{
  "slug": "ntfs-update-sequence-array",
  "term": "NTFS update sequence array",
  "aliases": [
    "NTFS fixup array",
    "NTFS multisector transfer protection"
  ],
  "definition": "An NTFS update sequence array stores a cyclic marker and displaced trailer words used to check protected multisector records before restoring those words.",
  "note": "The NTFS v3 contract compares the final two bytes of each 512-byte stride with the array marker before restoration. This is a record-transfer check, not a checksum over every byte. [ntfs-multisector]\n\nIn Hesela's bounded native-library fixtures, altered interior bytes and saved trailer words were accepted, as were mixed records with equal markers; unequal markers were rejected. These results test one packaged NTFS-3G routine, not Windows or a mounted filesystem. [ntfs-usa-fixtures]\n\nFor a 1024-byte fixture the tested count field is three 16-bit elements, occupying six bytes. The MULTI_SECTOR_HEADER documentation labels UpdateSequenceArraySize as bytes, while the pinned implementation treats usa_count as an element count; use the explicit layout and tested version when writing a parser. Its pre-write counter wraps from 65534 to 1. Neither a matching nor a newer-looking marker proves record identity or freshness. [ntfs-multisector] [ntfs-mst-source]\n\nDo not confuse this record marker with the NTFS USN change journal, which tracks file and directory changes. [ntfs-change-journal]\n\nFixup routines also depend on buffer state. In 24 additional NTFS-3G lifecycle controls, repeated read fixup rejected already-restored bytes; double pre-write protection followed by a successful checked read lost the original trailer payload. Properly paired writer calls preserved it. The post-write restoration helper returns no status and performs no marker validation, so it is not a substitute for checking input. These are deliberate caller-misuse controls, not observed production defects. [ntfs-usa-lifecycle] [ntfs-mst-source]",
  "status": "shipping",
  "advantages": [],
  "limitations": [
    "A successful fixup check is not evidence that file contents match a trusted original.",
    "The experiment uses synthetic record headers, not full MFT parsing or a drive-fault workload."
  ],
  "related": [
    "ntfs",
    "torn-write",
    "checksum",
    "lost-write"
  ],
  "supersedes": [],
  "supersededBy": [],
  "firstSeen": null,
  "lastSeen": null,
  "updated": "2026-10-23",
  "citations": [
    {
      "id": "ntfs-multisector",
      "title": "Microsoft: MULTI_SECTOR_HEADER, NTFS 3.0/3.1, 512-byte sequence stride",
      "url": "https://learn.microsoft.com/en-us/windows/win32/devnotes/multi-sector-header",
      "accessed": "2026-10-23"
    },
    {
      "id": "ntfs-mst-source",
      "title": "NTFS-3G mst.c, commit 78414d93613532fd82f3a82aba5d4a1c32898781: validation, restoration and counter wrap",
      "url": "https://github.com/tuxera/ntfs-3g/blob/78414d93613532fd82f3a82aba5d4a1c32898781/libntfs-3g/mst.c",
      "accessed": "2026-10-23"
    },
    {
      "id": "ntfs-usa-fixtures",
      "title": "Hesela: native NTFS-3G update-sequence fixtures, 36 read cases and five write transitions (2026-10-23)",
      "url": "https://hesela.dev/research/ntfs-update-sequence/results.json",
      "accessed": "2026-10-23"
    },
    {
      "id": "ntfs-change-journal",
      "title": "Microsoft: Change Journals, a separate NTFS change-tracking facility",
      "url": "https://learn.microsoft.com/en-us/windows/win32/fileio/change-journals",
      "accessed": "2026-10-23"
    },
    {
      "id": "ntfs-usa-lifecycle",
      "title": "Hesela: native NTFS-3G lifecycle controls, 24 sequences and 48 calls per capture (2026-10-23)",
      "url": "https://hesela.dev/research/ntfs-update-sequence/lifecycle-results.json",
      "accessed": "2026-10-23"
    }
  ],
  "provenance": [
    "One Ubuntu NTFS-3G 1:2022.10.3-1.2ubuntu3.2 library; two exact captures on one host are not independent environments.",
    "No Windows driver, chkdsk, mounted volume or device was exercised. Fixture frequencies are coverage counts, not observed failure probabilities."
  ]
}