The security of an NTFS volume is derived from the Windows object model.
Each NTFS file references a security descriptor, which specifies the owner of the
file, and an access-control list, which contains the access permissions granted
or denied to each user or group listed. Early versions of NTFS used a separate
security descriptor as an attribute of each file.