nt-part2_18
Analysis of the Security of Windows NT
1 March 1999
18
written to the disk, the disk arm must be constantly moved between the location of the
directory and the location of the data.
One problem is external fragmentation [2]. Internal fragmentation is another problem
when using large partition, e.g. greater then 32 MB. In its design FAT supports a max-
imum of 65536 allocation units, which implies that when large partitions are used, the
size of the allocation unit is bigger then it is when small partitions are used. For exam-
ple, a 1 GB partition has 16 kbyte units.
The classical FAT directory structure limits file names to eight characters plus a three
character extension. Other attributes that are maintained for each file are a number of
flags that indicate if the file is hidden, read-only, a system file, or should be archived
the next time the disk is backed up. Finally, there is a date and time stamp when the file
was last changed.
3.7.2 High Performance File System (HPFS)
HPFS is designed by Microsoft for OS/2 1.2, mostly to support the LAN Manager file
server. It was constructed with performance in mind, while FAT was design to be reli-
able. In HPFS, better performance is obtained due to a shorter physical distance
between the location of the directory and the location of the data, and frequent caching
of data in the memory. The tables that describe the location of files are positioned at
regular intervals throughout the dataset. When new datasets are added, they are written
to areas where there is a large amount of free space. This reduces both fragmentation
and disk arm movement. In addition, HPFS maintains a 512 byte allocation unit no
matter how large the partition becomes. HPFS requires a large amount of data in mem-
ory. This gives the advantage of high performance, but the system is more sensitive to
a system crash. After a system crash, all the partitions that were in use during the crash
are marked dirty, and before such a partition can be used again, the CHKDSK utility
program must be run. As partitions get larger, the recovery process time increases.
HPFS is not recommended on small systems (say with 4-8 MB of RAM) due to the
extra memory required for the disk cache.
Another advantage with HPFS compared to FAT, is that HPFS allows filenames to be
long, to contain several dots, and lowercase letters. Filenames are extended to up to
254 double byte characters.
3.7.3 NT File System (NTFS)
NTFS is a completely new file system for NT. NTFS is designed to be all things to all
people and to include all features of every other file system in common use. It includes
features not found in other file systems supported by NT, and is designed to be a reli-
able and efficient system on large partitions (up to 264 bytes). One of its strengths is
that it supports long file names, another is the ability to extend a disk volume after it is
formatted, and a third that it also offers many security features, which are unavailable
in both the FAT and HPFS file systems. NTFS uses security attributes (SIDs) available
at logon time to allow or disallow access to files and directories, see section 5.
A number of permissions are used to control access to file system objects, i.e. files and
directories. These are very similar to UNIX permissions, and consist of: Read (R),