameters.

How NTFS works

The OS determines which file system will be used. For example, NTFS is the default file system for Windows 10/11 and for all versions of Windows Server after version 2016. But older versions of Windows -- Windows NT, Windows 95, Windows 98, Windows 2000 -- support either HPFS or FAT file systems.

When an HDD is formatted or initialized, it is divided into partitions. Partitions are the major divisions of the hard drive's physical space. Within each partition, the OS keeps track of all the files it stores. Each file is stored on the HDD in one or more clusters or disk spaces of a predefined uniform size. A cluster refers to the smallest unit of size that the NTFS can reference when accessing storage

In NTFS, cluster sizes range from 4 kilobytes (KB), which is the default size, to 2048 KB. NTFS supports different combinations of cluster sizes and volumes. For example, a 4 KB cluster can have a maximum volume of 16 TB, while the maximum volume for a 2048 KB cluster can be as high as 8 PB.

Cluster size and deployment often determine system performance. In general, higher cluster sizes offer increased volume and file capacity. This can be a big advantage when a volume holds many large files, and in situations involving the use of Hyper-V, Structured Query Language or deduplication. On the other hand, smaller clusters can be used to minimize wasted space when storing small files. That said, Microsoft discourages the use of clusters smaller than 4 KB.

NTFS features

Some of the notable features of NTFS include:

• Quick file access. NTFS uses a binary tree directory scheme to index files and keep track of file clusters. This allows for efficient file sorting, organization, and retrieval.
• File size. NTFS supports very large files, with maximum allowable volumes of 16 TB.
• Continuously available volumes. NTFS can be used with the CSV file system in Windows Server failover clusters to enable multiple cluster nodes to access continuously available volumes simultaneously.
• User permissions. NTFS has an access control list (ACL) that lets a server administrator control who can access specific files and the access type.
• Compression. Integrated file compression shrinks file sizes and provides more storage space.
• Unicode file naming. Because it supports file names based on Unicode, long file names can be used with a wider array of characters. Short names can also be used on the system volume to ensure application compatibility. NTFS also supports extended-length paths.
• Security features. NTFS provides increased data security with features like encryption, rich metadata and disk quotas.
• Extra storage space. With NTFS, extra storage space can be created by mounting a volume at any empty folder on a local NTFS volume.

Advantages of NTFS

There are several advantages to using NTFS, which are included below.

• Support for large volumes. NTFS supports volumes ranging in size from 16 TB to 8 PB on Windows Server 2019 and newer, and on Windows 10, v1709 and newer.
• Control. NTFS provides disc quotas, which enable administrators to limit and control the amount of storage space on shared drives.
• Performance. NTFS uses file compression, which shrinks file sizes, increasing file transfer speeds and providing more storage space.
• Security. NTFS's built-in security features let administrators grant permissions to sensitive data, restricting access to certain users. NTFS also supports encryption to protect data integrity.
• Easy logging for transaction rollbacks. NTFS logs all transactions, making it possible to rollback transactions in order to restore a system and recover data. The built-in logging and auditing system also allows administrators to track files that have been deleted, added or changed in any way.
• Reliability. Data and files can be quickly restored in the event of a system failure or error, because NTFS dynamically remaps clusters with bad sectors and allocates new clusters for data.

Disadvantages of NTFS

The main disadvantages of the NTFS file system are:

• Limited OS compatibility. The main disadvantage of NTFS is that it is read-only with non-Windows OSes, such as macOS.
• It's unsuitable for smaller volumes. NTFS has a lot of space overhead -- 4 megabytes (MB) of drive space on a 100-MB partition -- making it unsuitable for volumes smaller than 400 MB. The overhead also makes it impossible to format floppy disks with NTFS.
• No built-in file encryption. While NTFS provides data encryption, it doesn't support file encryption. This can allow anyone to view the data stored on an NTFS volume, for example, by using a low-level disk editing utility.
• Possible partition size limitations. Underlying hardware limitations might limit the partition size possible with NTFS. The partition table is also limited to a maximum of 2 TB.

NTFS vs. FAT vs. HPFS

File systems are generally differentiated by the OS and the type of drive they are used with. NTFS is one type of file system. NTFS is the Windows 10/11/Server equivalent of the older Windows file systems: FAT and HPFS.

Although NTFS, FAT, and HPFS are all file systems for Windows OSes, they have several differences.

Both FAT and HPFS are only supported under older versions of Windows. In particular, HPFS, which was first introduced with OS/2 1.2, is now only supported under the now-end-of-life (EOL) Windows NT OS versions 3.1, 3.5, and 3.51. FAT (specifically, FAT32) is available for Windows 98/Windows 95 OSR2 and Windows 2000.

FAT is a very simple file system. A FAT-formatted disk is allocated in clusters. The cluster size depends on the volume size. FAT supports only read-only, hidden, system and archive file attributes.

FAT uses a file allocation table that resides at the very top of the volume and is stored -- along with the root directory -- in a fixed location to allow for the system's boot files to be correctly located. The FAT directory structure is not organized in any particular way. Every time a file is created, an entry is created in the FAT table. The FAT table must be regularly updated to prevent data loss.

One advantage of the FAT system is that it allows for file undeletes. Undeletes are not possible with older Windows OS (e.g., Windows NT) and their associated older file systems. Also, FAT starts out with little overhead, making it a suitable file system for drives or partitions that are smaller than 200 MB. The main drawback of FAT is that for volumes of over 200 MB, disk performance tends to decrease. Another is that it is not possible to set permissions on files that are FAT partitions.

HPFS organizes drives into multiple 8-MB bands, with files usually contained within one of these bands and in contiguous sectors. The file system maintains the directory organization of FAT, although directory entries under HPFS hold more information than they would under FAT. Also, unlike FAT where files are given the first open location on the drive, the directory entries in HPFS point to the FNODE. HPFS also automatically sorts the directory based on filename and provides increased flexibility by allowing for files to be composed of data and special attributes.

In contrast to FAT, HPFS is best for drives in the 200-400 MB volume range. It is not suited for volumes under 200 MB due to the overhead involved. And for volumes over 400 MB, it often causes performance degradation. Another limitation of HPFS is that it is not possible to set security on HPFS under Windows NT.

NTFS supports bigger volumes and cluster sizes than HPFS and FAT. Unlike these other file systems, NTFS doesn't use any special locations or objects on the disc. Additionally, it is not dependent on the underlying hardware, so it can often avoid partition size limitations.

Advantages of NTFS over FAT and HPFS

Like HPFS, NTFS organizes files into directories and also automatically sorts the directories based on filenames.

NTFS offers several improvements over FAT and HPFS in terms of performance, extendibility and security. It also removes many of FAT and HPFS's limitations. For example, it increases the size of files and volumes. In fact, it can support volumes as large as 8 PB on Windows Server 2019 and newer and Windows 10, version 1709 and newer.

Additionally, NTFS provides excellent performance even with larger volumes (400 MB or more). This is one of its standout advantages over FAT and HPFS.

NTFS also eliminates problems related to a fixed sector size (common with HPFS). Additionally, performance does not degrade with larger volume sizes (common with FAT), making NTFS ideal for volumes of 400 MB or more. These advantages are particularly valuable for high-end systems and file servers.

Unlike HPFS, NTFS doesn't include special data objects. This allows the file system to avoid fatal single-sector failures. It also tracks and protects all the objects on the disk and maintains multiple copies of the Master File Table (MFT).

NTFS also allows for better recoverability because it keeps track of transactions through a log. Chkdsk can use the log to roll back transactions to the last commit point to recover files and also maintain consistency within the file system. The built-in recoverability capabilities in NTFS mean that there's rarely any need to run a disk repair utility on NTFS partitions to recover data and avoid data loss.

NTFS also supports hot fixing. When it detects a bad sector, it uses a table of hotfixes to handle write errors. It does this by using the hotfixes entry to logically point to an existing good sector and mark the original sector as bad. FAT does not support hot fixing. HPFS does support hot fixing, but not with the version included in Windows NT.

NTFS provides additional functionality unavailable with FAT or HPFS. It provides a rich and flexible platform that other file systems can use. NTFS also supports multiple data streams, is POSIX.1 compliant, and allows for the addition of user-defined attributes to a file.

Finally, NTFS includes numerous security features that are not available with FAT or HPFS. For one, it fully supports the Windows NT security model. It provides ACL-based security for files and folders, meaning certain authorized users (e.g., admins) can set permissions and restrict or allow specific users and groups. NTFS also supports BitLocker drive encryption to protect critical system information on NTFS volumes.

NTFS vs. FAT32 vs. exFAT

Microsoft developed FAT32, the 32-bit version of the FAT file system, before NTFS, making FAT32 the oldest Windows file system. FAT 32 works with every version of Mac, Linux and Windows. However, it is generally considered less efficient than NTFS.

In contrast to NTFS, which supports volumes of up to 8 PB in size, FAT32 has a smaller 4 GB file size. This means file partitions are limited to a maximum size of 4 GB. If a file size is larger, FAT32 is not particularly efficient.

FAT32 is easier to format and simpler to use than NTFS. Its file allocation table is a less complex way to organize files than the MFT in NTFS. For these reasons, FAT32 is more commonly used with devices that need wide compatibility, such as memory cards, external hard drives, and devices with USB ports.

An evolution of FAT32 is exFAT. It retains the positive characteristics of FAT32 -- a lightweight, more flexible file allocation system -- while overcoming some of its limitations. For example, FAT32 can only store files up to 4 GB, while exFAT can handle file sizes of up to 128 PB. Unlike FAT32, which allows a maximum partition size of 2 TB, exFAT allows partitions of up to 128 TB. These improvements make exFAT suitable for removable drives that have larger file sizes (+4 GB) but don't need the wide compatibility provided by FAT32.

exFAT works with Windows and modern versions of macOS systems. It requires additional software to work with older Linux systems, although it does work with Linux Kernel 5.7 and newer Linux versions. In contrast, NTFS only works with Windows systems. It is read-only on Mac systems and works with some Linux systems.

NTFS is the best choice for formatting internal hard drives if the system uses a Windows OS since it supports large and continuously available volumes, increases system reliability by correcting corruption issues, and provides numerous data security features including encryption, disk quotas, and rich metadata.

The file system chosen -- NTFS, FAT, or exFAT-- mainly depends on the device type. FAT32 is best suited for USB drives, removable HDDs and gaming consoles with file sizes smaller than 4 GB, regardless of whether the system is based on Windows, Mac or Linux OS. ExFAT can be a better choice for external hard drives or flash drives that need storage capacities greater than 4 GB.

The file system takeaway

All the file systems discussed above -- NTFS, FAT32, HPFS, and exFAT -- have their strengths and weaknesses. However, each is also used in a variety of computing contexts, from personal computing to the enterprise. NTFS is prominent among the three because of its connection to Windows.

Learn more about the differences between these well-established file systems and how they are used in enterprises today.