Windows OS File Systems



Similar documents
Operating Systems CS-384. File Systems. NTFS and FAT32. Submitted To: Dr. Chris Taylor. Submitted By: Aditya Sitani

New Technologies File System (NTFS) Priscilla Oppenheimer. Copyright 2008 Priscilla Oppenheimer

File Systems Management and Examples

File System Forensics FAT and NTFS. Copyright Priscilla Oppenheimer 1

FAT32 vs. NTFS Jason Capriotti CS384, Section 1 Winter Dr. Barnicki January 28, 2000

Windows NT File System. Outline. Hardware Basics. Ausgewählte Betriebssysteme Institut Betriebssysteme Fakultät Informatik

Outline. Windows NT File System. Hardware Basics. Win2K File System Formats. NTFS Cluster Sizes NTFS

CHAPTER 17: File Management

Prof. Dr. Ing. Axel Hunger Dipl.-Ing. Bogdan Marin. Operation Systems and Computer Networks Betriebssysteme und Computer Netzwerke

File System Management

Chapter 6, The Operating System Machine Level

File-System Implementation

Chapter 13 File and Database Systems

Chapter 13 File and Database Systems

Chapter 12 File Management

REPORT DOCUMENTATION PAGE

COS 318: Operating Systems. File Layout and Directories. Topics. File System Components. Steps to Open A File

Copyright

Two Parts. Filesystem Interface. Filesystem design. Interface the user sees. Implementing the interface

The Windows File Articles -> Software Oct , 00:45 (UTC+0)

COS 318: Operating Systems

1. Introduction to the UNIX File System: logical vision

Understanding the Boot Process and Command Line Chapter #3

Password Changer for DOS User Guide

Main Points. File layout Directory layout

Chapter 11: File System Implementation. Operating System Concepts 8 th Edition

1 File Management. 1.1 Naming. COMP 242 Class Notes Section 6: File Management

Chapter 11: File System Implementation. Operating System Concepts with Java 8 th Edition

& Data Processing 2. Exercise 2: File Systems. Dipl.-Ing. Bogdan Marin. Universität Duisburg-Essen

XFS File System and File Recovery Tools

Disk management. Learning Objective. Preparing a Disk. Preparation tasks: Initializing the disk, i.e. defining disk s storage structure

Windows NT. Chapter 11 Case Study 2: Windows Windows 2000 (2) Windows 2000 (1) Different versions of Windows 2000

Algorithms and Methods for Distributed Storage Networks 7 File Systems Christian Schindelhauer

Installing a Second Operating System

Part III Storage Management. Chapter 11: File System Implementation

File Management Chapters 10, 11, 12

Acronis Disk Director 11 Advanced Server. Quick Start Guide

A Forensic Comparison of NTFS and FAT32 File Systems

Outline: Operating Systems

Crash Proof - Data Loss Prevention

3. USB FLASH DRIVE PREPARATION. Almost all current PC firmware permits booting from a USB drive, allowing the launch

TELE 301 Lecture 7: Linux/Unix file

Incident Response and Computer Forensics

File Systems for Flash Memories. Marcela Zuluaga Sebastian Isaza Dante Rodriguez

File System Design and Implementation

The Linux Virtual Filesystem

A+ Guide to Software: Managing, Maintaining, and Troubleshooting, 5e. Chapter 3 Installing Windows

File System Design for and NSF File Server Appliance

Understanding NTFS Hard Links, Junctions and Symbolic Links

Linux Filesystem Comparisons

Physical Data Organization

NSS Volume Data Recovery

QUICK RECOVERY FOR RAID

Filing Systems. Filing Systems

EaseTag Cloud Storage Solution

Defining Digital Forensic Examination and Analysis Tools Using Abstraction Layers

Module 2: File Systems and Management

File System & Device Drive. Overview of Mass Storage Structure. Moving head Disk Mechanism. HDD Pictures 11/13/2014. CS341: Operating System

Disaster Recovery on the Sun Cobalt RaQ 3 Server Appliance with Third-Party Software

Chapter 12 File Management. Roadmap

Chapter 12 File Management

Acronis Disk Director Server User s guide

Date: March Reference No. RTS-CB 018

IFSM 310 Software and Hardware Concepts. A+ OS Domain 2.0. A+ Demo. Installing Windows XP. Installation, Configuration, and Upgrading.

Chapter 10 Case Study 1: LINUX

Chapter 5: Operating Systems Part 1

How to partition your disk with the parted magic linux livecd

Digital Forensics Lecture 3. Hard Disk Drive (HDD) Media Forensics

Storage and File Systems. Chester Rebeiro IIT Madras

ECE 7650 Scalable and Secure Internet Services and Architecture ---- A Systems Perspective

Operating Systems CSE 410, Spring File Management. Stephen Wagner Michigan State University

Recover data from a defective Fujitsu desktop drive

File systems security: Shared folders & NTFS permissions, EFS Disk Quotas

Chapter 11 File and Disk Maintenance

Computer Forensic Capabilities

DualFS: A New Journaling File System for Linux

IBM TSM DISASTER RECOVERY BEST PRACTICES WITH EMC DATA DOMAIN DEDUPLICATION STORAGE

Project Group High- performance Flexible File System 2010 / 2011

Survey of Filesystems for Embedded Linux. Presented by Gene Sally CELF

4 II. Installation. 6 III. Interface specification Partition selection view Partition selection panel

Open Source Data Recovery

UNDELETE Users Guide

Flexible Storage Allocation

Lecture 18: Reliable Storage

Recovery of deleted files on a TrueCrypt volume March 23, 2010 rationallyparanoid.com

EnCase 7 - Basic + Intermediate Topics

Finding a needle in Haystack: Facebook s photo storage IBM Haifa Research Storage Systems

Windows BitLocker and Paragon s Backup Solutions

Computer Forensics and Investigations Duration: 5 Days Courseware: CT

NTLDR is missing. Below are the full error messages that may be seen when the computer is booting.

Data Storage and Backup. Sanjay Goel School of Business University at Albany, SUNY

Kaseya 2. User Guide. Version 7.0. English

winhex Disk Editor, RAM Editor PRESENTED BY: OMAR ZYADAT and LOAI HATTAR

Transcription:

Windows OS File Systems MS-DOS and Windows 95/98/NT/2000/XP allow use of FAT-16 or FAT-32. Windows NT/2000/XP uses NTFS (NT File System) File Allocation Table (FAT) Not used so much, but look at as a contrast to other file systems. Disk Layout See old Tanenbaum Fig 8-18. Boot sector Partition 1 Partion 2... Each partition can be a different file system (including Unix). Each partition is laid out as: Secondary Boot Sector FAT Optional Duplicate FAT Root directory Data blocks... CS 4513 1 week2-windowsfs.tex

File Allocation Table (FAT) Have a table with one entry for each block on the disk. Directory entry for a file contains the first block in the file. The FAT entry for this block then points to the next block of the file. Use EOF mark for last block. Blank entries indicate free blocks (no need for free block list). Example (also see old Tanenbaum Fig 8-19): Block Entry 0 Boot sector 1 Boot sector 2 3 3 7 4 Free 5 EOF 6 10 7 5 8 Free 9 Bad 10 EOF The boot sector contains boot instructions and descriptive info like: size of disk sector, number of physical sectors on disk per block, size of root directory. Bad entry indicates block is not usable. With 16-bit blocks have a maximum of 2 16 =64K blocks. To use a 2GB disk one would need 32K-byte blocks (very large). Can result in internal fragmentation for small files. FAT-32 uses 32-bit block numbers supporting 4GB of block numbers and disks up to 2 Terabytes in size. CS 4513 2 week2-windowsfs.tex

FAT-16 Directory Entry Each directory entry is 32 bytes: File Name (8 bytes) Extension (3 bytes) Attributes (1 byte) Reserved (10 bytes) Time (2 bytes) Date (2 bytes) Block number of first file block (2 bytes) File size in bytes (4 bytes) Attributes (one-bit each): R: Read Only A: Archive (set when file modified, cleared when backed up) S: System File (file cannot be deleted by the del command) H: Hidden File (file is not listed with dir command) D: Directory V: Volume Label Note: FAT and directory entry both keep track of how many blocks in a file could be inconsistency. FAT (versus Unix) keeps all information about a file in the directory entry rather than an inode. CS 4513 3 week2-windowsfs.tex

FAT-32 File System Block numbers are 32-bits long. FAT itself becomes larger and two of the reserved bytes in directory entry are used to extend block number to 4 bytes. FAT-32 also abolished the restriction on the size of the root directory the root directory is no longer stored in a fixed position. Like FAT-16, has no access protection for files. Long File Names VFAT (virtual file allocation table) is used in Windows 95/98 to handle long file names. Use a reserved area of VFAT for long file names with an invalid combination of attribute bits in directory entries. CS 4513 4 week2-windowsfs.tex

NT/2000/XP File System (NTFS) File System API Calls Look at Tanenbaum Figures 11-31 and 11-33 similar to Unix/Linux. Organization Fundamental entity in NTFS is a volume. Like a partition in FAT, but occupy part, all or multiple disks. Uses clusters (basically same as a block) as the unit of disk allocation. A cluster consists of one or more physical sectors on the disk. They are numbered by numbers called logical cluster numbers (LCNs). Information about NTFS files stored as attributes: file name (names if there are aliases), creation time, security descriptor, unnamed data attribute (contents of the file). Master File Table (MFT) Special file containing one entry for each file in a volume. MFT entry can be from 1KB to 4KB. Info contained in an MFT entry about a file: standard info such as time stamps, file size file s name in Unicode (16-bit chars) and also an 8.3 DOS-style name security info data for the file. If a small file this attribute can be stored in the MFT entry (resident attribute vs. non-resident attribute). More details if file is larger in keeping track of which LCNs are used. See Fig 11-35 for all attributes that can appear in MFT records. Attributes are accessed using file-name:attribute syntax. CS 4513 5 week2-windowsfs.tex

Directory The contents of a directory are stored as a file and contain an index to the files in this directory. The index is stored as a B+ tree for fast lookup of file names. Each file entry stores the file name, the number of its MFT entry, its time stamp and file size. Latter two values are duplicated from file MFT entry for faster directory listings. NTFS Volume Metadata NTFS volume metadata is stored in files: MFT itself copy of the MFT Log file records all metadata transactions to allow recovery from crashes attribute-definition table indicating which attribute types are used in the volume and what operations can be performed on them. Root directory Bitmap to show which clusters are allocated Boot file (to boot the system) Bad cluster file (clusters to avoid) (Tanenbaum Fig. 11-34) Other NTFS supports transparent file compression. Supports file encryption with public-key encryption Supports different RAID levels. CS 4513 6 week2-windowsfs.tex