File properties / metadata - NTFS and FAT32


Into_Oblivion1

Active member
Member
Local time
11:44 PM
Posts
189
OS
Windows 11
Hello

1.
NTFS
The file properties / metadata, are part of the file?
Is the file properties / metadata stored together with the file / on the same cluster as the file?

2.
FAT32
The file properties / metadata, are part of the file?
Is the file properties / metadata stored together with the file / on the same cluster as the file?

Thank you
 
Windows Build/Version
Windows 11

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Computer type
Laptop
Can anyone help me with this?

Thank you
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Computer type
Laptop
NTFS
The file properties / metadata, are part of the file?
Is the file properties / metadata stored together with the file / on the same cluster as the file?
No. File metadata is stored in the Master File Table, or non-resident clusters tied to the MFT.
No. File clusters only contain file data.

A tiny file (< 900 bytes) might be stored directly inside the MFT as an embedded data object, rather than exist outside as a standalone file cluster. NTFS can save space by not assigning an entire disk block to something that won't fill it. Once the file grows too large, it gets promoted to its own file cluster outside of the MFT. Extent-based filesystems on Linux do a similar trick.

FAT32
The file properties / metadata, are part of the file?
Is the file properties / metadata stored together with the file / on the same cluster as the file?
No. Stored in the FAT32.
No.
 
Last edited:

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Meta data that is stored in the filesystem is one thing and the files internal meta data is another.
Filesystem meta data get lost if copied between two incompatible filesystems as from to NTFS to ext4 and then back to NTFS again.
In a photo where it says model of camera, GPS coordinates etc. is in the file it self and will still be intact.. otherwise cleaning photo meta data would just to copy the file between two incompatible filesystems
 

My Computers My Computers

  • At a glance

    Linux: Debian, Kali-linux, Alma, Win:7,10IoT,...i3, i5 and i7 From 2gen to 9th gen... Server ...
    OS
    Linux: Debian, Kali-linux, Alma, Win:7,10IoT,2012R
    Manufacturer/Model
    HP Elitebook 840, AsusX53, Aspire E1-572. AsusUX32A, HP Pro3130mt+3010mt, HP Proliant ML150, 3xCustom-PC, i3, i5, i7
    CPU
    i3, i5 and i7 From 2gen to 9th gen... Server dual Xenon
    Hard Drives
    Sata, M.2, SAS
  • At a glance

    Retro: 2003server.XPpro, Win2000, Win98SE, Wi...Oldest intel 8088 up to P4 dual core
    Operating System
    Retro: 2003server.XPpro, Win2000, Win98SE, Win95, Win3.11, MS-DOS, IBM-DOS
    Manufacturer/Model
    Commodore, AST, Fujitsu, Compaq, etc etc. etc Around 15 desktops and 20 laptops in the collection
    CPU
    Oldest intel 8088 up to P4 dual core
    Hard Drives
    MFM, IDE, SCSI
.. otherwise cleaning photo meta data would just to copy the file between two incompatible filesystems
ITYM otherwise copying the file between two incompatible filesystems would clean the photo metadata
 

My Computers My Computers

  • At a glance

    W10Ryzen3-2200G16 GB Kingston HyperX DDR4Integrated
    OS
    W10
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home brew
    CPU
    Ryzen3-2200G
    Motherboard
    GA-A320M-S2H
    Memory
    16 GB Kingston HyperX DDR4
    Graphics Card(s)
    Integrated
    Sound Card
    Integrated
    Monitor(s) Displays
    LG W2246
    Screen Resolution
    1920x1080
    Hard Drives
    Intel 760p 256GB NVMe M.2
    Seagate Barracuda 7200 1TB
    Gash Seagate ST31608
    PSU
    2006-vintage no-name
    Case
    Acer Aspire 2006
    Cooling
    Air (fan-assist)
    Keyboard
    HP SK-2885
    Mouse
    wireless
    Internet Speed
    32 mbps
    Browser
    FF latest
    Antivirus
    MS Defender
  • At a glance

    W10Ryzen 5 3500U8 GBon-board
    Operating System
    W10
    Computer type
    Laptop
    Manufacturer/Model
    HP 255 G8
    CPU
    Ryzen 5 3500U
    Memory
    8 GB
    Graphics card(s)
    on-board
    Monitor(s) Displays
    16"
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung SSD 512GB Nvme
    Browser
    FF + Edge
    Antivirus
    MS Defender
otherwise cleaning photo meta data would just to copy the file between two incompatible filesystems

ITYM otherwise copying the file between two incompatible filesystems would clean the photo metadata
Or i could have
otherwise cleaning the photo meta data would just to copy the file between two incompatible filesystems.

But english is only my second language i started to learn 2018.. So... yeah i do mess up now and then on the grammar... Do you? and how long have you known english?
 

My Computers My Computers

  • At a glance

    Linux: Debian, Kali-linux, Alma, Win:7,10IoT,...i3, i5 and i7 From 2gen to 9th gen... Server ...
    OS
    Linux: Debian, Kali-linux, Alma, Win:7,10IoT,2012R
    Manufacturer/Model
    HP Elitebook 840, AsusX53, Aspire E1-572. AsusUX32A, HP Pro3130mt+3010mt, HP Proliant ML150, 3xCustom-PC, i3, i5, i7
    CPU
    i3, i5 and i7 From 2gen to 9th gen... Server dual Xenon
    Hard Drives
    Sata, M.2, SAS
  • At a glance

    Retro: 2003server.XPpro, Win2000, Win98SE, Wi...Oldest intel 8088 up to P4 dual core
    Operating System
    Retro: 2003server.XPpro, Win2000, Win98SE, Win95, Win3.11, MS-DOS, IBM-DOS
    Manufacturer/Model
    Commodore, AST, Fujitsu, Compaq, etc etc. etc Around 15 desktops and 20 laptops in the collection
    CPU
    Oldest intel 8088 up to P4 dual core
    Hard Drives
    MFM, IDE, SCSI
Photo metadata, when created by a device (camera, smartphone, Adobe suite) as the EXIF header, is directly embedded in a photo file. Transferring from different filesystems and platforms wouldn't strip that data.

Windows metadata like "Rate this picture" is stored as NTFS alternative streams, and isn't supported outside of NTFS.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
EDIT: I see that in the meantime, Garlin also referenced the alternate data streams. Man, you can't get anything past him :-)

This is not used extensively, but some things can also get stored in an "alternate data stream". The one thing that I know that does make use of this is the flagging of some files downloaded from the Internet. For example, have you ever looked at the properties of a file and seen a checkbox to unblock the file? That info is stored in an alternate data stream.

I downloaded a .reg file from one of Brink's tutorials. Below are the properties for that file:

Image1.webp

I've used this in the past to store info about some files but this has to be used with caution because it can easily be stripped off.
 

My Computers My Computers

  • At a glance

    Win11 Pro 25H2 (RTM+)Intel i7-14650HX32 GBNo GPU - Built-in Intel Graphics
    OS
    Win11 Pro 25H2 (RTM+)
    Computer type
    PC/Desktop
    Manufacturer/Model
    Acemagic
    CPU
    Intel i7-14650HX
    Memory
    32 GB
    Graphics Card(s)
    No GPU - Built-in Intel Graphics
    Sound Card
    Integrated
    Monitor(s) Displays
    Varies as machine will often be moved to locations with different monitors
    Screen Resolution
    Varies
    Hard Drives
    1 x 1TB Gen 4 NVMe SSD
    PSU
    120W Power Brick
    Keyboard
    Corsair K70 Max RGB Magnetic Keyboard
    Mouse
    Logitech MX Master 3
    Internet Speed
    1Gb Up / 1 Gb Down
    Browser
    Edge
    Antivirus
    Windows Defender
  • At a glance

    Win11 Pro 25H2 (RTM+)Intel i7-1255U16 GBIntel Iris Xe Graphics
    Operating System
    Win11 Pro 25H2 (RTM+)
    Computer type
    Laptop
    Manufacturer/Model
    Lenovo ThinkBook 13x Gen 2
    CPU
    Intel i7-1255U
    Memory
    16 GB
    Graphics card(s)
    Intel Iris Xe Graphics
    Sound Card
    Realtek® ALC3306-CG codec
    Monitor(s) Displays
    13.3-inch IPS Display
    Screen Resolution
    WQXGA (2560 x 1600)
    Hard Drives
    2 TB 4 x 4 NVMe SSD
    PSU
    USB-C / Thunderbolt 4 Power / Charging
    Keyboard
    Backlit, spill resistant keyboard
    Mouse
    Buttonless Glass Precision Touchpad
    Internet Speed
    1Gb Up / 1Gb Down
    Browser
    Edge
    Antivirus
    Windows Defender
    Other Info
    WiFi 6e / Bluetooth 5.1 / Facial Recognition / Fingerprint Sensor / ToF (Time of Flight) Human Presence Sensor
HFS on older Macs supported "resource forks" (same idea), but after they switched to UNIX, per-file metadata is stored in "dot" files. If you've ever extracted an archive file of a photos folder from a Mac, you get a bunch of extra files that look weird on Windows.
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Or i could have
otherwise cleaning the photo meta data would just to copy the file between two incompatible filesystems.

But english is only my second language i started to learn 2018.. So... yeah i do mess up now and then on the grammar... Do you? and how long have you known english?
You could write the words in many different orders, but they won't all mean the same. I am not criticising your english, only making a suggestion for the benefit of others who may not be able to work out what you meant.

Of course I mess up - there are probably typos in this. And all my life.
 

My Computers My Computers

  • At a glance

    W10Ryzen3-2200G16 GB Kingston HyperX DDR4Integrated
    OS
    W10
    Computer type
    PC/Desktop
    Manufacturer/Model
    Home brew
    CPU
    Ryzen3-2200G
    Motherboard
    GA-A320M-S2H
    Memory
    16 GB Kingston HyperX DDR4
    Graphics Card(s)
    Integrated
    Sound Card
    Integrated
    Monitor(s) Displays
    LG W2246
    Screen Resolution
    1920x1080
    Hard Drives
    Intel 760p 256GB NVMe M.2
    Seagate Barracuda 7200 1TB
    Gash Seagate ST31608
    PSU
    2006-vintage no-name
    Case
    Acer Aspire 2006
    Cooling
    Air (fan-assist)
    Keyboard
    HP SK-2885
    Mouse
    wireless
    Internet Speed
    32 mbps
    Browser
    FF latest
    Antivirus
    MS Defender
  • At a glance

    W10Ryzen 5 3500U8 GBon-board
    Operating System
    W10
    Computer type
    Laptop
    Manufacturer/Model
    HP 255 G8
    CPU
    Ryzen 5 3500U
    Memory
    8 GB
    Graphics card(s)
    on-board
    Monitor(s) Displays
    16"
    Screen Resolution
    1920x1080
    Hard Drives
    Samsung SSD 512GB Nvme
    Browser
    FF + Edge
    Antivirus
    MS Defender
You could write the words in many different orders, but they won't all mean the same. I am not criticising your english, only making a suggestion for the benefit of others who may not be able to work out what you meant.

Of course I mess up - there are probably typos in this. And all my life.
i actually dont think anyone can misinterpret the meaning of my mess... Butt feel free to rewrite my hole post to correct US or UK grammar, so the whole post become coherent instead of split posts.
 

My Computers My Computers

  • At a glance

    Linux: Debian, Kali-linux, Alma, Win:7,10IoT,...i3, i5 and i7 From 2gen to 9th gen... Server ...
    OS
    Linux: Debian, Kali-linux, Alma, Win:7,10IoT,2012R
    Manufacturer/Model
    HP Elitebook 840, AsusX53, Aspire E1-572. AsusUX32A, HP Pro3130mt+3010mt, HP Proliant ML150, 3xCustom-PC, i3, i5, i7
    CPU
    i3, i5 and i7 From 2gen to 9th gen... Server dual Xenon
    Hard Drives
    Sata, M.2, SAS
  • At a glance

    Retro: 2003server.XPpro, Win2000, Win98SE, Wi...Oldest intel 8088 up to P4 dual core
    Operating System
    Retro: 2003server.XPpro, Win2000, Win98SE, Win95, Win3.11, MS-DOS, IBM-DOS
    Manufacturer/Model
    Commodore, AST, Fujitsu, Compaq, etc etc. etc Around 15 desktops and 20 laptops in the collection
    CPU
    Oldest intel 8088 up to P4 dual core
    Hard Drives
    MFM, IDE, SCSI
Filesystem meta data get lost if copied between two incompatible filesystems as from to NTFS to ext4 and then back to NTFS again.
I have copied a file from NTFS > FAT32 > NTFS again
And the file retained its original "Modified" timestamp
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Computer type
Laptop
No. File metadata is stored in the Master File Table, or non-resident clusters tied to the MFT.
No. File clusters only contain file data.

No. Stored in the FAT32.
No.
Files copied between the two systems, do they retain their filesystem metadata?
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Computer type
Laptop
Another question:

3.
How many timestamps for each of "Created" "Modifed" "Accessed" does a filesystem store?
Only 1, and it just get overwritten by the filesystem?
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Computer type
Laptop
Files copied between the two systems, do they retain their filesystem metadata?
They retain the basic file metadata which they have in common (timestamps, ownership, permissions, attributes).
 

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Regarding journaling:

NTFS journaling is a feature of the New Technology File System (NTFS) that ensures file system integrity by recording metadata changes in a transaction log before they are actually made.

No, NTFS journaling is not part of the Master File Table (MFT); rather, it is a separate, but related,

So I can conclude, that the NTFS journaling will not follow the file:
If the file is copied on the same drive?
If the file is copied to another drive?

Regarding NTFS MFT entry modified:

An NTFS “MFT Entry Modified” (or $Mft Modified) timestamp changes whenever the actual Master File Table (MFT) record for a file or directory is altered. This happens during operations like creating, deleting, renaming, moving, copying, or making any change to the file’s content or metadata, such as altering its size.

Does NTFS MFT entry modified timestamp follow the file:
If the file is copied on the same drive?
If the file is copied to another drive?
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Computer type
Laptop
Could anyone help me with my remaining questions?

Thank you

Regarding journaling:

NTFS journaling is a feature of the New Technology File System (NTFS) that ensures file system integrity by recording metadata changes in a transaction log before they are actually made.

No, NTFS journaling is not part of the Master File Table (MFT); rather, it is a separate, but related,

So I can conclude, that the NTFS journaling will not follow the file:
If the file is copied on the same drive?
If the file is copied to another drive?

Regarding NTFS MFT entry modified:

An NTFS “MFT Entry Modified” (or $Mft Modified) timestamp changes whenever the actual Master File Table (MFT) record for a file or directory is altered. This happens during operations like creating, deleting, renaming, moving, copying, or making any change to the file’s content or metadata, such as altering its size.

Is there only 1 MFT entry timestamp for a file?

Does NTFS MFT entry modified timestamp follow the file:
If the file is copied on the same drive?
If the file is copied to another drive?
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Computer type
Laptop
Anyone can help me with my remaining questions above?
Or is it too tech savvy / advanced?

Thank you
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Computer type
Laptop

My Computer My Computer

At a glance

Windows 7
OS
Windows 7
Is there a point to the endless round of questions? I suggest you purchase or find a copy of these two books in your local library:


Those are the most technical references you're going to get as an outsider.
Thank you for your input

I had hoped to save some time, and someone knowledgeable on this forum could help me out
 

My Computer My Computer

At a glance

Windows 11
OS
Windows 11
Computer type
Laptop
Back
Top Bottom