Day 28
File System
File systems under Linux

Virtual File System (VFS)


Provides support for a variety of file management
systems and file structures.
Provides a single, uniform interface to all user
processes.
Virtual File System


Similar to UNIX in supporting
 Hierarchical directory structure
 Directories are treated like files (only the format of the contents of
the data-blocks differ)
 i-nodes are used to describe directory entries.
In addition,
 Files are considered objects that share basic properties
regardless of the target file system.



Files have symbolic names that allow them to be uniquely identified
Have owners, protection against unauthorized access or modification
…
A mapping module is used to convert the attributes of the file in
its native file system to the format of the VFS.
Object types in VFS

Superblock object

Stores information about the specific file system

Device mounted on, pointer to root of the file system,
basic block size, list of open files, list of superblock
operations etc.
Object types in VFS

The Inode Object



Exists only in main memory.
A cache of all accessed file and directory i-nodes
is maintained.
Holds the attributes of the directory entry

File type, owner, size of data, number of datablocks
Object types in VFS

Directory Entry Object (dentry)




Exists only in main memory
Held in a dcache (dentry cache)
Constructed as directory entries are accessed
from the various underlying file systems
Maintained by the VFS for faster access.
Object types in VFS

The File Object



Represent a file(or directory) opened by a
process.
open(), close() operations
Includes the following:



Dentry object associated with the file.
File system containing the file.
File pointer
Accessing a file with VFS




Check to see if a dentry for the file exists in the
dcache.
If yes, then find the i-node in the i-node cache and
take appropriate action.
If no, map the VFS system call to the system call of
the file system that the file exists in.
Access the file information from the file system,
perform appropriate action and update the dcache
and i-node cache.

In some cases, this may involve having to actually
construct the i-node for the dentry.
Ext3fs (Third extended file
system)



The de-facto Linux file system
Supports basic UNIX operations and structure
In addition,
 Supports long file names (upto 255 characters)
 Supports larger portion sizes (more than one sector)
 Faster symbolic links i.e. the path is stored in the i-node and
does not occupy a block on the disk.
 Secure deletion of files (man shred)
 New types of files such as immutable files can be created (chattr
+i filename)
 Journaling is enabled



log of all file system changes is maintained
in the event of a system crash can undo or redo actions based on the
recorded actions in the log file
The main difference between ext2fs and ext3fs
Windows File System


File allocation table used in Windows 95, MSDOS (FAT12, FAT16, FAT32)
Windows file system (NTFS - New
Technology File System ) used in Windows
XP
Key features of NTFS

NTFS uses clusters(rather than sectors) as units of
disk allocation.



Default cluster sizes:
 Sector size for volumes up to 512MB
 1KB for volumes up to 1GB
 2KB for volumes up to 2GB
 4KB for larger volumes
Uses logic cluster numbers as disk addresses.
A file is a structured object that has attributes such
as name, creation time, security (ACL), data
attributes.
Key features of NTFS

Security – Each file references a security
descriptor



Contains an access token for the owner
Contains an ACL
General indexing facility

Can index file using different attributes e.g. size,
date last created, name
Key features of NTFS

Recoverability

In the event of a crash, NTFS can reconstruct disk
volumes to a consistent state.


File system information can be retrieved, not
necessarily the data in the files.
Uses transaction processing, where a change is
an atomic operation and the change is logged,
when (successfully) completed.
Recoverability

Log each transaction that modifies the
volume
1.
2.
3.
4.

Enter transaction in log file (cache)
Perform action on volume (cache)
Write log file to disk
Write volume to disk
In the event of a crash in the midst of a
transaction, the log file can be used to redo
or undo the transaction.
NTFS Volume Layout
NTFS metadata files

Partition boot sector


Maybe more than one sector.
Holds the volume layout, file system structures, boot
startup information and code, pointer to MFT(master
File Table) and MFT2
NTFS volume layout

The disk is partitioned into two zones


Data-zone
MFT-zone (Master File Table)



About 22% of the sectors
Allows for the MFT to be stored in contiguous
locations and hence allows for faster access.
If the data-zone runs out of space, then the space in
the MFT-zone may be used.

MFT may become fragmented. The standard defragmentation tool cannot de-fragment MFT. (Tools to defragment the MFT - Diskeeper, PerfectDisk and O&O
Defrag )
NTFS Metadata Files
NameMFT
Record
Description
$MFT
0
Master File Table—NTFS's command central
$MFTMIRR
1
Copy of the first 16 records of the MFT
$LOGFILE
2
Transactional logging file
$VOLUME
3
Contains volume serial number, creation time, and dirty flag
$ATTRDEF
4
Attribute definitions
.
5
Root directory of the disk
$BITMAP
6
Contains drive's cluster map (in-use vs. free)
$BOOT
7
Boot record of the drive
$BADCLUS
8
Lists bad clusters on the drive
$QUOTA
9
Contains user quota information—unused before NT 5.0 NTFS
Article from WindowsITPro by Mark RussinovichReference # 4
NTFS metadata files (occupy
about 4MB)

Master File Table



A list of all the contents on the volume (including an entry
for the MFT itself.)
Table of variable length records.
Each record is a file or a folder.
 Contains the set of attributes that define the file/folder.


May contain the data of the file/folder if the data is
small enough.
Else contain pointers to clusters that hold the rest of
the data for the file/folder.

Contiguous allocation is used.
NTFS metadata files

System files




MFT2
 A mirror of the first 16 records (i.e. the 11 metafiles) of the
MFT, placed in the middle of the disk partition.
Log file
 A list of the transactions used for recovery.
Cluster bit map
Attribute definition table
 Defines types of attributes supported
 Indicates whether they can be indexed.
 Indicated whether they can be recovered.