NTFS Explained: Features, Limits and Repair

NTFS (New Technology File System) is the file system Windows installs on by default and has used since Windows NT 3.1 in 1993. If you run Windows, almost every file you own lives on NTFS. This guide explains how it works inside, the features admins actually use (permissions, compression, encryption, quotas, links, shadow copies), the limits, and the commands for inspecting and repairing it. For a comparison with FAT32, exFAT and ReFS, see Windows file systems compared.

How NTFS is organised

An NTFS volume is divided into fixed-size clusters (4 KB by default on most volumes). At the start of the volume sits the Master File Table (MFT), a database with one record for every file and folder. Each record stores the file’s attributes: its name, timestamps, security descriptor (who may access it), and its data. Very small files can be stored directly inside the MFT record; larger files store a list of “runs” pointing to the clusters that hold their data. Even the file system’s own bookkeeping is stored as hidden files whose names begin with $ (for example $MFT, $LogFile, $Bitmap, $Boot).

Because a file is just a set of attributes, NTFS can attach more than one data stream to it; see alternate data streams.

Key features

Feature	What it does	How you meet it
Journaling	Logs metadata changes in `$LogFile` so the file system can be made consistent after a crash or power loss without a full scan	Fast recovery after an unclean shutdown. It protects the file system structures, not the contents of your files.
Permissions (ACLs)	Per-user and per-group access control on every file and folder, with inheritance	Right-click > Properties > Security; `icacls`; PowerShell `Get-Acl`
Encryption (EFS)	Encrypts individual files or folders for a user account	Properties > Advanced > Encrypt contents. Not available on Home editions. Whole-drive encryption is BitLocker, a separate feature.
Compression	Transparent per-file or per-folder compression	Properties > Advanced; `compact /c file` (per file or folder); `compact /compactos:query` shows system-wide CompactOS
Disk quotas	Limit how much space each user can use on a volume	Volume Properties > Quota; mostly on servers
Hard links and symbolic links / junctions	Multiple names for one file, or pointers to other paths	`mklink`, `New-Item -ItemType SymbolicLink`
Volume Shadow Copy	Point-in-time snapshots used by backups and “Previous Versions”	`vssadmin list shadows`
Sparse files, reparse points, change journal	Efficient large files, OneDrive placeholders, and the change tracking used by search and backup	Mostly invisible

Limits

NTFS supports files and volumes far larger than any current disk. Maximum file and volume sizes depend on the cluster size, because NTFS can address a limited number of clusters: about 16 TB with 4 KB clusters and 256 TB with 64 KB clusters, rising to roughly 8 PB with 2 MB clusters on Windows 10 version 1709 and later and Windows Server 2019 and later. Check Microsoft’s NTFS overview for the exact current table. A path can normally be up to 260 characters (MAX_PATH) in older applications, but Windows 10 and later can opt in to paths of about 32,767 characters when long path support is enabled. NTFS is case-preserving but by default case-insensitive: File.txt and file.txt are the same name.

Inspecting an NTFS volume

fsutil fsinfo ntfsinfo C:
Get-Volume -DriveLetter C
Get-Partition -DriveLetter C | Format-List Size, Type

fsutil fsinfo ntfsinfo (administrator prompt) shows the NTFS version, cluster size, MFT size and the volume’s serial number. Get-Volume shows the file system type and free space.

Checking and repairing

Run chkdsk C: without switches for a read-only check.
Run chkdsk C: /f to fix file system errors. On the system drive, Windows schedules it for the next restart.
Use chkdsk C: /r to also locate bad sectors and recover readable data. This can take hours on a large disk.
In PowerShell, Repair-Volume -DriveLetter D -Scan and Repair-Volume -DriveLetter D -OfflineScanAndFix scan and repair file system errors, and -SpotFix repairs only what is known to be corrupt. None of them replaces chkdsk /r, which also checks for bad sectors.

If a disk is failing, do not run repair tools on it repeatedly; copy your data off first. The health of the drive itself (SMART data) is a different question, and Get-PhysicalDisk | Format-Table FriendlyName, HealthStatus, OperationalStatus is a quick check.

Permissions in practice

Show and change access with icacls:

icacls D:\Shared
icacls D:\Shared /grant "DOMAIN\Team:(OI)(CI)M"
icacls D:\Shared /inheritance:r

The first command lists the access control entries. The second grants the group Modify that is inherited by files (OI) and subfolders (CI). The third removes inherited permissions, and should be used with care, since it can lock people out. Always add your own administrative access before removing inheritance.

Tips for admins

Cluster size: the default 4 KB is right for almost everything. Larger clusters help only with very large files such as video or databases.
Keep free space: aim for at least 15 percent free on busy volumes, so fragmentation and the MFT do not become a problem.
Do not defragment SSDs manually: Windows runs “optimize” (TRIM) for them automatically.
Back up before converting a FAT32 volume with convert D: /fs:ntfs. It keeps your data but cannot be undone.
Other systems: Linux can read and write NTFS (the in-kernel ntfs3 driver or ntfs-3g), and macOS mounts NTFS read-only by default.

Common questions

Is NTFS better than exFAT?

For Windows disks, yes: it has permissions, journaling and better resilience. exFAT wins when the drive must work across Windows, macOS and cameras.

Can I use NTFS on a USB drive?

Yes. It works on Windows and can be read on Linux and macOS, but macOS needs extra software to write. Remember to use “Safely remove hardware” or set the drive to Better performance only if you always eject it properly.

Does NTFS protect against ransomware?

No. Journaling and permissions do not stop a program running as you from encrypting your files. Use backups and the protections described in the Windows security tips.