1 The Linux NTFS filesystem driver
2 ================================
11 - Supported mount options
12 - Known bugs and (mis-)features
13 - Using NTFS volume and stripe sets
14 - The Device-Mapper driver
15 - The Software RAID / MD driver
16 - Limitiations when using the MD driver
23 Linux-NTFS comes with a number of user-space programs known as ntfsprogs.
24 These include mkntfs, a full-featured ntfs filesystem format utility,
25 ntfsundelete used for recovering files that were unintentionally deleted
26 from an NTFS volume and ntfsresize which is used to resize an NTFS partition.
27 See the web site for more information.
29 To mount an NTFS 1.2/3.x (Windows NT4/2000/XP/2003) volume, use the file
30 system type 'ntfs'. The driver currently supports read-only mode (with no
31 fault-tolerance, encryption or journalling) and very limited, but safe, write
34 For fault tolerance and raid support (i.e. volume and stripe sets), you can
35 use the kernel's Software RAID / MD driver. See section "Using Software RAID
36 with NTFS" for details.
42 There is plenty of additional information on the linux-ntfs web site
43 at http://linux-ntfs.sourceforge.net/
45 The web site has a lot of additional information, such as a comprehensive
46 FAQ, documentation on the NTFS on-disk format, informaiton on the Linux-NTFS
47 userspace utilities, etc.
53 - This is a complete rewrite of the NTFS driver that used to be in the kernel.
54 This new driver implements NTFS read support and is functionally equivalent
55 to the old ntfs driver.
56 - The new driver has full support for sparse files on NTFS 3.x volumes which
57 the old driver isn't happy with.
58 - The new driver supports execution of binaries due to mmap() now being
60 - The new driver supports loopback mounting of files on NTFS which is used by
61 some Linux distributions to enable the user to run Linux from an NTFS
62 partition by creating a large file while in Windows and then loopback
63 mounting the file while in Linux and creating a Linux filesystem on it that
64 is used to install Linux on it.
65 - A comparison of the two drivers using:
66 time find . -type f -exec md5sum "{}" \;
67 run three times in sequence with each driver (after a reboot) on a 1.4GiB
68 NTFS partition, showed the new driver to be 20% faster in total time elapsed
69 (from 9:43 minutes on average down to 7:53). The time spent in user space
70 was unchanged but the time spent in the kernel was decreased by a factor of
71 2.5 (from 85 CPU seconds down to 33).
72 - The driver does not support short file names in general. For backwards
73 compatibility, we implement access to files using their short file names if
74 they exist. The driver will not create short file names however, and a
75 rename will discard any existing short file name.
76 - The new driver supports exporting of mounted NTFS volumes via NFS.
77 - The new driver supports async io (aio).
78 - The new driver supports fsync(2), fdatasync(2), and msync(2).
79 - The new driver supports readv(2) and writev(2).
80 - The new driver supports access time updates (including mtime and ctime).
83 Supported mount options
84 =======================
86 In addition to the generic mount options described by the manual page for the
87 mount command (man 8 mount, also see man 5 fstab), the NTFS driver supports the
88 following mount options:
90 iocharset=name Deprecated option. Still supported but please use
91 nls=name in the future. See description for nls=name.
93 nls=name Character set to use when returning file names.
94 Unlike VFAT, NTFS suppresses names that contain
95 unconvertible characters. Note that most character
96 sets contain insufficient characters to represent all
97 possible Unicode characters that can exist on NTFS.
98 To be sure you are not missing any files, you are
99 advised to use nls=utf8 which is capable of
100 representing all Unicode characters.
102 utf8=<bool> Option no longer supported. Currently mapped to
103 nls=utf8 but please use nls=utf8 in the future and
104 make sure utf8 is compiled either as module or into
105 the kernel. See description for nls=name.
109 umask= Provide default owner, group, and access mode mask.
110 These options work as documented in mount(8). By
111 default, the files/directories are owned by root and
112 he/she has read and write permissions, as well as
113 browse permission for directories. No one else has any
114 access permissions. I.e. the mode on all files is by
115 default rw------- and for directories rwx------, a
116 consequence of the default fmask=0177 and dmask=0077.
117 Using a umask of zero will grant all permissions to
118 everyone, i.e. all files and directories will have mode
122 dmask= Instead of specifying umask which applies both to
123 files and directories, fmask applies only to files and
124 dmask only to directories.
126 sloppy=<BOOL> If sloppy is specified, ignore unknown mount options.
127 Otherwise the default behaviour is to abort mount if
128 any unknown options are found.
130 show_sys_files=<BOOL> If show_sys_files is specified, show the system files
131 in directory listings. Otherwise the default behaviour
132 is to hide the system files.
133 Note that even when show_sys_files is specified, "$MFT"
134 will not be visible due to bugs/mis-features in glibc.
135 Further, note that irrespective of show_sys_files, all
136 files are accessible by name, i.e. you can always do
137 "ls -l \$UpCase" for example to specifically show the
138 system file containing the Unicode upcase table.
140 case_sensitive=<BOOL> If case_sensitive is specified, treat all file names as
141 case sensitive and create file names in the POSIX
142 namespace. Otherwise the default behaviour is to treat
143 file names as case insensitive and to create file names
144 in the WIN32/LONG name space. Note, the Linux NTFS
145 driver will never create short file names and will
146 remove them on rename/delete of the corresponding long
148 Note that files remain accessible via their short file
149 name, if it exists. If case_sensitive, you will need
150 to provide the correct case of the short file name.
152 disable_sparse=<BOOL> If disable_sparse is specified, creation of sparse
153 regions, i.e. holes, inside files is disabled for the
154 volume (for the duration of this mount only). By
155 default, creation of sparse regions is enabled, which
156 is consistent with the behaviour of traditional Unix
159 errors=opt What to do when critical filesystem errors are found.
160 Following values can be used for "opt":
161 continue: DEFAULT, try to clean-up as much as
162 possible, e.g. marking a corrupt inode as
163 bad so it is no longer accessed, and then
165 recover: At present only supported is recovery of
166 the boot sector from the backup copy.
167 If read-only mount, the recovery is done
168 in memory only and not written to disk.
169 Note that the options are additive, i.e. specifying:
170 errors=continue,errors=recover
171 means the driver will attempt to recover and if that
172 fails it will clean-up as much as possible and
175 mft_zone_multiplier= Set the MFT zone multiplier for the volume (this
176 setting is not persistent across mounts and can be
177 changed from mount to mount but cannot be changed on
178 remount). Values of 1 to 4 are allowed, 1 being the
179 default. The MFT zone multiplier determines how much
180 space is reserved for the MFT on the volume. If all
181 other space is used up, then the MFT zone will be
182 shrunk dynamically, so this has no impact on the
183 amount of free space. However, it can have an impact
184 on performance by affecting fragmentation of the MFT.
185 In general use the default. If you have a lot of small
186 files then use a higher value. The values have the
188 Value MFT zone size (% of volume size)
193 Note this option is irrelevant for read-only mounts.
196 Known bugs and (mis-)features
197 =============================
199 - The link count on each directory inode entry is set to 1, due to Linux not
200 supporting directory hard links. This may well confuse some user space
201 applications, since the directory names will have the same inode numbers.
202 This also speeds up ntfs_read_inode() immensely. And we haven't found any
203 problems with this approach so far. If you find a problem with this, please
207 Please send bug reports/comments/feedback/abuse to the Linux-NTFS development
208 list at sourceforge: linux-ntfs-dev@lists.sourceforge.net
211 Using NTFS volume and stripe sets
212 =================================
214 For support of volume and stripe sets, you can either use the kernel's
215 Device-Mapper driver or the kernel's Software RAID / MD driver. The former is
216 the recommended one to use for linear raid. But the latter is required for
217 raid level 5. For striping and mirroring, either driver should work fine.
220 The Device-Mapper driver
221 ------------------------
223 You will need to create a table of the components of the volume/stripe set and
224 how they fit together and load this into the kernel using the dmsetup utility
227 Linear volume sets, i.e. linear raid, has been tested and works fine. Even
228 though untested, there is no reason why stripe sets, i.e. raid level 0, and
229 mirrors, i.e. raid level 1 should not work, too. Stripes with parity, i.e.
230 raid level 5, unfortunately cannot work yet because the current version of the
231 Device-Mapper driver does not support raid level 5. You may be able to use the
232 Software RAID / MD driver for raid level 5, see the next section for details.
234 To create the table describing your volume you will need to know each of its
235 components and their sizes in sectors, i.e. multiples of 512-byte blocks.
237 For NT4 fault tolerant volumes you can obtain the sizes using fdisk. So for
238 example if one of your partitions is /dev/hda2 you would do:
242 Disk /dev/hda: 81.9 GB, 81964302336 bytes
243 255 heads, 63 sectors/track, 9964 cylinders, total 160086528 sectors
244 Units = sectors of 1 * 512 = 512 bytes
246 Device Boot Start End Blocks Id System
247 /dev/hda1 * 63 4209029 2104483+ 83 Linux
248 /dev/hda2 4209030 37768814 16779892+ 86 NTFS
249 /dev/hda3 37768815 46170809 4200997+ 83 Linux
251 And you would know that /dev/hda2 has a size of 37768814 - 4209030 + 1 =
254 For Win2k and later dynamic disks, you can for example use the ldminfo utility
255 which is part of the Linux LDM tools (the latest version at the time of
256 writing is linux-ldm-0.0.8.tar.bz2). You can download it from:
257 http://linux-ntfs.sourceforge.net/downloads.html
258 Simply extract the downloaded archive (tar xvjf linux-ldm-0.0.8.tar.bz2), go
259 into it (cd linux-ldm-0.0.8) and change to the test directory (cd test). You
260 will find the precompiled (i386) ldminfo utility there. NOTE: You will not be
261 able to compile this yourself easily so use the binary version!
263 Then you would use ldminfo in dump mode to obtain the necessary information:
265 $ ./ldminfo --dump /dev/hda
267 This would dump the LDM database found on /dev/hda which describes all of your
268 dynamic disks and all the volumes on them. At the bottom you will see the
269 VOLUME DEFINITIONS section which is all you really need. You may need to look
270 further above to determine which of the disks in the volume definitions is
271 which device in Linux. Hint: Run ldminfo on each of your dynamic disks and
272 look at the Disk Id close to the top of the output for each (the PRIVATE HEADER
273 section). You can then find these Disk Ids in the VBLK DATABASE section in the
274 <Disk> components where you will get the LDM Name for the disk that is found in
275 the VOLUME DEFINITIONS section.
277 Note you will also need to enable the LDM driver in the Linux kernel. If your
278 distribution did not enable it, you will need to recompile the kernel with it
279 enabled. This will create the LDM partitions on each device at boot time. You
280 would then use those devices (for /dev/hda they would be /dev/hda1, 2, 3, etc)
281 in the Device-Mapper table.
283 You can also bypass using the LDM driver by using the main device (e.g.
284 /dev/hda) and then using the offsets of the LDM partitions into this device as
285 the "Start sector of device" when creating the table. Once again ldminfo would
286 give you the correct information to do this.
288 Assuming you know all your devices and their sizes things are easy.
290 For a linear raid the table would look like this (note all values are in
294 # Offset into Size of this Raid type Device Start sector
295 # volume device of device
296 0 1028161 linear /dev/hda1 0
297 1028161 3903762 linear /dev/hdb2 0
298 4931923 2103211 linear /dev/hdc1 0
301 For a striped volume, i.e. raid level 0, you will need to know the chunk size
302 you used when creating the volume. Windows uses 64kiB as the default, so it
303 will probably be this unless you changes the defaults when creating the array.
305 For a raid level 0 the table would look like this (note all values are in
309 # Offset Size Raid Number Chunk 1st Start 2nd Start
310 # into of the type of size Device in Device in
311 # volume volume stripes device device
312 0 2056320 striped 2 128 /dev/hda1 0 /dev/hdb1 0
315 If there are more than two devices, just add each of them to the end of the
318 Finally, for a mirrored volume, i.e. raid level 1, the table would look like
319 this (note all values are in 512-byte sectors):
322 # Ofs Size Raid Log Number Region Should Number Source Start Taget Start
323 # in of the type type of log size sync? of Device in Device in
324 # vol volume params mirrors Device Device
325 0 2056320 mirror core 2 16 nosync 2 /dev/hda1 0 /dev/hdb1 0
328 If you are mirroring to multiple devices you can specify further targets at the
331 Note the "Should sync?" parameter "nosync" means that the two mirrors are
332 already in sync which will be the case on a clean shutdown of Windows. If the
333 mirrors are not clean, you can specify the "sync" option instead of "nosync"
334 and the Device-Mapper driver will then copy the entirey of the "Source Device"
335 to the "Target Device" or if you specified multipled target devices to all of
338 Once you have your table, save it in a file somewhere (e.g. /etc/ntfsvolume1),
339 and hand it over to dmsetup to work with, like so:
341 $ dmsetup create myvolume1 /etc/ntfsvolume1
343 You can obviously replace "myvolume1" with whatever name you like.
345 If it all worked, you will now have the device /dev/device-mapper/myvolume1
346 which you can then just use as an argument to the mount command as usual to
347 mount the ntfs volume. For example:
349 $ mount -t ntfs -o ro /dev/device-mapper/myvolume1 /mnt/myvol1
351 (You need to create the directory /mnt/myvol1 first and of course you can use
352 anything you like instead of /mnt/myvol1 as long as it is an existing
355 It is advisable to do the mount read-only to see if the volume has been setup
356 correctly to avoid the possibility of causing damage to the data on the ntfs
360 The Software RAID / MD driver
361 -----------------------------
363 An alternative to using the Device-Mapper driver is to use the kernel's
364 Software RAID / MD driver. For which you need to set up your /etc/raidtab
365 appropriately (see man 5 raidtab).
367 Linear volume sets, i.e. linear raid, as well as stripe sets, i.e. raid level
368 0, have been tested and work fine (though see section "Limitiations when using
369 the MD driver with NTFS volumes" especially if you want to use linear raid).
370 Even though untested, there is no reason why mirrors, i.e. raid level 1, and
371 stripes with parity, i.e. raid level 5, should not work, too.
373 You have to use the "persistent-superblock 0" option for each raid-disk in the
374 NTFS volume/stripe you are configuring in /etc/raidtab as the persistent
375 superblock used by the MD driver would damange the NTFS volume.
377 Windows by default uses a stripe chunk size of 64k, so you probably want the
378 "chunk-size 64k" option for each raid-disk, too.
380 For example, if you have a stripe set consisting of two partitions /dev/hda5
381 and /dev/hdb1 your /etc/raidtab would look like this:
387 persistent-superblock 0
394 For linear raid, just change the raid-level above to "raid-level linear", for
395 mirrors, change it to "raid-level 1", and for stripe sets with parity, change
396 it to "raid-level 5".
398 Note for stripe sets with parity you will also need to tell the MD driver
399 which parity algorithm to use by specifying the option "parity-algorithm
400 which", where you need to replace "which" with the name of the algorithm to
401 use (see man 5 raidtab for available algorithms) and you will have to try the
402 different available algorithms until you find one that works. Make sure you
403 are working read-only when playing with this as you may damage your data
404 otherwise. If you find which algorithm works please let us know (email the
405 linux-ntfs developers list linux-ntfs-dev@lists.sourceforge.net or drop in on
406 IRC in channel #ntfs on the irc.freenode.net network) so we can update this
409 Once the raidtab is setup, run for example raid0run -a to start all devices or
410 raid0run /dev/md0 to start a particular md device, in this case /dev/md0.
412 Then just use the mount command as usual to mount the ntfs volume using for
413 example: mount -t ntfs -o ro /dev/md0 /mnt/myntfsvolume
415 It is advisable to do the mount read-only to see if the md volume has been
416 setup correctly to avoid the possibility of causing damage to the data on the
420 Limitiations when using the Software RAID / MD driver
421 -----------------------------------------------------
423 Using the md driver will not work properly if any of your NTFS partitions have
424 an odd number of sectors. This is especially important for linear raid as all
425 data after the first partition with an odd number of sectors will be offset by
426 one or more sectors so if you mount such a partition with write support you
427 will cause massive damage to the data on the volume which will only become
428 apparent when you try to use the volume again under Windows.
430 So when using linear raid, make sure that all your partitions have an even
431 number of sectors BEFORE attempting to use it. You have been warned!
433 Even better is to simply use the Device-Mapper for linear raid and then you do
434 not have this problem with odd numbers of sectors.
440 Note, a technical ChangeLog aimed at kernel hackers is in fs/ntfs/ChangeLog.
443 - Stamp the user space journal, aka transaction log, aka $UsnJrnl, if
444 it is present and active thus telling Windows and applications using
445 the transaction log that changes can have happened on the volume
446 which are not recorded in $UsnJrnl.
447 - Detect the case when Windows has been hibernated (suspended to disk)
448 and if this is the case do not allow (re)mounting read-write to
449 prevent data corruption when you boot back into the suspended
451 - Implement extension of resident files using the normal file write
452 code paths, i.e. most very small files can be extended to be a little
453 bit bigger but not by much.
454 - Add new mount option "disable_sparse". (See list of mount options
456 - Improve handling of ntfs volumes with errors and strange boot sectors
458 - Fix various bugs including a nasty deadlock that appeared in recent
459 kernels (around 2.6.11-2.6.12 timeframe).
461 - Improve handling of ntfs volumes with errors.
462 - Fix various bugs and race conditions.
464 - Fix several race conditions and various other bugs.
465 - Many internal cleanups, code reorganization, optimizations, and mft
466 and index record writing code rewritten to fit in with the changes.
467 - Update Documentation/filesystems/ntfs.txt with instructions on how to
468 use the Device-Mapper driver with NTFS ftdisk/LDM raid.
470 - Fix two stupid bugs introduced in 2.1.18 release.
472 - Minor bugfix in handling of the default upcase table.
473 - Many internal cleanups and improvements. Many thanks to Linus
474 Torvalds and Al Viro for the help and advice with the sparse
475 annotations and cleanups.
477 - Fix scheduling latencies at mount time. (Ingo Molnar)
478 - Fix endianness bug in a little traversed portion of the attribute
481 - Fix bugs in mount time error code paths.
483 - Implement access time updates (including mtime and ctime).
484 - Implement fsync(2), fdatasync(2), and msync(2) system calls.
485 - Enable the readv(2) and writev(2) system calls.
486 - Enable access via the asynchronous io (aio) API by adding support for
487 the aio_read(3) and aio_write(3) functions.
489 - Invalidate quotas when (re)mounting read-write.
490 NOTE: This now only leave user space journalling on the side. (See
491 note for version 2.1.13, below.)
493 - Fix an NFSd caused deadlock reported by several users.
495 - Implement writing of inodes (access time updates are not implemented
496 yet so mounting with -o noatime,nodiratime is enforced).
497 - Enable writing out of resident files so you can now overwrite any
498 uncompressed, unencrypted, nonsparse file as long as you do not
499 change the file size.
500 - Add housekeeping of ntfs system files so that ntfsfix no longer needs
501 to be run after writing to an NTFS volume.
502 NOTE: This still leaves quota tracking and user space journalling on
503 the side but they should not cause data corruption. In the worst
504 case the charged quotas will be out of date ($Quota) and some
505 userspace applications might get confused due to the out of date
506 userspace journal ($UsnJrnl).
508 - Fix the second fix to the decompression engine from the 2.1.9 release
509 and some further internals cleanups.
511 - Driver internal cleanups.
513 - Force read-only (re)mounting of volumes with unsupported volume
514 flags and various cleanups.
516 - Fix two bugs in handling of corner cases in the decompression engine.
518 - Read the $MFT mirror and compare it to the $MFT and if the two do not
519 match, force a read-only mount and do not allow read-write remounts.
520 - Read and parse the $LogFile journal and if it indicates that the
521 volume was not shutdown cleanly, force a read-only mount and do not
522 allow read-write remounts. If the $LogFile indicates a clean
523 shutdown and a read-write (re)mount is requested, empty $LogFile to
524 ensure that Windows cannot cause data corruption by replaying a stale
525 journal after Linux has written to the volume.
526 - Improve time handling so that the NTFS time is fully preserved when
527 converted to kernel time and only up to 99 nano-seconds are lost when
528 kernel time is converted to NTFS time.
530 - Enable NFS exporting of mounted NTFS volumes.
532 - Fix minor bug in handling of compressed directories that fixes the
533 erroneous "du" and "stat" output people reported.
535 - Minor bug fix in attribute list attribute handling that fixes the
536 I/O errors on "ls" of certain fragmented files found by at least two
537 people running Windows XP.
539 - Minor update allowing compilation with all gcc versions (well, the
540 ones the kernel can be compiled with anyway).
542 - Major bug fixes for reading files and volumes in corner cases which
543 were being hit by Windows 2k/XP users.
545 - Major bug fixes aleviating the hangs in statfs experienced by some
548 - Update handling of compressed files so people no longer get the
549 frequently reported warning messages about initialized_size !=
552 - Add configuration option for developmental write support.
553 - Initial implementation of file overwriting. (Writes to resident files
554 are not written out to disk yet, so avoid writing to files smaller
556 - Intercept/abort changes in file size as they are not implemented yet.
558 - Minor bugfixes in error code paths and small cleanups.
560 - Small internal cleanups.
561 - Support for sendfile system call. (Christoph Hellwig)
563 - Massive internal locking changes to mft record locking. Fixes
564 various race conditions and deadlocks.
565 - Fix ntfs over loopback for compressed files by adding an
566 optimization barrier. (gcc was screwing up otherwise ?)
567 Thanks go to Christoph Hellwig for pointing these two out:
568 - Remove now unused function fs/ntfs/malloc.h::vmalloc_nofs().
569 - Fix ntfs_free() for ia64 and parisc.
571 - Small internal cleanups.
573 These only affect 32-bit architectures:
574 - Check for, and refuse to mount too large volumes (maximum is 2TiB).
575 - Check for, and refuse to open too large files and directories
578 - Support non-resident directory index bitmaps. This means we now cope
579 with huge directories without problems.
580 - Fix a page leak that manifested itself in some cases when reading
584 - Fix race condition and improvements in block i/o interface.
585 - Optimization when reading compressed files.
587 - Fix race condition in reading of compressed files.
589 - Cleanups and optimizations.
591 - Fix stupid bug introduced in 2.0.15 in new attribute inode API.
592 - Big internal cleanup replacing the mftbmp access hacks by using the
593 new attribute inode API instead.
595 - Bug fix in parsing of remount options.
596 - Internal changes implementing attribute (fake) inodes allowing all
597 attribute i/o to go via the page cache and to use all the normal
598 vfs/mm functionality.
600 - Internal changes improving run list merging code and minor locking
601 change to not rely on BKL in ntfs_statfs().
603 - Internal changes towards using iget5_locked() in preparation for
604 fake inodes and small cleanups to ntfs_volume structure.
606 - Internal cleanups in address space operations made possible by the
607 changes introduced in the previous release.
609 - Internal updates and cleanups introducing the first step towards
610 fake inode based attribute i/o.
612 - Microsoft says that the maximum number of inodes is 2^32 - 1. Update
613 the driver accordingly to only use 32-bits to store inode numbers on
614 32-bit architectures. This improves the speed of the driver a little.
616 - Change decompression engine to use a single buffer. This should not
617 affect performance except perhaps on the most heavy i/o on SMP
618 systems when accessing multiple compressed files from multiple
619 devices simultaneously.
620 - Minor updates and cleanups.
622 - Remove now obsolete show_inodes and posix mount option(s).
623 - Restore show_sys_files mount option.
624 - Add new mount option case_sensitive, to determine if the driver
625 treats file names as case sensitive or not.
626 - Mostly drop support for short file names (for backwards compatibility
627 we only support accessing files via their short file name if one
629 - Fix dcache aliasing issues wrt short/long file names.
630 - Cleanups and minor fixes.
634 - Major bugfix to make compatible with other kernel changes. This fixes
635 the hangs/oopses on umount.
636 - Locking cleanup in directory operations (remove BKL usage).
638 - Major buffer overflow bug fix.
639 - Minor cleanups and updates for kernel 2.5.12.
641 - Cleanups and updates for kernel 2.5.11.
643 - Small bug fixes, cleanups, and performance improvements.
645 - Use default fmask of 0177 so that files are no executable by default.
646 If you want owner executable files, just use fmask=0077.
647 - Update for kernel 2.5.9 but preserve backwards compatibility with
649 - Minor bug fixes, cleanups, and updates.
651 - Minor updates, primarily set the executable bit by default on files
652 so they can be executed.