File System:

The fundamental structure of the 2000 file system (NTFS) is a volume.

      1.  Created by the 2000 disk administrator utility.

      2.  Based on a logical disk partition.

      3.  May occupy a portions of a disk, an entire disk, or span across several disks.

All metadata, such as information about the volume, is stored in a regular file.

NTFS uses clusters as the underlying unit of disk allocation.

      1. A cluster is a number of disk sectors that is a power of two.

      2. Because the cluster size is smaller than for the 16-bit FAT file system, the amount of

           internal  fragmentation is reduced.

File System — Internal Layout :

NTFS uses logical cluster numbers (LCNs) as disk addresses.

A file in NTFS is not a simple byte stream, as in MS-DOS or UNIX, rather, it is a structured object consisting of attributes.

Every file in NTFS is described by one or more records in an array stored in a special file called the Master File Table (MFT).

Each file on an NTFS volume has a unique ID called a file reference.

   1. 64-bit quantity that consists of a 48-bit file number and a 16- bit sequence number.

   2. Can be used to perform internal consistency checks.

The NTFS name space is organized by a hierarchy of directories; the index root contains the top level of the B+ tree.

File System — Recovery

All file system data structure updates are performed inside transactions.

     1. Before a data structure is altered, the transaction writes a log record that contains redo

         and undo information.  

   2.   After the data structure has been changed, a commit record  is written to the log to signify

          that the transaction succeeded.

After a crash, the file system data structures can be restored to a consistent state by processing the log records.

This scheme does not guarantee that all the user file data can be recovered after a crash, just that the file system data structures (the metadata files) are undamaged and reflect some consistent state prior to the crash..

The log is stored in the third metadata file at the beginning of the volume.

 The logging functionality is provided by the 2000 log file service.

File System — Security

Security of an NTFS volume is derived from the 2000 object model.

Each file object has a security descriptor attribute stored in this MFT record.

This attribute contains the access token of the owner of the file, and an access control list that states the access privileges that are granted to each user that has access to the file.

Volume Management and Fault Tolerance

FtDisk, the fault tolerant disk driver for 2000, provides several ways to combine multiple SCSI disk drives into enological volume.

Logically concatenate multiple disks to form a large logical volume, a volume set.

Interleave multiple physical partitions in round-robin fashion to form a stripe set (also called RAID level 0, or “disk striping”).

   1. Variation: stripe set with parity, or RAID level 5.  Disk mirroring, or RAID level 1, is a robust scheme that uses a mirror set — two equally sized partitions on tow disks with identical data contents.

To deal with disk sectors that go bad, FtDisk, uses a hardware technique called sector sparing and NTFS uses a software technique called cluster remapping.

Volume Set On Two Drives

Stripe Set on Two Drives

Stripe Set With Parity on Three Drives

Mirror Set on Two Drives

File System — Compression

To compress a file, NTFS divides the file’s data into compression units, which are blocks of 16 contiguous clusters.

For sparse files, NTFS uses another technique to save space.

   1. Clusters that contain all zeros are not actually allocated or stored on disk.

Instead, gaps are left in the sequence of virtual cluster numbers stored in the MFT entry for the file.

   2. When reading a file, if a gap in the virtual cluster numbers is found, NTFS just zero-fills that portion of the caller’s buffer.