NTFS vs FAT

Criteria

NTFS5

NTFS

FAT32 DOS v7 and higher Windows 98 Windows ! Windows 2000 Windows XP

FAT16

FAT12

Operting System

Windows 2000 Windows XP Windows 2003 Server

Windows NT Windows 2000 Windows XP Windows 2003 Server

DOS "## versions o$ i%roso$t Windows

DOS "## versions o$ i%roso$t Windows

Limitations 32+* $or a## OS, 2T* $or some OS 2+* $or a## OS, -+* $or some OS

a& 'o#(me Si)e

2T*

2T*

./ *

a& 0i#es on 'o#(me

Near#y 1n#imited

Near#y 1n#imite d

-.9-30-

/223/

a& 0i#e Si)e

3imit On#y 4y 'o#(me Si)e

3imit On#y 4y 'o#(me Si)e

-+* min(s 2 *ytes

2+* 53imit On#y 4y 'o#(me Si)e6

./ * 53imit On#y 4y 'o#(me Si)e6

a& 7#(sters N(m4er

Near#y 1n#imited

Near#y 1n#imite d

-.779.8

/2220

-080

a& 0i#e Name 3ength

1p to 222

1p to 222

1p to 222

Standard 8 8,3 !&tended 8 (p to 222

1p to 22-

File System Features 1ni%ode 0i#e Names 1ni%ode 7hara%ter Set 1ni%ode 7hara%te r Set 0T irror 0i#e System 7hara%te r Set Se%ond 7opy o$ 0"T 0irst Se%tor and 7opy in Se%tor :/ Standard Set System 7hara%ter Set Se%ond 7opy o$ 0"T System 7hara%te r Set Se%ond 7opy o$ 0"T

System 9e%ords irror

0T

irror 0i#e

*oot Se%tor 3o%ation

0irst and 3ast Se%tors

0irst and 3ast Se%tors

0irst Se%tor

0irst Se%tor

0i#e "ttri4(tes

Standard and 7(stom

Standard and 7(stom ;es ;es No ;es No No No No

Standard Set

Standard Set

"#ternate Streams 7ompression !n%ryption O4<e%t Permissions Dis= >(otas Sparse 0i#es 9eparse Points 'o#(me Points o(nt

;es ;es ;es ;es ;es ;es ;es ;es

No No No No No No No No

No No No No No No No No

No No No No No No No No

Overall Performance *(i#t8?n Se%(rity ;es ;es No No No

9e%overa4i#ity

;es

;es 3ow on sma## vo#(mes @igh on 3arge

No @igh on sma## vo#(mes 3ow on #arge

No @ighest on sma## vo#(mes 3ow on #arge inima# on #arge vo#(mes "verage

No

Per$orman%e

3ow on sma## vo#(mes @igh on 3arge

@igh

Dis= Spa%e !%onomy 0a(#t To#eran%e

a&

a&

"verage

a&

a&

a&

inima#

"verage

NTFS File Types

0i#e "ttri4(tes System 0i#es (#tip#e Data Streams 7ompressed 0i#es !n%rypted 0i#es 1sing !0S !0S ?nterna#s A!0S "ttri4(te ?ss(es with !0S o NT0S Sparse 0i#es

o o o o o

NT0S NT0S NT0S NT0S NT0S

NTFS File Attributes

The NT0S $i#e system views ea%h $i#e 5or $o#der6 as a set o$ $i#e attri4(tes, !#ements s(%h as the $i#eBs nameC its se%(rity in$ormationC and even its dataC are a## $i#e attri4(tes, !a%h attri4(te is identi$ied 4y an attri4(te type %ode andC optiona##yC an attri4(te name, When a $i#eBs attri4(tes %an $it within the 0T $i#e re%ordC they are %a##ed resident attri4(tes, 0or e&amp#eC in$ormation s(%h as $i#ename and time stamp are a#ways in%#(ded in the 0T $i#e re%ord, When a## o$ the in$ormation $or a $i#e is too #arge to $it in the 0T $i#e re%ordC some o$ its attri4(tes are nonresident, The nonresident attri4(tes are a##o%ated one or more %#(sters o$ dis= spa%e e#sewhere in the vo#(me, NT0S %reates the "ttri4(te 3ist attri4(te to des%ri4e the #o%ation o$ a## o$ the attri4(te re%ords, Ta4#e 283 #ists a## o$ the $i#e attri4(tes %(rrent#y de$ined 4y the NT0S $i#e system, This #ist is e&tensi4#eC meaning that other $i#e attri4(tes %an 4e de$ined in the $(t(re,

Ta le 5!3 0i#e "ttri4(tes De$ined 4y NT0S

Attri ute Type Standard ?n$ormation "ttri4(te 3ist

"escription ?n%#(des in$ormation s(%h as timestamp and #in= %o(nt,

3ists the #o%ation o$ a## attri4(te re%ords that do not $it in the re%ord,

0T

0i#e Name

" repeata4#e attri4(te $or 4oth #ong and short $i#e names, The #ong name o$ the $i#e %an 4e (p to 222 1ni%ode %hara%ters, The short name is the 8,3C %ase8insensitive name $or the $i#e, "dditiona# namesC or hard #in=sC reD(ired 4y POS?X %an 4e in%#(ded as additiona# $i#e name attri4(tes, Des%ri4es who owns the $i#e and who %an a%%ess it,

Se%(rity Des%riptor Data

7ontains $i#e data, NT0S a##ows m(#tip#e data attri4(tes per $i#e, !a%h $i#e typi%a##y has one (nnamed data attri4(te, " $i#e %an a#so have one or more named data attri4(tesC ea%h (sing a parti%(#ar synta&, " vo#(me8(niD(e $i#e identi$ier, 1sed 4y the distri4(ted #in= tra%=ing servi%e, Not a## $i#es have o4<e%t identi$iers, Simi#ar to a data streamC 4(t operations are #ogged to the NT0S #og $i#e <(st #i=e NT0S metadata %hanges, This is (sed 4y !0S, 1sed $or vo#(me mo(nt points, They are a#so (sed 4y ?nsta##a4#e 0i#e System 5?0S6 $i#ter drivers to mar= %ertain $i#es as spe%ia# to that driver, 1sed to imp#ement $o#ders and other inde&es, 1sed to imp#ement $o#ders and other inde&es,

O4<e%t ?D

3ogged Too# Stream 9eparse Point

?nde& 9oot ?nde& "##o%ation *itmap 'o#(me ?n$ormation 'o#(me Name

1sed to imp#ement $o#ders and other inde&es, 1sed on#y in the A'o#(me system $i#e, 7ontains the vo#(me version,

1sed on#y in the A'o#(me system $i#e, 7ontains the vo#(me #a4e#,

Active "ata #ecovery Soft$are

Active@ NTFS Reader for DOS 1ser +(ide

'ersion .,0

Contents
P#O"%CT O&'#&(') S*ST'+ #',%(#'+'NTS P#O"%CT F'AT%#'S OP'#AT(N- P#OC'"%#'S
4.1 Bootable Floppy Disk (Startup Disk) Preparation..............................................................................4 4.2 Program Start and Information Display............................................................................................... 4.!. S"an and Sear"# for Files and Folders.................................................................................................. 4.4. Pre$ie%ing Files ............................................................................................................................... .......& 4. . 'opying Files and Folders......................................................................................................................( 4.&. )sing Disk *ie%er ............................................................................................................................ .....+ 4.(. ,o"ali-ed File .ames Display ...............................................................................................................+ 4.+. ,ong File .ames Display......................................................................................................................./ 4./. 'ommand ,ine Parameters ................................................................................................................... /

1 P#O"%CT O&'#&(')
0"ti$e1 .2FS 3eader is a "ompa"t and po%erful D4S utility t#at "an read .2FS $olumes from a D4S en$ironment and "opy files and folders to dri$es #a$ing a F02 file system.

2 S*ST'+ #',%(#'+'NTS
5inimum system re6uirements for 0"ti$e1 .2FS 3eader7 02 "ompatible 'P) %it# 2+& or ne%er pro"essor &489b of 305 1.44 5b floppy diskette dri$e :;0 &48<4+8 or better s"reen resolution Bootable Floppy disk "ontaining 5S=D4S &.8>? or startup disk for @indo%s / A/+A5:ABP ID:A020AS'SI #ard dri$e atta"#ed to t#e system to be re"o$ered

3 P#O"%CT F'AT%#'S
2#e list belo% displays t#e features of 0"ti$e1 .2FS 3eader for D4S7 )tility "an be sa$ed to and run from a bootable !. C floppy Displays "omplete p#ysi"al and logi"al dri$e information Supports ID: A 020 A S'SI #ard dri$es Supports large si-ed #ard dri$es (more t#an +;B) 3eads .2FS? .2FS file systems @rites to F0212? F021&? F02!2 file systems Supports "ompressed and fragmented files on .2FS Supports partitions "reated in 5S=D4S? @indo%s / A/+A5:A.2A2888ABP Displays non=englis# (lo"al language fonts) and long file names 0bility to pre$ie% files and folders before "opying Supports sear"# by file name or partial file name Disk *ie%er displays "ontent of t#e file in De<A2e<t mode

4 OP'#AT(NP#OC'"%#'S
./1 0oota le Floppy"is1 2Startup "is13Preparation Ideally? "reate a bootable floppy disk before you en"ounter any problems %it# an .2FS dri$e. 4n"e you #a$e a bootable floppy? "opy or do%nload t#e utility to t#e floppy disk. If you do not #a$e a bootable floppy disk? you "an make one from 5S=D4S? @indo%s / A/+A5:ABP follo%ing t#ese steps7 MS DOS Prompt Boot t#e system in 5S=D4S or 'ommand Prompt mode. Insert a blank floppy and type t#e format "ommand in t#e follo%ing synta<7
FORMAT A: /S

Follo% instru"tions on t#e s"reen to "omplete t#e pro"ess. !NDO S "#$"%$M& 4pen t#e @indo%s E'ontrol PanelE. 'li"k E0ddA3emo$e ProgramsE. 'li"k t#e EStartup DiskE tab. 'li"k EStartup DiskE and follo% s"reen instru"tions to "omplete t#e pro"ess. !NDO S 'P Boot t#e system in @indo%s BP.

Insert a blank floppy in t#e floppy dri$e. 4pen @indo%s :<plorer and rig#t="li"k F07C dri$e. 'li"k EFormatE. :nable t#e E'reate an 5S=D4S startup diskE option. 'li"k EStartE to "omplete t#e pro"ess.

./2 Pro4ram Start an5 (nformation "isplay 0fter en"ountering a problem %it# an .2FS dri$e? retrie$e your bootable floppy and boot start t#e ma"#ine from t#at floppy. Start in D4S mode? or in 'ommand Prompt mode in @indo%s / A/+. Follo% t#e steps belo%7 Start 0"ti$e1 .2FS 3eader for D4S in dri$e 07 by typing7
A:\>READNTFS.EXE

2#e .2FS 3eader program s"reen appears. 4n t#e left side of t#e %indo% you %ill see t#e list of dete"ted Dard Disk Dri$es (DDD). DDD Partitions and ,ogi"al Dri$es are displayed in a tree format. Deleted partitions and DDD spa"e not o""upied by partitions %ill be displayed as E)nallo"ated spa"eE. Sele"t dri$es or folders by using keyboard arro% keys to mo$e t#e "ursor o$er listed DDD and logi"al dri$es. @#en t#e "ursor is on a parti"ular dri$e or folder? t#at dri$e or folder is "onsidered to be sele"ted. 2#e sele"ted dri$e or folder information is displayed in t#e rig#t pane. ./3/ Scan an5 Searc6 for Files an5 Fol5ers S"an dri$es and folders to lo"ate deleted files. If you kno% t#e e<a"t lo"ation of t#e deleted file or folder? you "an sele"t t#at lo"ation rig#t a%ay. )se t#e met#ods belo% to s"an for deleted files or folders7 Sele"t a dri$e or a folder and press t#e G:nterH key. 3epeat s"anning until you rea"# t#e folder %#ere t#e deleted file or folder is lo"atedDeleted files are marked %it# a solid mark on t#e left side. .2FS 3eader %ill lo"ate deletedfiles and folders and does not allo% you to pre$ie% or "opy deleted files.Sear"# dri$es and folders if you do not kno% t#e e<a"t lo"ation of deleted files. )se t#esear"# met#ods belo%7 Sele"t a dri$e "ontaining files and press G'trl>FH on t#e keyboard. Sear"#ing %ill begin. If you kno% t#e e<a"t filename or part of t#e filename? enter t#is data in t#e ESear"# Dialogue typeE and press t#e G:nterH key. Sear"#ing %ill begin. Iou "an stop t#e sear"# pro"ess at any time by pressing t#e G:s"H key. If files mat"#ing t#e sear"# pattern are found? t#e file information is displayed. If displayed file information does not list deleted files t#at you are looking for? press t#e G'trl>FH keys to "ontinue sear"#ing. If displayed file information lists deleted files t#at you are looking for? press t#e G:nterH key to stop sear"#ing and go dire"tly to t#e folder %#ere t#e file %as lo"ated or press t#e G:s"H key to "an"el furt#er sear"#.

2#e asterisk symbol (J) is used as a %ild "ard "#ara"ter. )sed during t#e sear"# pro"ess? asterisk is repla"ed by any allo%ed possible "#ara"ters a$ailable on t#e system for sear"# purposes. 2#e 6uestion mark (K) symbol is used for single %ild "ard "#ara"ter and is repla"ed by any allo%ed possible "#ara"ter a$ailable on t#e system for sear"# purpose.
6 7@"PT!9 -E OP!9"T?N+ P9O7!D19!S

)se a sear"# pattern to find deleted files and folders similar to t#e pattern t#at is used %#en performing a sear"# in D4S or @indo%s. The table below shoes examples of pa t!al "ame sea #h exp ess!o"s:
Ta()e 4*1 $a t!al Name Sea #h Exp ess!o"s

././ Previe$in4 Files 4n"e deleted files #a$e been found? pre$ie% t#e file "ontents using Dist *ie%er. Follo% t#e steps belo%7 Boot in D4S mode and run 0"ti$e1 .2FS 3eader for D4S. S"an or sear"# for files or folders (see se"tion 4.!). Sele"t a found file or folder. Press t#e G:nterH key to pre$ie% t#e file in Disk *ie%er. 4n"e Disk *ie%er #as started? you "an s%it"# bet%een 2e<t and De< $ie%s by pressing t#e G20BH key.
+aria()es Description % All f!les %.txt All f!les w!th the exte"s!o" &TXT' m(%.% All f!les that sta t w!th the #ha a#te s &m(' m(f!le.txt Sea #h expl!#!tel( fo the f!le &m(f!le.txt' ,

./5/ Copyin4 Filesan5 Fol5ers 'opy files or folders from .2FS to F02 partiton in order to re"o$ery t#em. Follo% t#e steps belo%7 Boot in D4S mode and run 0"ti$e1 .2FS 3eader for D4S. S"an or sear"# for files or folders (see se"tion 4.!). Sele"t a found file or folder. (4ptionally) pre$ie% t#e file using Disk *ie%er (see se"tion4.4) Press t#e G'trl > 'H keys toget#er to e<e"ute t#e "opy "ommand Note: The number and drive letters in this dialog box may not match with what was displayed in the previous window. This happens because the write operation is performed in DOS real mode and only the F T drives are visible to the operating system as the output location. )se t#e G2abH key to mo$e bet%een "ontrols? and press t#e G:nterH key to "#ange t#e dri$e or folder. Define t#e output name and lo"ation and press t#e G:nterH key to start t#e "opying pro"ess. Iou "an stop t#e "opying pro"ess at any time by pressing G:s"H. If you "opy a folder? all files and sub=folders lo"ated in t#e folder tree %ill be "opied to t#e ne% lo"ation re"ursi$ely.
7 7@"PT!9 -E OP!9"T?N+ P9O7!D19!S

./6/ %sin4 "is1 &ie$er Disk *ie%er allo%s $ie%ing t#e "ontents of a file and a""esses any se"tor "omposing t#e file being $ie%ed. 3un 0"ti$e1 .2FS 3eader for D4S. Sele"t t#e obLe"t file to $ie% its se"tors. Press t#e G:nterH key to open Disk *ie%er. In t#e Disk *ie%er s"reen? t#e 2itle displays t#e name of t#e obLe"t to be $ie%ed and t#e "urrent se"tor number %ill be s#o%n belo%. 2#e rest of t#e area displays se"tor "ontents in De< $ie% on t#e left side and 2e<t *ie% on t#e rig#t side. )se arro%s? GDomeH and G:ndH keys to s"roll t#e $ie%. )se GPage Do%nH and GPage )pH keys to go to t#e ne<t or pre$ious se"tor. Press G'trl > ;H toget#er to go a parti"ular se"tor. Press G2abH to s%it"# from De<=and=2e<t $ie% to 2e<t=4nly and ba"k. ./8/ Locali9e5 File Names "isplay ,o"ali-ed file names are stored on t#e dri$e in )ni"ode format. 2#e 4perating System (@indo%s / A/+A5:A.2A2888ABP) "reates filenames based on regional settings. @indo%s #as set of language=spe"ifi" fonts to #andle and display filenames properly. 5S D4S mig#t #a$e lo"al fonts supported but it "annot display filenames in )ni"ode. 0"ti$e1 .2FS 3eader "an display lo"ali-ed filenames in D4S only if a proper font definition file for t#e lo"al settings is a$ailable. 2o prepare t#is file %it# font definitions follo% t#ese steps7 From t#e .2FS @eb site? do%nload ).I'4D:.:B: and sa$e it to t#e same pla"e %#ere 3:0D.2FS.:B: is lo"ated. Boot t#e system in @indo%s / A/+A5:A.2A2888ABP %it# t#e "orre"t lo"ale settings and run ).I'4D:.:B:. 0 file named ).I'4D:.D02 (& ? !& bytes) s#ould be "reated in t#e same folder as ).I'4D:.:B:. 3eboot t#e system in D4S mode and run 0"ti$e1 .2FS 3eader for D4S. S"an your dri$e and s%it"# to E,ong file namesE mode by pressing t#e G2abH key If t#is pro"ess is "ompleted su""essfully? you s#ould be able to read lo"ali-ed file names. Note: To be able to see locali!ed filenames you must have support for the local fonts when booted in DOS mode. "n other words# display driver for the proper code page must be loaded.
"

./7/ Lon4 File Names "isplay Sin"e t#e laun"# of @indo%s / ? P' filenames #a$e not been limited to t#e original +.! pattern and "an #a$e a lengt# of up to 2 "#ara"ters. Standard *ie% mode displays all files and folders t#e same %ay as D4S does? i.e. in +.! format. Do%e$er sometimes it is not "on$enient to see only first fe% symbols of files %it# longer names.

To )!spla( lo"* f!le"ames +,p to -. s(mbols/ follow these steps: Boot in D4S mode and run 0"ti$e1 .2FS 3eader. S"an t#e parti"ular dri$e by pressing t#e G:nterH key. Press t#e G2abH key to s%it"# to long filenames $ie%. ./:/ Comman5 Line Parameters 0"ti$e1 .2FS 3eader for D4S supports a set of "ommand line parameters. 2o $ie% t#em and t#eir definitions? type7
A:\>READNTFS.EXE 01

Belo% is a list of "ommand line parameters a$ailable7

Ta()e 4*2 $a amete s fo 2omma") 3!"e
Parameter Description 0lba Fo #e 34A mo)e fo a##ess to all )ete#te) ha ) ) !5es 0lba6N Fo #e 34A mo)e fo a##ess to a" !")!#ate) ha ) ) !5e whe e N6789h:8;h:8<h:8-h==

What is data recovery? Data recovery is the process of retrieving deleted or inaccessible data from failed electronic storage media such as computer hard disk drives, removable media, optical devices and tape cartridges. Your data can become inaccessible due to a software problem, computer virus, mechanical or electrical malfunction or a deliberate human act. Regardless of the cause of your data loss, our experienced technicians are able to successfully recover lost data 80 ! 8" of the time