Windows File System

The Windows file system is the structure Windows uses to name, store, organize, and protect data on storage devices.
Windows supports several file systems, each with different capabilities designed for security, performance, reliability, or compatibility with other devices.
Today, NTFS is used for the Windows system drive, while FAT32 and exFAT are mostly used for USB drives and memory cards, and ReFS is used for servers and developer storage.

Windows File System Hierarchy

Unlike Linux, which uses a single directory tree starting at root [/], Windows gives each volume its own drive letter [C:\, D:\, E:\],
and each drive has its own directory tree. [Volumes can also be mounted into an empty NTFS folder instead of a drive letter, but this is less common.]
Structure of a typical Windows file system:

Root Directories [Drive Letters]:
Each volume is assigned a drive letter. The C:\ drive is usually the system partition where Windows is installed.
The letters A:\ and B:\ were historically reserved for floppy disk drives, which is why the system drive is C:\.

System Directories:
C:\Windows\ – Contains the core operating system files [also referred to by the environment variable %SystemRoot%].
C:\Program Files\ – The default installation location for 64-bit applications.
C:\Program Files (x86)\ – The installation location for 32-bit applications on 64-bit Windows.
C:\ProgramData\ – A hidden folder that stores application data and settings shared by all users.
C:\Users\ – Contains the profile folder of every user on the system, plus a Public folder shared by all users.
C:\Windows\Temp\ – Temporary files used by Windows and system services.

User Directories:
C:\Users\[Username]\ – The user's profile folder [%USERPROFILE%].
C:\Users\[Username]\Desktop\, Documents\, Downloads\, Pictures\ – The user's personal folders.
C:\Users\[Username]\AppData\ – A hidden folder that stores user-specific application data, divided into three subfolders:
Local\ – Data that stays on this computer only, such as caches. It also contains the user's temporary folder, AppData\Local\Temp [%TEMP%].
LocalLow\ – Data for applications that run with low integrity [restricted permissions], such as sandboxed browser components.
Roaming\ – Settings that follow the user between computers when roaming profiles are used in a domain environment [%APPDATA%].

Hidden and System Files:
C:\pagefile.sys – The Windows paging file, used as virtual memory when physical RAM is full.
C:\swapfile.sys – A smaller paging file used by modern [Store] apps.
C:\hiberfil.sys – The hibernation file, which stores the contents of RAM when the computer hibernates [also used by Fast Startup].
C:\$Recycle.Bin\ – Recycle Bin storage, with a separate subfolder for each user [named after the user's SID].
C:\System Volume Information\ – Stores System Restore points and Volume Shadow Copies. Accessible only by the SYSTEM account.
C:\Windows\System32\ – Critical system files, programs, and libraries. On 64-bit Windows, this folder contains the 64-bit files, despite its name.
C:\Windows\SysWOW64\ – Contains the 32-bit system files on 64-bit Windows [WOW64 stands for "Windows 32-bit on Windows 64-bit"].

Important Locations for Security & Forensics

These locations are commonly checked by SOC analysts and incident responders, and commonly abused by attackers:
C:\Windows\System32\config\ – The registry hives, including SAM [local user accounts and password hashes], SYSTEM, SECURITY, and SOFTWARE.
C:\Windows\System32\winevt\Logs\ – The Windows Event Logs [.evtx files], such as Security.evtx, System.evtx, and Application.evtx.
C:\Windows\System32\drivers\etc\hosts – The local hosts file. Malware sometimes modifies it to redirect or block websites.
C:\Windows\Prefetch\ – Prefetch files [.pf] that show which programs were executed, and when - a valuable source of evidence in investigations.
%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup\ – Programs placed here run automatically when the user logs in - a common persistence location.
%TEMP%, C:\Users\Public\, and C:\ProgramData\ – Writable without administrator rights, so malware often drops and runs files from these folders.

File System Features

Access Control and Security

NTFS uses Access Control Lists [ACLs] to define which users and groups can access each file and folder, and what they are allowed to do.
Windows offers two types of encryption:
EFS [Encrypting File System] - Encrypts individual files and folders on NTFS, tied to the user's account and certificate.
BitLocker - Encrypts an entire volume, protecting all data if the disk or computer is stolen. Available on Pro, Enterprise, and Education editions [Windows Home offers a simpler "Device Encryption"].
BitLocker works below the file system, so it can protect NTFS, FAT32, and exFAT volumes [BitLocker To Go for USB drives].

Journaling and Data Integrity

NTFS uses a transaction log [$LogFile] to record metadata changes before they are written, so the file system can quickly recover to a consistent state after a crash or power loss.
NTFS journaling protects the file system structure, not the contents of your files.
NTFS also keeps a separate Change Journal [$UsnJrnl], which records every file creation, deletion, and rename - very useful in forensic investigations.
ReFS takes a different approach: instead of overwriting metadata in place, it writes changes to a new location [allocate-on-write], and uses checksums to detect corruption.

Compression

NTFS supports built-in, transparent file compression - files are compressed on disk and decompressed automatically when opened.
It can be enabled from the file's Properties > Advanced, or with the compact command.
A file cannot be both NTFS-compressed and EFS-encrypted at the same time.

Alternate Data Streams [ADS]

NTFS allows a file to contain more than one stream of data. The normal content is the main stream, and additional hidden streams can be attached to it.
These hidden streams do not change the file size shown in File Explorer, and are invisible to normal directory listings.
Windows itself uses ADS for the "Mark of the Web" - a stream called Zone.Identifier that marks files downloaded from the internet, which triggers security warnings.
Attackers can abuse ADS to hide data or malicious code inside legitimate files.
You can view streams with dir /r in CMD, or Get-Item [file] -Stream * in PowerShell.

Shadow Copies and Backups

The Volume Shadow Copy Service [VSS] creates point-in-time snapshots of a volume, even while files are in use.
It is used by System Restore, File History, Windows Backup, and most third-party backup software.
From a security perspective, ransomware almost always tries to delete shadow copies before encrypting files, to prevent recovery
[for example, with vssadmin delete shadows /all /quiet] - this command is a strong indicator of a ransomware attack.

File Attributes

Windows files and folders have special attributes that control their behavior and visibility.
These attributes can be managed through File Explorer [Properties], or with command-line tools such as attrib, compact, and cipher.

NTFS Permissions and Ownership

NTFS provides granular control over file and folder access through permissions and ownership.
Each file and folder has an Access Control List [ACL], made up of entries [ACEs] that Allow or Deny specific permissions to users and groups.
Understanding these concepts is crucial for system security and multi-user environments.

Standard NTFS Permissions

Permission Inheritance

Child folders and files inherit permissions from their parent folder by default.
This simplifies permission management across large directory structures.
Inheritance can be disabled for specific folders that require custom permissions.

How Windows Decides Access

Permissions from all of a user's groups are combined - if any group is allowed, the user is allowed, unless a Deny entry applies.
An explicit Deny takes priority over an explicit Allow.
Permissions set directly on a file [explicit] take priority over inherited permissions - so an explicit Allow can override an inherited Deny.
When accessing files over the network, both the Share permissions and the NTFS permissions apply, and the more restrictive of the two wins.

Ownership

Every file and folder has an owner - usually the user who created it.
The owner can always change the file's permissions, even if they have been denied access.
Administrators can take ownership of any file [with the takeown or icacls /setowner commands], which is how locked-out files are recovered.

Permissions From a Security Perspective

Weak permissions are one of the most common ways attackers escalate privileges on Windows.
For example, if a regular user can modify a program that runs as a service with SYSTEM privileges, they can replace it with their own code.
Tools like WinPEAS automatically search for these misconfigurations, and you can check a file's permissions yourself with icacls [file].

File System Commands

Windows provides powerful command-line tools for file system management.
These commands can be executed in Command Prompt [CMD] or PowerShell. Commands that change system files or other users' files require an Administrator prompt.

Essential CMD Commands

PowerShell Commands

Sources: Microsoft Learn - ReFS overview, Microsoft Learn - Dev Drive, Microsoft Learn - format command.