In any operating system, a file system is a part of the overall structure that determines how the files are named, stored, and organized on a volume. The files and folders are managed by a file system, and this information is required to set and access these items by local and remote users. The file system that the Windows NT operating system uses for storing and retrieving files on a hard disk is NTFS (New Technology File System).

NTFS is the Windows NT equivalent of the Windows 95 file allocation table (FAT). NTFS has a number of features that are not available in FAT or FAT32. NTFS allows a user to gain the maximum benefits such as increased security, more robust and reliable performance, as well as a design for greater storage growth. NTFS manages sparse files by tracking the starting and ending point of the sparse file, as well as its useful (non-zero) data. The unused space in a sparse file is made available as free space.

NTFS allows setting permissions on a file or folder, and specifying the groups and users whose access a user wants to restrict or allow, and then select the type of access. NTFS also supports the Encrypting File System (EFS) technology used to store encrypted files on NTFS volumes. NTFS file system provides increased security for the mail store. NTFS maintains the change journal by tracking information about added, deleted, and modified files for each volume. By creating hard links, one can have a single file in multiple folders without duplicating the file. As all of the hard links reference the same file, applications can open any of the hard links and modify the file. NTFS allows creating an NTFS volume up to 16 terabytes using the default cluster size (4 KB) for large volumes. A disk quota allows tracking and controlling the user disk space usage for NTFS volumes. NTFS supports compression as well as adding unallocated space from the same disk or from another disk to increase the size of an NTFS volume. Mounted volumes allows to mount a volume at any empty folder on a local NTFS volume if one runs out of drive letters or need to create additional space that is accessible from an existing folder.

NTFS has enough information in the log to complete or abort any partial NTFS operation, in case of system failure. During recovery operations, NTFS redoes each committed operation found in the log file. Then NTFS locates in the log file the transactions that were not committed at the time of the system failure and undoes each metadata operation recorded in the log file. An operation can either be completed or rolled back, to ensure this NTFS records the metadata operations in a log file cached in memory. NTFS records the actual metadata operations in memory. It marks the transaction in the cached log file as committed. The log files are flushed to disk. The actual metadata operations are flushed to the disk.