Windows File System
Windows File System File allocation table (FAT) used in Windows 95, and MS-DOS NTFS - New Technology File System 2
Key features of NTFS NTFS uses clusters(rather than sectors) as units of disk allocation. Sector: Smallest physical storage unit on disk Data size in bytes is a power of 2 (typically 512 bytes) Cluster: One or more contiguous sectors Size in sectors is a power of 2 example, 1KB for volumes up to 1 GB 2KB for volumes up to 2GB 4KB for larger volumes 3
Key features of NTFS Uses logical cluster numbers as disk addresses A file is a structured object that has attributes such as name, creation time, security (ACL), data attributes 4
Key features of NTFS Security Each file references a security descriptor Contains an access token for the owner Contains an ACL (access control list) General indexing facility Can index file using different attributes e.g., size, date last created, name Recoverability 5
Recoverability In the event of a crash, NTFS can reconstruct disk volumes to a consistent state. File system information can be retrieved, not necessarily the data in the files. Uses transaction processing: A change is an atomic operation and the change is logged, when (successfully) completed 6
Recoverability Log each transaction that modifies the volume Enter transaction in log file (cache) Perform action on volume (cache) Write log file to disk Write volume to disk In the event of a crash in the midst of a transaction, the log file can be used to redo or undo the transaction. 7
Important concepts in NTFS Uses 64-bit disk addresses Can theoretically support disk partitions of size 2^64 bytes Individual file names limited to 255 chars Files names 2^8 characters (Unicode) Full path names limited to 32,767 chars Path names 2^15 characters 8
Important concepts in NTFS File consist of multiple attributes Each attribute represented by stream of bytes name of the file, 64-bit object ID, long unnamed stream of data (max length 2^64 bytes) Some files have 2 named streams instead 1 unnamed stream e.g., foo:stream1 (borrowed from MAC) Possible uses Photo and thumbnail, permanent word doc and temp doc during word procession Uses file pointers to keep track of where a process is in a file 9
NTFS file management API NTFS (Windows 2000, XP, Vista) provides an API with functions for doing file I/O Second column gives nearest UNIX equivalent 10
NTFS directory management API These are the major API calls for directories in NTFS Like UNIX, the directory structure is hierarchical The separator between component names is \ (inherited from MS-DOS) instead of / 11
NTFS volume layout Each NTFS volume (e.g., disk partition) contains files, directories, bitmaps, and other data structures organized as linear sequence of fixed sized (512B to 64 KB) blocks (Microsoft calls them clusters) Most NTFS disk volumes use 4 KB clusters Advantage: compromise between low internal fragmentation and efficient transfer 12
NTFS volume layout Clusters are referred to by their offset from the start of the volume (using 64-bit numbers) Main data structure in each volume is the Master File Table or MFT contains a linear sequence of fixed-size 1 KB records 13
NTFS volume layout 14
NTFS volume layout The disk volume is partitioned into two zones Data-zone MFT-zone Occupies about 22% of the clusters Allows for the MFT to be stored in contiguous locations Hence, allows for faster access If the data-zone runs out of space, then the space in the MFTzone may be used. MFT may become fragmented. The standard defragmentation tool cannot de-fragment MFT. Tools to defragment the MFT Diskeeper, PerfectDisk, O&O Defrag 15
Master File Table (MFT) Recall: Main data structure in each volume is the Master File Table or MFT contains a linear sequence of fixed-size 1 KB records Each MFT record describes one file or directory A record contains the files attributes (name, timestamp, list of disk addresses where blocks are located) If file is extremely large, multiple MFT records are used to hold the list of all blocks of file MFT contains records for metadata files File names begin with a $ sign An entry for MFT itself 16
MFT records 17
NTFS metadata files NameMFT Record Description $MFT 0 Master File Table NTFS's command central $MFTMIRR 1 Copy of the first 16 records of the MFT $LOGFILE 2 Transactional logging file $VOLUME 3 Contains volume serial number, creation time, and dirty flag $ATTRDEF 4 Attribute definitions. 5 Root directory of the disk $BITMAP 6 Contains drive's cluster map (in-use vs. free) $BOOT 7 Boot record of the drive $BADCLUS 8 Lists bad clusters on the drive $QUOTA 9 Contains user quota information unused before NT 5.0 NTFS $UPCASE 10 Maps lowercase characters to their uppercase version Article from WindowsITPro by Mark Russinovich- Reference # 4 18
NTFS metadata files System files MFTMIRR A mirror of the first 16 records (including the 11 metafiles) of the MFT, placed in the middle of the disk partition. Log file A list of the transactions used for recovery Cluster bit map Attribute definition table Defines types of attributes supported Indicates whether they can be indexed Indicates whether they can be recovered 19
MFT record details Each record describes a file or a folder Contains the set of attributes that define the file May contain the data of the file if the data is small enough Contains pointers to clusters that hold the rest of the data for the file 20
Attributes in a MFT record 21
An MFT record for a 3-run file 22