Since NTFS is a proprietary file system created by Microsoft, how did the ntfs-3g developers manage to create an open source version of the NTFS drivers without referring to the NTFS source code? Or is there some kind of agreement with Microsoft regarding this??

2 Answers 2


ntfs-3g is the following of the first NTFS driver created back in 1995 by Martin von Löwis.
The driver has been mostly reverse engineered which mean by observing and analyzing the data structure and find a way to correctly handling it.
According to the original project site

The method was roughly:
1 Look at the volume with a hex editor
2 Perform some operation, e.g. create a file
3 Use the hex editor to look for changes
4 Classify and document the changes
5 Repeat steps 1-4 forever

After a long developement and a laborious work, a fork has been created from NTFS-Linux according to the first release note of ntfs-3g back in 2006:

As part of the Linux-NTFS project, I'm happy to announce my contribution to ntfsmount and libntfs which resulted ntfs-3g, a read-write ntfs driver, capable for unlimited file creation and deletion.

I hope this partial answer help you see how this was born and how it continues to leave.
It's important to note that today this driver is maintained by Tuxera and is no longer an amateur product.

  • I'm glad this answer your question.
    – Kiwy
    Feb 26, 2014 at 11:05
  • Thanks for the great answer... must have been really hard, having to reverse engineer an entire filesystem!!
    – rpthms
    Feb 27, 2014 at 5:19
  • @Nighpher I bet it was and still is because NTFS is still under developement by Microsoft and ntfs-3g doesz continue to work.
    – Kiwy
    Feb 27, 2014 at 8:30
  • I wonder what made Microsoft not sue for IP infringement. Since NTFS is proprietary software Microsoft had every right to sue the developer of ntfs-3g. Feb 8, 2017 at 18:07

That's right. Reverse engineering.

Reverse engineering is basically looking at patterns for a certain behaviour and expected results and document them in a way that you can reproduce it without even looking at the code.

For example, for windows compatibility network layer for CIFS/SMB (NetBIOS for early versions, AKA as window shares) the Samba project developers used a network sniffer and a packet analyzer in such a way that they documented what those network packages contained for certain operations (like sending a request to the port to list shares) and then simulate the same operation but with their own code implementation, as long as the network packet data send was compatible with what the windows server was expecting.

So NTFS-3g was the same thing, but looking at hard disk behaviour and results, instead of network.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .