Everybody and welcome to the introduction of video on the windows file system.
So the first thing we're going to talk about is NTFS.
So NTFS is the type is the type of file system that Windows uses.
So NTFS in a nutshell is also called new technology file systems or sometimes just called the windows
and T file system.
It's built proprietary by Microsoft.
It's used in most common recent versions of Windows and it is a journal based file system.
So what that means is as it keeps.
Think of it as a as a transaction a journal of transactions or changes that are going to occur that
just haven't gotten committed to the actual file system yet.
And that's done so in case any power vanishes.
Nothing was lost because it was still recorded.
So if it was mid change on something it would go back and look at the last records start from there.
So that's an in a big nutshell of kind of what it is.
So we're gonna go into a little bit more detail now on how it's structured how the internal workings
of that kind of work.
We're not going to go too deep as such as like opening up a hex editor and starting to show you where
where the beginning and ending part is.
I will link to a lot of descriptions and links above this video if you want to go into more detail on
that specific side and looking at hex code and such.
So the format the format is a general.
It's got the boot sector where all of the boot code actually resides for loading the OS getting everything
kind of working then we have the Master File Table which we'll go over in a little bit and then the
actual file system data itself.
So the actual text of files images et cetera and then we have a copy of the Master File Table at the
end.
So what is the Master File Table.
It is a table that keeps a record of information about every file on the NTFS system.
So that includes the file table as well.
So this is the structure of kind of what it looks like.
So we have the NFTE and a copy of itself and then 14 default records which you can go over in the next
slide and then it's you know the file records directory records file directory.
It doesn't have to necessarily in a file directory file directory order it just know that the data comes
after that but there are the first 16 as you can see here the first the top three in my chart but the
first 16 records in place are always there ahead of time.
So some data about each file is like the size the time the permissions that can be done on the file.
In some cases the content which will go over a second.
So the first thing first 16 records is obviously the massive file table the copy of itself.
This is done so that in case a an issue were to occur it has a copy of of itself in case there's a corruption
of any kind.
Then there's the volume information such as the label of the volume.
In this case you can think of this as like the the C drive you know what it's called and then the version
of the volume itself attribute definitions which the list of I'm not going to go over a full list of
attributes but the.
There is one in the link above.
There can be quite a bit of them where the root folder is and the cluster bitmap again clusters are
kind of their own thing.
It's a cluster on the volumes that go in powers of two.
So there are a few different types.
Again I've linked more details if you want to go into that above the video we have the boot sector code
as well to mount the actual volume.
The bad clusters file to keep track of anything that the NTFS system is labeled as a bad cluster the
security file for unique security descriptors.
Who has access to what etc..
And then we have the upper case table so this is to make sure it can convert lowercase to uppercase
for unicode.
And then the last five records are reserved for other miscellaneous things.
So what does an MF t record actually look like.
So we have the MF t header which kind of contains in standard information such as like the timestamp
the access mode how how things are accessed.
Next we have an attribute list.
It's a list of the attributes that we were talking that I talked about before but there's ones dedicated
for files and folders.
Now this can be a large list.
An example of this is security descriptors volume information such as who can access what et cetera.
So that's all of that stuff is there.
The next section is the name of the file or directory.
Now this can be up to two hundred fifty five characters but it has of Unicode characters.
If you go any more than that it will let you do that.
So next thing is the debtor index.
So a full record of NFTE is going to be about one killed.
And it has to fill that full amount per record.
If your file happens to be less than 1 kill by and it's and it's small enough that after all of the
attribute list the standard information the name all of that stuff is stored in its can still technically
fall under the one kilobytes.
It'll just save the actual data in the NAFTA.
So it won't save it onto the disk section of the volume that we that I showed you earlier in this image.
So the file system data the files system data section here it won't serve it here at all will perform
it right here in the Master File Table.
So again anything left over is unused space it's just it'll be considered used to the file system.
But as far as the NFTE record is concerned it is just empty space.
Next we're going to go over the structure of kind of how Windows has laid out its folder structure but
that's a quick overview on NTFS and how the current file system works.
So if you want again if you want to read more There's links up above the video to a little bit more
detailed readings if you guys want to get into really deep into it.
So let's go ahead and move out to the file system so this is the this is that same machine that we brought
up in previous videos.
So this is local disk c.
So a quick look here at the properties and we see this is an NTFS system.
So what we are just looking at this isn't so with the structure we just we're looking at is what's actually
here.
Right so what we want to do is here is the.
Once you land into your C drive or your root drive you're going to have a few files.
We're going to turn this off so I'll get to that in a second.
So we have perf logs perf logs are for logs for performance for Windows so any performance data that
it has to dump somewhere it's going to dump it here it is a system file you can remove it but it's just
going to get rebuilt right afterwards.
Next is we have two sets of program files.
So when you install an application it's going to end up in here.
It fits a 32 bit application you're going to end up in these x eighty six folder if you're 64 bit application
you're going to end up here.
Then we have the just as a quick example so you can see that Internet Explorer Windows Defender the
power shall some standard stuff is here and for the x six you'll see again the standard variations of
this of the stuff this pre installed.
So under users again we're going to have our users in this particular case we just have administrators
so we can see links to the desktop downloads cetera and you would be able to see this for other users
pending you have at least admin rights on the machine to be able to view it so the next important piece
is this Windows voter.
So this is your system folder.
This is where all the magic happens for Windows.
And it is.
It doesn't look like that big of a folder.
However this is the small version of it.
So common stuff like Notepad and read yet it are happen to be in this particular folder.
But as you can see there are a few things in here such as drivers so anything you install later after
the fact it's gonna come in here than we have.
Let's take a look here.
We got off my web pages any cash or Web pages end up in here though end up as well.
And a few other places but it's just a good way to keep track of it as well so we've got quite a bit
here.
The temp folder is here so when your applications are running or system services are running anything
like that your temp stuff's going to end up landing here.
Now that's one of the most important folders of the windows OS is right here.
System 32 without this folder nothing is going to work.
Windows won't boot nothing.
And this as you can see is is quite a quite a large folder.
So let's take a quick look I'm an only hit a few parts in here.
You can.
You can dig deeper into kind of what some of these folders do.
So we have.
Let's see drivers right here.
This is all the drivers for the Windows operating system all of the services that are pre-built.
Everything is as here.
Everything it uses to interact with hardware etc is all there so it's creep down just a little bit more
so we have tasks.
So for the tasks that you that you build are going to be in here which we showed in previous video since
prep so for a do you a little bit more information about the system and it allows you to prepare the
machine for imaging if you if you need to do that.
So that's also did want to keep in mind if you're a sysadmin so let's take another look here and then
we're gonna start getting into deals which we have another video specifically on them.
But you notice that there's a lot of executable here so a lot of the if not most of the system level
executable that you're gonna be using such as Let's do a quick example for CMT which we're gonna go
over and a little bit you'll see that CMT.
It popped up just for a second there.
So we can see CMT.
EMC is in system 32.
So keep that in mind that's just a sneak peek before we start working on that.
But a lot of.
So for example nets that so commands that you would run as an example which we're going to go over in
the command line many course is so if you needed to view network connections you would open up net stack
from the command line when you run the nets that command.
This is what actually gets ran.
So a lot of the applications that you're going to interface with is gonna be in this folder.
So this wraps up the the general overview of how Windows are structured play around with it get familiar
with it search up different things that you see to try to figure out what they're doing.
That's always the best way to learn is to have an initial bit of information so you know where to broaden
the research at.