19. NTFS system files

•  MFT Sys File
   Rec Name       Description
   --- ---------- ---------------------------------------------------------------------------
    0  $MFT.......MFT 1: file records on NTFS volume - an indef of every file.
    1  $MftMirr...MFT 2: a backup of first 4 records of $MFT for recovery purposes.
    2  $LogFile...Log File: the transaction log of recent file transactions for recovery purposes.
    3  $Volume....Volume: volume information table - serial number, creation time, dirty flag.
    4  $AttrDef...Attribute definitions: list of file attribute definitions.
    5  "." .......Root folder: volume root folder (named ".")
    6  $Bitmap....Bitmap: maps the availability (free/in-use) of the volume clusters.
    7  $Boot......VBR, the Boot sector: used to mount the NTFS volume during the bootstrap process.
    8  $BadClus...Bad cluster file: map of clusters with unrecoverable I/O errors.
    9  $Secure....On Windows 2000 - Security file: the access control list with unique security descriptors for files.
    9  $Quota.....Quota Information - the amount of space allowed for each user
   10  $UpCase....Upcase table: table to convert uppercase characters to lowercase Unicode characters for collating.
   11  $Extend....On Windows 2000 - NTFS extension file: Optional extensions like quotes and object identifiers.
   12-15..........Unused, but marked "in use"
   16-23..........Unused, but marked "unused"
   Any.$Reparse...Reparse point information
   Any.$UsnJrnl...Journaling of Encryption
   s
  

  NOTE: the record number of the MFT entry is often called the inode.