Abstract: Because of the extensive use ofNTFS, this paper analyzed the basic structure ofmanaging disk data on NTFS volume from the organization of disk physical sectors, the layout of disk space and the mode of organizing disk data in detail. This paper can supp ly some guidance for the data recovery technology and Computer Forensics technology based on NTFS.