Windows File System - Rose

Comments

Transcription

Windows File System - Rose
Windows File System
Windows File System
 File allocation table (FAT)
 used in Windows 95, and
 MS-DOS
 NTFS - New Technology File System
Q1
2
Key features of NTFS
 NTFS uses clusters(rather than sectors) as units of disk
allocation.
 Sector:
 Smallest physical storage unit on disk
 Data size in bytes is a power of 2 (typically 512 bytes)
 Cluster:



One or more contiguous sectors
Size in sectors is a power of 2
example,
 1KB for volumes up to 1 GB
 2KB for volumes up to 2GB
 4KB for larger volumes
3
Key features of NTFS
 Uses logical cluster numbers as disk addresses
 A file is a structured object that has attributes such as
 name,
 creation time,
 security (ACL),
 data attributes
Q2
4
Key features of NTFS
 Security – Each file references a security descriptor
 Contains an access token for the owner
 Contains an ACL (access control list)
 General indexing facility
 Can index file using different attributes e.g., size, date
last created, name
 Recoverability
Q3
5
Recoverability
 In the event of a crash, NTFS can reconstruct disk
volumes to a consistent state.
 File system information can be retrieved, not necessarily
the data in the files.
 Uses transaction processing:
 A change is an atomic operation and
 the change is logged, when (successfully) completed
6
Recoverability
 Log each transaction that modifies the volume
 Enter transaction in log file (cache)
 Perform action on volume (cache)
 Write log file to disk
 Write volume to disk
 In the event of a crash in the midst of a transaction,
the log file can be used to redo or undo the
transaction.
7
Important concepts in NTFS
 Uses 64-bit disk addresses
 Can theoretically support disk partitions of size 264 bytes
 Individual file names limited to 255 chars
 Files names 28 characters (Unicode)
 Full path names limited to 32,767 chars
 Path names 215 characters
Q4
8
Important concepts in NTFS
 File consist of multiple attributes
 Each attribute represented by stream of bytes




name of the file,
64-bit object ID,
long unnamed stream of data (max length 264 bytes)
Some files have 2 named streams instead 1 unnamed stream
 e.g., foo:stream1 (borrowed from MAC)
 Possible uses


Photo and thumbnail,
permanent word doc and temp doc during word procession
 Uses file pointers to keep track of where a process is in
a file
9
NTFS file management API
 NTFS (Windows 2000, XP, Vista) provides an API with
functions for doing file I/O
 Second column gives nearest UNIX equivalent
Q5
10
NTFS directory management API
 These are the major API calls for directories in NTFS
 Like UNIX, the directory structure is hierarchical
 The separator between component names is \
(inherited from MS-DOS) instead of /
11
NTFS volume layout
 Each NTFS volume (e.g., disk partition)
 contains files, directories, bitmaps, and other data
structures
 organized as linear sequence of fixed sized (512B to 64
KB) blocks

(Microsoft calls them clusters)
 Most NTFS disk volumes use 4 KB clusters
 Advantage: compromise between low internal
fragmentation and efficient transfer
12
NTFS volume layout
 Clusters are referred to by their offset from the start of
the volume (using 64-bit numbers)
 Main data structure in each volume is the Master File
Table or MFT
 contains a linear sequence of fixed-size 1 KB records
Q6
13
NTFS volume layout
14
NTFS volume layout
 The disk volume is partitioned into two zones
 Data-zone
 MFT-zone




Occupies about 22% of the clusters
Allows for the MFT to be stored in contiguous locations
 Hence, allows for faster access
If the data-zone runs out of space, then the space in the MFTzone may be used.
MFT may become fragmented.
 The standard defragmentation tool cannot de-fragment MFT.
 Tools to defragment the MFT

Diskeeper, PerfectDisk, O&O Defrag
15
Master File Table (MFT)
 Recall: Main data structure in each volume is the
Master File Table or MFT
 contains a linear sequence of fixed-size 1 KB records
 Each MFT record describes one file or directory
 A record contains the files attributes (name, timestamp,
list of disk addresses where blocks are located)
 If file is extremely large, multiple MFT records are
used to hold the list of all blocks of file
 MFT contains records for metadata files
 File names begin with a $ sign
 An entry for MFT itself
Q7
16
MFT records
Q8
17
NTFS metadata files
NameMFT
Record
Description
$MFT
0
Master File Table—NTFS's command central
$MFTMIRR
1
Copy of the first 16 records of the MFT
$LOGFILE
2
Transactional logging file
$VOLUME
3
Contains volume serial number, creation time, and dirty flag
$ATTRDEF
4
Attribute definitions
.
5
Root directory of the disk
$BITMAP
6
Contains drive's cluster map (in-use vs. free)
$BOOT
7
Boot record of the drive
$BADCLUS
8
Lists bad clusters on the drive
$QUOTA
9
Contains user quota information—unused before NT 5.0 NTFS
$UPCASE
10
Maps lowercase characters to their uppercase version
Article from WindowsITPro by Mark Russinovich- Reference # 4
Q9
18
NTFS metadata files
 System files
 MFTMIRR
 A mirror of the first 16 records (including the 11 metafiles) of the
MFT, placed in the middle of the disk partition.
 Log file
 A list of the transactions used for recovery
 Cluster bit map
 Attribute definition table
 Defines types of attributes supported
 Indicates whether they can be indexed
 Indicates whether they can be recovered
19
MFT record details
 Each record describes a file or a folder
 Contains the set of attributes that define the file
 May contain the data of the file if the data is small
enough
 Contains pointers to clusters that hold the rest of the
data for the file
 A directory entry contains the
 MFT index for the file,
 the length of the file name,
 the file name itself, and various other fields and flags.
Q10
20
Attributes in a MFT record
21
An MFT record for a 3-run file
22

Similar documents