
Concealment Techniques 䡲 89
operations such as read, write, and search - and even advanced operations such as fi le-system
recovery—on very large hard disks.
Formatting a volume with the NTFS fi le system results in the creation of several system fi les
and the Master File Table (MFT), which contains information about all the fi les and folders on
the NTFS volume.
e fi rst information on an NTFS volume is the Partition Boot Sector, which starts at
sector 0 and can be up to 16 sectors long. e fi rst fi le on an NTFS volume is the MFT.
e NTFS fi le system has a simple, yet very powerful design. Basically, everything on the
volume is a fi le