1. Day 28 File System

2. File systems under Linux
Virtual File System (VFS)
Provides support for a variety of file management systems and file structures.
Provides a single, uniform interface to all user processes.

3. Virtual File System Similar to UNIX in supporting In addition,
Hierarchical directory structure
Directories are treated like files (only the format of the contents of the data-blocks differ)
i-nodes are used to describe directory entries.
In addition,
Files are considered objects that share basic properties regardless of the target file system.
Files have symbolic names that allow them to be uniquely identified
Have owners, protection against unauthorized access or modification …
A mapping module is used to convert the attributes of the file in its native file system to the format of the VFS.

5. Object types in VFS Superblock object
Stores information about the specific file system
Device mounted on, pointer to root of the file system, basic block size, list of open files, list of superblock operations etc.

6. Object types in VFS The Inode Object Exists only in main memory.
A cache of all accessed file and directory i-nodes is maintained.
Holds the attributes of the directory entry
File type, owner, size of data, number of datablocks

7. Object types in VFS Directory Entry Object (dentry)
Exists only in main memory
Held in a dcache (dentry cache)
Constructed as directory entries are accessed from the various underlying file systems
Maintained by the VFS for faster access.

8. Object types in VFS The File Object
Represent a file(or directory) opened by a process.
open(), close() operations
Includes the following:
Dentry object associated with the file.
File system containing the file.
File pointer

9. Accessing a file with VFS
Check to see if a dentry for the file exists in the dcache.
If yes, then find the i-node in the i-node cache and take appropriate action.
If no, map the VFS system call to the system call of the file system that the file exists in.
Access the file information from the file system, perform appropriate action and update the dcache and i-node cache.
In some cases, this may involve having to actually construct the i-node for the dentry.

10. Ext3fs (Third extended file system)
The de-facto Linux file system
Supports basic UNIX operations and structure
In addition,
Supports long file names (upto 255 characters)
Supports larger portion sizes (more than one sector)
Faster symbolic links i.e. the path is stored in the i-node and does not occupy a block on the disk.
Secure deletion of files (man shred)
New types of files such as immutable files can be created (chattr +i filename)
Journaling is enabled
log of all file system changes is maintained
in the event of a system crash can undo or redo actions based on the recorded actions in the log file
The main difference between ext2fs and ext3fs

11. Windows File System
File allocation table used in Windows 95, MS-DOS (FAT12, FAT16, FAT32)
Windows file system (NTFS - New Technology File System ) used in Windows XP

12. Key features of NTFS
NTFS uses clusters(rather than sectors) as units of disk allocation.
Default cluster sizes:
Sector size for volumes up to 512MB
1KB for volumes up to 1GB
2KB for volumes up to 2GB
4KB for larger volumes
Uses logic cluster numbers as disk addresses.
A file is a structured object that has attributes such as name, creation time, security (ACL), data attributes.

13. Key features of NTFS
Security – Each file references a security descriptor
Contains an access token for the owner
Contains an ACL
General indexing facility
Can index file using different attributes e.g. size, date last created, name

14. Key features of NTFS Recoverability
In the event of a crash, NTFS can reconstruct disk volumes to a consistent state.
File system information can be retrieved, not necessarily the data in the files.
Uses transaction processing, where a change is an atomic operation and the change is logged, when (successfully) completed.

15. Recoverability Log each transaction that modifies the volume
Enter transaction in log file (cache)
Perform action on volume (cache)
Write log file to disk
Write volume to disk
In the event of a crash in the midst of a transaction, the log file can be used to redo or undo the transaction.

16. NTFS Volume Layout

17. NTFS metadata files Partition boot sector Maybe more than one sector.
Holds the volume layout, file system structures, boot startup information and code, pointer to MFT(master File Table) and MFT2

18. NTFS volume layout The disk is partitioned into two zones Data-zone
MFT-zone (Master File Table)
About 22% of the sectors
Allows for the MFT to be stored in contiguous locations and hence allows for faster access.
If the data-zone runs out of space, then the space in the MFT-zone may be used.
MFT may become fragmented. The standard de-fragmentation tool cannot de-fragment MFT. (Tools to de-fragment the MFT - Diskeeper, PerfectDisk and O&O Defrag )

19. NTFS Metadata Files
NameMFT
Record
Description
$MFT
Master File Table—NTFS's command central
$MFTMIRR 1
Copy of the first 16 records of the MFT
$LOGFILE 2
Transactional logging file
$VOLUME 3
Contains volume serial number, creation time, and dirty flag
$ATTRDEF 4
Attribute definitions . 5
Root directory of the disk
$BITMAP 6
Contains drive's cluster map (in-use vs. free)
$BOOT 7
Boot record of the drive
$BADCLUS 8
Lists bad clusters on the drive
$QUOTA 9
Contains user quota information—unused before NT 5.0 NTFS
Article from WindowsITPro by Mark Russinovich- Reference # 4

20. NTFS metadata files (occupy about 4MB)
Master File Table
A list of all the contents on the volume (including an entry for the MFT itself.)
Table of variable length records.
Each record is a file or a folder.
Contains the set of attributes that define the file/folder.
May contain the data of the file/folder if the data is small enough.
Else contain pointers to clusters that hold the rest of the data for the file/folder.
Contiguous allocation is used.

21. NTFS metadata files System files MFT2 Log file Cluster bit map
A mirror of the first 16 records (i.e. the 11 metafiles) of the MFT, placed in the middle of the disk partition.
Log file
A list of the transactions used for recovery.
Cluster bit map
Attribute definition table
Defines types of attributes supported
Indicates whether they can be indexed.
Indicated whether they can be recovered.