NTFS Metadata files

Upon initializing NTFS on a disk, 11 metadata files are created in which NTFS
stores data associated with disk management. Don’t try to delete them. They are
the heart of NTFS. (actually I don’t think you can). In any case, should you
find them, they are not the odd remains of the latest virus or trojan. Metadata
files are typically invisible but you can see them by typing

dir /ah metadatafilename

For example, dir /ah $mft

The metadata files and description:

$MFT – Master File Table
$MFTMIRR – Copy of the first 16 records of the MFT
$LOGFILE – Transactional logging file
$VOLUME – Volume serial number, creation time, and dirty
flag
$ATTRDEF – Attribute definitions
. – Root
directory of the disk
$BITMAP – Contains drive’s
cluster map (in-use vs. free)
$BOOT – Boot record of
the drive
$BADCLUS – Lists bad clusters on the
drive
$QUOTA – Contains user quota information
(implemented in W2k as $Secure)
$UPCASE – Maps lowercase characters to their uppercase
version