Subject: Digital Forensics

Topic: Preserving and Recovering Digital Evidence

Difficulty: High

NTFS, an acronym that stands for New Technology File System, is a file systemfirst introduced by Microsoft in 1993 with the release of Windows NT 3.1.

NTFS is the primary file system used in Microsoft's Windows 10, Windows 8, Windows 7, Windows Vista, Windows XP, Windows 2000, and Windows NT operating systems.

The Windows Server line of operating systems also primarily use NTFS.

How to See If a Drive Is Formatted as NTFS

There are a few different ways to check if a hard drive has been formatted with NTFS, or if it's using a different file system.

With Disk Management

The first and probably easiest way to the status of one or more drives is to use Disk Management. See How Do I Open Disk Management in Windows? if you've never worked with Disk Management before. The file system is listed right here, alongside the volume and other details about the drive.

In Windows Explorer

Another way to check to see if a drive was formatted with the NTFS file system is by right-clicking or tap-and-holding on the drive in question, either from File Explorer or Windows Explorer, depending on your version of Windows. Next, choose Properties from the drop-down menu. Check the File system listed right there on the General tab. If the drive is NTFS, it will read File system: NTFS.

Through a Command Prompt Command

Yet another way to see which file system a hard drive is using is through the command-line interface. Open Command Prompt and enter fsutil fsinfo volumeinfo drive_letter to show various details about a hard drive, including its file system. For example, you can use fsutil fsinfo volumeinfo C: to do this for the C: drive. If you don't know the drive letter, you can get a print out using the fsutil fsinfo drives command.

NTFS File System Features

Theoretically, NTFS can support hard drives up to just under 16 EB. Individual file size is capped at just under 256 TB, at least in Windows 8 and Windows 10, as well as in some newer Windows Server versions.

NTFS supports disk usage quotas. Disk usage quotas are set by an administrator to restrict the amount of disk space that a user can take up. It's used mainly to control the amount of shared disk space someone can use, usually on a network drive. File attributes previously unseen in Windows operating systems, like the compressed attribute and indexed attribute, are available with NTFS-formatted drives.

Encrypting File System (EFS) is another feature supported by NTFS. EFS provides file-level encryption, which means that individual files and folders can be encrypted. This is a different feature than full-disk encryption, which is the encryption of an entire drive (like what's seen in these disk encryption programs).

NTFS is a journaling file system, which means it provides a way for system changes to be written to a log, or a journal, before the changes are actually written. This allows the file system to revert to previous, well-working conditions in the event of a failure because the new changes have yet to be committed.

Volume Shadow Copy Service (VSS) is an NTFS feature that can be used by online backup service programs and other backup software tools to back up files that are currently being used, as well as by Windows itself to store backups of your files.

Another feature introduced in this file system is called transactional NTFS. This feature allows software developers to build applications that either completely succeed or completely fail. Programs that take advantage of transactional NTFS don't run the risk of applying a few changes that do work as well as a few changes that don't, a recipe for serious problems.