NTFS Overview

NTFS is the primary file system used by Windows computers. The file system consists of file system metadata files which collectively enable the file system to store and retrieve files and provide the necessary security permissions on files and directories. A few examples of other features include the addition of alternate data or named streams, file compression, file encryption and distributed link tracking. NTFS is a journaling file system and records all file and metadata transactions.

The NTFS file system is understood by Linux, OSX and other non-Windows operating systems.

There are many references on the World Wide Web regarding NTFS. An understanding of NTFS basics will be a requirement to be an effective malware investigator

Additional information…

The file system was first introduced in 1993 with the advent of the Windows NT operating system. Over time improvements and additional features have been included creating an impressive and robust file system.