# EfiNtfs & EFI Commander - Release 09.2026

Native NTFS read+write file system driver for UEFI, plus a dual-panel pre-boot
file manager. Builds for x64 and ARM64 (AArch64) from identical sources.
Pure C, no EDK2 build system, no ntfs-3g.

No archive password.

---

## WHAT'S INSIDE

NTFS_EFI-latest/
|
+-- x64/             Intel/AMD 64-bit firmware
|   +-- ntfs.efi
|   +-- EC.efi
|   +-- ntfs_probe.efi
|
+-- arm64/           ARM64 (AArch64) firmware
|   +-- ntfs.efi
|   +-- EC.efi
|   +-- ntfs_probe.efi
|
+-- EC.ini           Sample configuration for EC.efi
+-- README.txt       This guide

Pick the directory matching your firmware. The two builds come from the same
sources and behave identically; only the machine type of the images differs.

  ntfs.efi         NTFS read+write UEFI driver
                   EFI_DRIVER_BINDING_PROTOCOL -> EFI_SIMPLE_FILE_SYSTEM_PROTOCOL
                   Binds to every disk handle with a valid NTFS boot sector

  EC.efi           EFI Commander - dual-panel file manager on GOP
                   Copy/move/delete/mkdir across FAT32 and NTFS, viewer, editor,
                   recursive search, SHA-256 integrity and tree sync
                   Loads ntfs.efi itself when the firmware has not

  ntfs_probe.efi   Self-loading test harness and tree-copy benchmark
                   Unit tests + recursive copy + _RESULT.txt + shutdown

## FILE SIZES
<!--SIZES-->
                       x64          arm64
  ntfs.efi            93,696 B     87,040 B
  EC.efi             163,840 B    154,112 B
  ntfs_probe.efi      49,664 B     47,104 B

<!--/SIZES-->

---

## DEPLOYMENT - WHERE THE FILES MUST GO

ntfs.efi MUST sit in the SAME DIRECTORY as EC.efi.

EC.efi derives its application directory from the MEDIA_FILEPATH node of its
own EFI_LOADED_IMAGE_PROTOCOL path and looks for <AppDir>\ntfs.efi. Override
that with NtfsDriverPath in EC.ini: a relative value is joined to <AppDir>,
a value starting with \ is taken from the volume root.

EC.ini resolution order:  <AppDir>\EC.ini  ->  \EC.ini  ->  \EFI\BOOT\EC.ini

ntfs_probe.efi is stricter on purpose: it opens \ntfs.efi on the root of the
volume it was itself loaded from, hardcoded, so an unattended run has nothing
to configure.

### Interactive rescue stick (FAT32 stick or ESP)

  \EFI\Boot\BOOTX64.EFI     copy of x64\EC.efi   - firmware boots straight into it
  \EFI\Boot\BOOTAA64.EFI    copy of arm64\EC.efi - the ARM64 fallback name
  \EFI\Boot\ntfs.efi        same directory, found automatically
  \EFI\Boot\EC.ini          optional

Use the fallback name your firmware looks for: BOOTX64.EFI on x64 machines,
BOOTAA64.EFI on ARM64 ones. A stick can carry both, each next to the ntfs.efi
of its own architecture, but then keep them in separate directories - EC.efi
looks for ntfs.efi in the directory it was loaded from.

Any other directory works equally well as long as both files share it,
e.g. \EC\EC.efi + \EC\ntfs.efi.

### UEFI Shell layout

  \ntfs.efi                  load fs0:\ntfs.efi
  \EC.efi                    AppDir is the root, so it finds ntfs.efi here
  \EC.ini

---

## QUICK START

### Windows - copy onto the EFI System Partition

  1. Mount the ESP from an elevated Command Prompt:
       mountvol X: /S
     (X: is an example - use any free drive letter)

  2. Copy both binaries into one directory, from the folder matching the
     firmware of the target machine (x64\ or arm64\):
       xcopy /Y x64\ntfs.efi X:\EFI\BOOT
       xcopy /Y x64\EC.efi   X:\EFI\BOOT
       xcopy /Y EC.ini       X:\EFI\BOOT

  3. Add a UEFI boot entry pointing to \EFI\BOOT\EC.efi via BIOS Setup
     (Boot > Add Boot Option), or copy EC.efi over BOOTX64.EFI (BOOTAA64.EFI
     on ARM64) on a dedicated rescue stick.

  4. Unmount: mountvol X: /D

### UEFI Shell

  Shell> load fs0:\ntfs.efi
  Shell> map -r
  Shell> fs1:                    the NTFS volume, now mounted by the driver
  fs1:\> cp fs0:\patched.sys fs1:\Windows\System32\drivers\
  fs1:\> fs0:\EC.efi

### Unattended test run

  Deploy ntfs_probe.efi as \EFI\Boot\BOOTX64.EFI (BOOTAA64.EFI on ARM64)
  with ntfs.efi in the volume ROOT. The probe runs its unit tests, copies a
  tree, writes \_RESULT.txt and shuts the machine down.

---

## BEFORE PULLING THE STICK

Quit EC.efi with F10, or issue DisconnectController on the NTFS handle.
That is what triggers the preallocation trim, the $Volume dirty-flag clear
and BlockIo->FlushBlocks. Cutting power at the panel view leaves the volume
marked dirty and Windows will want to check it on the next boot.

---

## EC.efi KEYBOARD REFERENCE

  F1                 Help
  F2                 Drive menu for the active panel
  F3 / F4            View file / edit file
  F5 / F6            Copy (recursive) / rename or move
  F7                 Create directory
  F8 or Delete       Delete (recursive)
  F9                 Program menu (see below)
  F10                Quit (clean unmount)
  Tab                Switch active panel
  Enter              Enter directory or launch an EFI application
  Backspace          Parent directory
  Alt+F1 / Alt+F2    Change left / right drive
  Alt+F7             Find a file anywhere under the active directory - by name
                     or mask, and optionally by text the file must contain
  Alt+F10            Directory hotlist (HotDir1..HotDir9 from EC.ini)
  Alt+Left/Right     Path history back / forward
  Ctrl+O             Command line; exit or Ctrl+O returns to the panels
  Ctrl+Q             Quick View of the current item in the passive panel
  Ctrl+F2            Attributes and modification time of the current item
  Ctrl+F3 / Ctrl+F4  Sort by name / extension  (repeat toggles direction)
  Ctrl+F5 / Ctrl+F6  Sort by date / size       (repeat toggles direction)
  Ctrl+F12           Panel filter mask, * clears it
  Insert or Space    Tag current item
  Ctrl+A / Ctrl+U    Tag all / clear tags
  + / -              Tag / untag by mask
  *                  Invert tags
  =                  Tag what differs between the two panels
  letters            Quick prefix jump
  / then N           Find anywhere in name, repeat

  In the viewer:  F4 text/hex, F7 find ASCII text, F3 find next
  In the editor:  F2 save, F4 text/hex

---

## EC.efi F9 MENU

  Refresh both panels
  Change active drive                same as F2
  Find file by name or contents      same as Alt+F7, for firmware that eats Alt
  Compare panel directories          same as =
  Recursive compare / update         walks both trees with SHA-256, then can
                                     copy missing and differing entries one way
                                     while keeping destination-only entries.
                                     Esc stops it where it stands
  Checksum selected file             SHA-256 and CRC32 of the current file
  Toggle Quick View                  same as Ctrl+Q
  Run selected EFI with arguments    LoadImage + LoadOptions + StartImage
  UEFI tools                         volume details, device rescan, load an
                                     image as a driver, read-only BootOrder /
                                     BootNext / Boot#### listing
  Selection tools                    the +, -, *, Ctrl+A, Ctrl+U operations
  Set active panel filter            same as Ctrl+F12, this session only
  Directory hotlist                  same as Alt+F10
  Command line                       same as Ctrl+O
  Settings                           every option in EC.ini, saved on change
  Help                               same as F1

Settings are written back the moment they change. EC.ini is created on first
write if it does not exist, next to the running EC.efi; if an existing file was
found elsewhere at startup, that file is the one updated. A filter set with
Ctrl+F12 is temporary - to keep it, set it under Settings.

---

## VERIFIED

  ~3.9 MB real Windows 11 System32 subset - SHA256 byte-exact per file,
                                            chkdsk /f CLEAN, volume NOT dirty
  1500 files in one directory              - forces INDX leaf splits and
                                            separator promotion, chkdsk CLEAN
  7 GB mixed data, FAT -> NTFS, Hyper-V    - ~4 minutes, bad=0, chkdsk CLEAN
  6344 files onto a full $MFT, Hyper-V     - table grown from 136960 to 143872
                                            records, chkdsk found no problems
  2000 files created then all deleted      - index back to one 4 KB block,
                                            chkdsk found no problems
  Four LZX-compacted Windows binaries      - 72 KB to 7.6 MB, up to 243 chunks,
                                            byte-exact against Windows
  EC self-test, Hyper-V                    - 68 scripted checks, 0 failures

Always attach a result image with Mount-VHD -ReadOnly before verifying.
Given write access, Windows silently repairs a volume on first access, and a
chkdsk run afterwards then reports a clean volume that the driver did not
actually leave clean.

---

## KNOWN BOUNDARIES

  - No DOS 8.3 alias (single POSIX $FILE_NAME)
  - Write path assumes a single base MFT record (no $ATTRIBUTE_LIST creation)
  - Deletes only a file with one genuine name; an 8.3 alias does not count,
    a name another directory also holds does
  - No $LogFile journal - integrity rests on ordered writes, explicit
    rollback and the $Volume dirty flag
  - Compressed files are read only: LZNT1, WOF XPRESS-Huffman and WOF LZX
    all decompress, nothing compresses on write
  - 2048 extents per attribute
  - Little-endian only; builds ship for x64 and ARM64

---

## CONTACT & SUPPORT

  GitHub:        https://github.com/wesmar/NTFS_EFI
  Project page:  https://kvc.pl/repositories/ntfs_efi
  Email:         marek@wesolowski.eu.org

---

## LEGAL DISCLAIMER

This software is provided for educational, research and recovery purposes.
Writing to a file system from firmware carries inherent risk: always test on
a disposable volume or VHD first, and keep backups of anything you care
about. The author assumes no liability for data loss or misuse.

MIT licence - see LICENSE.md in the repository.

---

Release: 08.2026
(c) WESMAR 2026
