August 01, 2022

What Is NTFS and How Does It Work?

By David Weiss
Endpoint BackupInfrastructureDatto Endpoint Backup

NT file system (NTFS), which is also sometimes called the New Technology File System, is a process that the Windows NT operating system uses for storing, organizing, and finding files on a hard disk efficiently.

NTFS was first introduced in 1993, as apart of the Windows NT 3.1 release.

The benefits of NTFS are that, compared to other similar file systems like File Allocation Table (FAT) and High-Performance File System (HPFS), NTFS focuses on:

  • Performance: NTFS allows file compression so your organization can enjoy increased storage space on a disk.
  • Security access control: NTFS will enable you to place permissions on files and folders so you can restrict access to mission-critical data.
  • Reliability: NTFS focuses on the consistency of the file system so that in the event of a disaster (such as a power loss or system failure), you can quickly restore your data.
  • Disk space utilization: In addition to file compression, NTFS also allows disk quotas. This feature enables businesses to have even more control over storage space.
  • File system journaling: This means that you can easily keep a log of⁠—and audit⁠—the files added, modified, or deleted on a drive. This log is called the Master File Table (MFT).

How Does NTFS Work

The technical breakdown of NTFS is as follow

  1. A hard disk is formatted
  2. A file gets divided into partitions within the hard disk
  3. Within each partition, the operating system tracks every file stored in a specific operating system
  4. Each file is distributed and stored in one or more clusters or disk spaces of a predefined uniform size (on the hard disk)
  5. The size of each cluster will range from 512 bytes to 64 kilobytes

You can control the size of a cluster size based on what’s most important to your organization:

  • Efficient use of disk space
  • The number of disk accesses required to access a file

Drawbacks of NTFS

The primary disadvantage of NTFS is that its modern capabilities aren’t accessible to older technology. And, because NTFS is designed to work with a Windows operating system, devices that operated from Mac or Android aren’t always compatible. For example:

  1. Mac OS computers can read NTFS formatted drives, but they can only get written to NTFS with the help of third-party software
  2. Media devices like DVD players, TVs, and digital cameras are likely too old to leverage NTFS storage devices

Additionally, NTFS does not include a system for guaranteeing performance and bandwidth to the file system, which can pose a problem to some users.

Who Uses NTFS?

Today, NTFS is used most often with the following Microsoft operating systems:

  • Windows 10
  • Windows 8
  • Windows 7
  • Windows Vista
  • Windows XP
  • Windows 2000
  • Windows NT

However, it is possible to leverage NTFS with other operating systems like Linux and BSD.

File Restore With NTFS Permissions

NTFS permissions provide access control for files and folders, containers and objects on shared systems, typically network attached storage (NAS). There are five basic NTFS permissions:

  1. Read: Allows the user or group to read the file and view its attributes, ownership, and permissions set.
  2. Write: Allows the user or group to overwrite the file, change its attributes, view its ownership, and view the permissions set.
  3. Read & Execute: Allows the user or group to run and execute the application, and perform all actions allowed by the Read permission.
  4. Modify: Allows the user or group to modify and delete a file, and perform all of the actions permitted by the Read, Write, and Read and Execute permissions.
  5. Full Control: Allows the user or group to change the permission set on a file, take ownership of the file, and perform actions permitted by all other permissions

Datto SIRIS can Restore Files With NTFS Permissions

Datto SIRIS offers a variety of backup and restore types to meet different recovery scenarios. One of these is known as File Restore with NTFS Permissions. It is specifically designed to restore an externally-hosted NAS share its file permissions intact.


To perform this type of restore, you must first back up a NAS share with NTFS permissions intact. This enables the contents of the selected recovery point to be shared over your network as an iSCSI target. Upon restore, all files and folders in the recovery point will include the ACL attributes (read: permissions) they had at the time of the snapshot.

To learn more about Datto restore capabilities, check out Datto SIRIS 

Suggested Next Reads

What is a Zero-Day Vulnerability?

A zero-day vulnerability is a software flaw that is unknown to the vendor and subject to exploitation. Learn how to identify them and prevent zero-day attacks.