UNT in partnership with TEA, Copyright ©. All rights reserved1 Computer Maintenance File System Formats

UNT in partnership with TEA, Copyright © . All rights reserved 1

Computer Maintenance

File System Formats

UNT in partnership with TEA, Copyright © . All rights reserved IT: Computer Maintenance - File Systems 2

What Is a File System?

The organizational method used by an OS to store files and folders on a secondary storage device FAT (file allocation table) file system Files and directories File naming conventions File organization Partitions and logical drives on a hard drive


Partitions

• Low-level formatting is done at the factory. It marks off the disk into sectors and cylinders, and defines their placement on the disk.

• FDISK is used to partition a hard drive (high-level).


• When the hard drive is divided into more than one partition, the first partition is referred to as the primary partition and the second is called the extended partition.

• The primary partition is usually the active partition, or the partition Windows refers to during the boot-up process.

• A hard disk can have up to 4 separate primary partitions, or 3 primary and 1 extended.

Partitions (cont.)


• Fat16 can only address a maximum of 2 gigabytes (GB) of hard disk space.

• FAT32 increases the limit to 2 terabytes (TB) of hard disk space.

• Only the primary partition on any hard drive can be designated as active.

• DOS, Windows 95, and Windows 98 can only manage 1 primary partition per hard drive.

• There can be only 1 extended partition per disk.

Partitions (cont.)


• Unlike the primary partition, it can be subdivided into a maximum of 23 sections called logical drives.

• In Windows, in addition to the drive letter, each drive can be assigned a name called a drive label. The drive label can be up to 11 characters long.

Partitions (cont.)


Partitions and Logical Drives on a Hard Drive


• Have you ever wondered what all those little boxes are when you defrag your hard drive? These boxes are clusters; they are storage units on the hard drive.

• This applies mostly to the file systems FAT12, FAT16, and FAT32. FAT Stands for file allocation table.

• FAT12 is only seen on floppy disks and very small storage media, while FAT16 is the older version of FAT from the Windows 95 days, and FAT32 is newer, from the Windows 98 days.

• NT, 2000, XP, Vista, and Windows 7 can use all the FAT file systems, plus the NTFS (New Technology File System)

About Clusters


Files and Directories

A hard drive is organized into groups of files stored in directories. The first directory is called the root directory. All directories can have child directories or sub-directories. In Windows, a directory is called a folder.


The Master Boot Record, created when you create the first partition on the hard disk, is probably the most important data structure on the disk. It is the first sector on every disk.

The location is always track (cylinder) 0, side (head) 0, and sector 1.

The Master Boot Record contains the Partition Table for the disk and a small amount of executable code.

Master Boot Record (MBR)


• On x86-based computers, the executable code examines the Partition Table, and identifies the system partition.

• The Master Boot Record then finds the system partition's starting location on the disk, and loads a copy of its Partition Boot Sector into memory.

• The Master Boot Record then transfers execution to executable code in the Partition Boot Sector.

Note: Although there is a Master Boot Record on every hard disk, the executable code in the sector is used only if the disk is connected to an x86-based computer and the disk contains the system partition.

Master Boot Record (MBR)


Options for the Fdisk Command


Options for the Format Command


File Allocation Table

FAT File System


The File Allocation Table (FAT) file system is a simple file system originally designed for small disks and simple folder structures.

The FAT file system is named for its method of organization, the file allocation table, which resides at the beginning of the volume.

To protect the volume, two copies of the table are kept, in case one becomes damaged. In addition, the file allocation tables and the root folder must be stored in a fixed location so that the files needed to start the system can be correctly located.

FAT File System


FAT File System

A volume formatted with the FAT file system is allocated into clusters.

The default cluster size is determined by the size of the volume.

For the FAT file system, the cluster number must fit in 16 bits and be a power of two.


The way FAT works is that it keeps a record at the start of the drive of all the files, and to point to the files, it points to the clusters that contain the files.

The main rule of clusters is that there cannot be more than 1 file per cluster; otherwise, pointing to that cluster would cause problems, as it would be pointing and doing read/write operations on two files at once, which would cause Windows to crash.

Depending on the size and FAT version of the partition, the cluster size can vary.

Also keep in mind that a section of the partition is reserved for the FAT, which is the record of each file and where it can be found. This changes in size depending on the size of the partition and clusters.

How FAT Works


• FAT32 is a derivative of the File Allocation Table (FAT) file system that supports drives with over 2GB of storage. Because FAT32 drives can contain more than 65,526 clusters, smaller clusters are used than on large FAT16 drives. This method results in more efficient space allocation on the FAT32 drive.

• The largest possible file for a FAT32 drive is 4GB minus 2 bytes.

• The FAT32 file system includes four bytes per cluster within the file allocation table. Note that the high 4 bits of the 32-bit values in the FAT32 file allocation table are reserved and are not part of the cluster number.

FAT32 File System


Each FAT type has its limits; this table displays these limits:

FAT type Max Clusters Cluster sizes Max volume size

FAT12 4,086 0.5 to 4KB16,736,256 bytes

(16MB)

FAT16 65,526 2KB to 32KB2,147,483,648 bytes

(2GB)

FAT32 268,435,456 4KB to 32KB8,796,093,022,208 bytes

(8TB)

FAT Limitations


What is the maximum partition size of a FAT16 drive?

2GB

How can you tell the type of partition used?

Properties

An HS is divided into what?

Sectors

FAT Relationships


Showing FAT16 in the HDD Properties Window

File System Types


Showing FAT32 in the HDD Properties Window

File System Types


Converting FAT16 to FAT32

At the command prompt:Cvt1.exe

This will allow you to convert a FAT16 file system to a FAT32 system without losing any data.

Converting FAT to NTFS At the command prompt:

Convert.exe

This will allow you to convert a FAT16 or FAT32 file system to a NTFS system without losing any data.


New Technology File System

NTFS


NTFS is a high-performance, self-healing file system proprietary to Windows XP and later. Features include

• file-level security, compression, and auditing• support for large volumes and powerful storage

solutions such as built-in RAID support• the ability to encrypt files and folders to protect your

sensitive data• more efficient drive management due to its smaller

cluster size capabilities

• support for very large drives made possible by its 64-bit clustering arrangement

• recoverable file system capabilities

NTFS System Files


• In NTFS volumes, the data fields that follow the BIOS Parameter Block (BPB) form an extended BPB.

• The data in these fields enables Ntldr (the NT loader program) to find the master file table (MFT) during startup.

NTFS System Files


NTFS System Files

• In NTFS volumes, the MFT is not located in a predefined sector, as on FAT16 and FAT32 volumes. For this reason, the MFT can be moved if there is a bad sector in its normal location.

• However, if the data is corrupted, the MFT cannot be located and Windows NT/2000 assumes that the volume has not been formatted.


Windows NT Partitions


The Master File Table allocates a certain amount of space for each file record. The attributes of a file are written to the allocated space in the MFT. Small files and directories (typically 1500 bytes or smaller), such as the file illustrated in the next slide, can be entirely contained within the Master File Table record.

NTFS System Files


NTFS System Files

This design makes file access very fast. Consider, for example, the FAT file system, which uses a file allocation table to list the names and addresses of each file. FAT directory entries contain an index into the file allocation table. When you want to view a file, FAT first reads the file allocation table and assures that it exists. Then FAT retrieves the file by searching the chain of allocation units assigned to the file. With NTFS, as soon as you look up the file, it's there for you to use.


The Organization of anNTFS Disk Volume


Basic NTFSMaster File Table Record


The Master File Table (MFT) replaces the FAT in an MS-DOS compatible system and contains information about each file being stored on the disk. In order of occurrence, this information includes:

• Header information• Standard information• Filename• Security information • Data

Master File Table


The system files produced during the NTFS formatting process include:

0/1. A pair of MFT files (the real one and a shorter backup version) 2. A log file to maintain transaction steps for recovery purposes 3. A volume file that includes the volume name, NTFS version, and other key volume information 4. An attribute definition table file 5. A root filename file that serves as the drive’s root folder


6. A cluster bitmap that represents the volume and shows which clusters are in use 7. The partition boot sector file 8. A bad cluster file containing the locations of all bad sectors identified on the disk 9. A quota table for tracking allowable storage space on the disk for each user 10. An upper case table for converting lowercase characters to Unicode uppercase characters

The system files produced during the NTFS formatting process include:


Windows NT/2000 supports compression on individual files, folders, and entire NTFS volumes. Files compressed on an NTFS volume can be read and written by any Windows-based application without first being decompressed by another program.

NTFS File Compression


The Encrypting File System (EFS) provides the core file encryption technology used to store encrypted files on NTFS volumes. EFS keeps files safe from intruders who might gain unauthorized physical access to sensitive, stored data (for example, by stealing a portable computer or external disk drive).

NTFS File Encryption


Encryption is transparent to the user who encrypted the file; the system automatically decrypts the file or folder when the user accesses it. When the file is saved, encryption is reapplied. Users who are not authorized to access the encrypted files or folders transparently receive an “Access denied” message if they try to open, copy, move, or rename the encrypted file or folder.



Users can invoke EFS features through Windows Explorer or by using a command-line utility called cipher.exe. To use Windows Explorer to encrypt a file, open the File Property Window by right-clicking on the file name. Click Advanced... The Advanced Attributes dialog will be opened, allowing you to mark the file as encrypted.



• Before saving new settings Windows will prompt the user to encrypt only the file or the whole folder. It address a very important issue - while the file itself could be perfectly protected, the application which opens the file may create temporary copies of the file while working with the document.

• The example is Microsoft Word. When the user opens an encrypted document, EFS decrypts it transparently for Word. Then during the work, Word creates a temporary hidden file where it automatically saves the document in the process of editing, and deletes it on the exit. This hidden file presents a real breach in security because it contains user data in plain (not encrypted) form. Encrypting the whole folder instead of only the file solves this problem.





NTFS Cluster Sizes


NTFS Security

The Windows NT file system provides security for each file in the system, as well as supplying complete file access auditing information to the system administrator. NTFS files and folders can have permissions assigned to them whether they are shared or not.

The NTFS system includes security features that enable permission levels to be assigned to files and folders on the disk. These permissions set parameters for activities that users can conduct with the designated file or folder.


Standard NTFS permissions include:

• Read (R) - This permission enables the file or folder to be displayed along with its attributes and permissions.

• Write (W) - This permission enables the user to add files or folders, change file and folder attributes, add data to an existing file, and change display attributes.

• Execute (X) – This permission enables users to make changes to subfolders, display attributes and permissions, as well as to run executable file types.

NTFS File Attributes


NTFS File Attributes (cont.)

• Delete (D) – This permission makes it possible for users to remove files and folders.

• Change Permission (P) - This permission enables users to change permission assignments for files and folders.

• Take Ownership (O) – This permission enables the user to take ownership of the file or folder.


Some combinations of the permissions are woven together in Standard NTFS

file and folder permissions. These include:

• No Access (none). File and Folder level

• Read (RX). File and Folder level

• Change (RWXD). File and Folder level

• Add (WX). Folder level only

• Add & Read (RWX). Folder level (RX) File level

• List (RX). Folder level only

• Full Control (RWXDPO). File and Folder level

NTFS Files Attributes


NTFS5

• Windows 2000 and up features an improved NTFS, referred to as NTFS5 and NTFS6. These versions enable administrators to establish user hard disk quotas limiting the amount of hard drive space users can have access to.

• The NTFS system also offers enhanced system security.

• Windows 2000+ provides an encrypted file system and secure network protocol and authentication standards.


Disk Quotas

Limit how much disk space a user can access

Do not specify the locations of files, just the total space allowed

Can be set only if you are using NTFS


Windows allows you to choose between two types of logical disks: Basic or Dynamic

There are five different types of dynamic volumes:

• Simple• Spanned• Mirrored• Striped• RAID 5

Windows Volumes


Basic Disks

Before Win2K, Windows operating systems used only basic disks which date back to Windows 9x and have a fairly respectable past. Microsoft designed the basic disk to support future Windows products. In essence, a basic disk contains basic volumes such as primary partitions, extended partitions, and logical drives.


Basic Disks

When you use basic disks, you're limited to creating four primary partitions per disk, or three primary partitions and one extended partition with unlimited logical drives.


Basic Disks

Although these limitations are real, they aren't as severe as you might think. Basic and dynamic disks differ in the number of partitions (on basic disks) and volumes (on dynamic disks) that each can contain.

Basic disks also use the partition tables (stored in the Master Boot Record at the beginning of the disk) that Windows XP, Win2K, NT 4.0, Windows Me, Win9x, and MS-DOS support.


Basic Disks

To make matters more confusing, basic disk volumes also include support for multidisk volumes—such as volume sets, stripe sets, mirror sets, and stripe sets with parity—created in NT 4.0 or earlier (XP doesn't support these multidisk basic volumes but Win2K does).


Dynamic Disks

The limitations of basic disks and other inconveniences drove the creation of a new type of disk definition for Windows systems, the dynamic disk. Windows XP Professional Edition and Win2K support dynamic disk storage. When you initialize a physical disk as dynamic, it's called a dynamic disk and contains dynamic volumes, such as simple volumes, spanned volumes, striped volumes, mirrored volumes, and RAID 5 volumes.


Dynamic Disks

Dynamic disk storage is divided into volumes instead of partitions. Dynamic storage lets you manage disks and volumes without restarting Windows.

Differentiating storage types (i.e., basic and dynamic disks) from file-system types (i.e., FAT, FAT16, FAT32, and NTFS), and from partitions and volumes is important. Storage types are different from file-system types.


Dynamic Disks

On a basic disk, a partition is a portion of the disk that functions as a physically separate unit. A physical disk unit can contain any combination of storage types. However, all volumes on the same disk must use the same storage type. A volume is a storage unit derived from free space on one or more dynamic disks.

You can format both partitions and volumes with a file system (such as NTFS) and assign a drive letter. Volumes also have different layouts (e.g., simple, spanned, striped) and characteristics.


Dynamic Disks

Basic disks used to provide different layout types (e.g., spanned, mirrored, RAID 5) with partitions. However, XP Pro, Win2K, and the Win.NET Server provide these layouts in dynamic disk volumes. Unfortunately, laptop computers and XP Home Edition based computers don't support dynamic disks.


Dynamic Disks

Other dynamic disk limitations include a lack of support for removable storage devices (i.e., IEEE 1394 FireWire and USB-attached disks)


Dynamic Disks

Dynamic disks introduced the concept of disk groups. VERITAS Software has performed a lot of storage-management work for Microsoft, and VERITAS's Logical Disk Manager (LDM) Pro for Windows heavily uses disk groups.


Dynamic Disks

Disk groups (collections of disks organized as entities) help administrators prevent data loss by organizing dynamic disks. All dynamic disks within a disk group store configuration data for the entire group (this data is stored in a 1MB region at the end of each dynamic disk).


Dynamic Disks

All configuration information for simple, spanned, mirrored, striped, or RAID 5 volumes within a disk group is stored on each disk in the group.

This "database" of configuration information is replicated and kept up-to-date across all dynamic disks in the group. If you lose a dynamic disk or you move the disk group to another system, the OS maintains the configuration information for the disk group.


Dynamic Disks

Win2K systems allow only one disk group (Disk Group 0—DG0) per computer (unless you use LDM Pro). Microsoft will probably extend this disk-group functionality in future Windows releases.


Disk ManagementTo open Disk Management1.Click Start, and then Control Panel2.Click Performance and Maintenance3.Click Administrative Tools4.Double-click Computer Management5.In the console tree, click Disk Management


Disk Management

You must be logged on as an administrator or a member of the Administrators group in order to complete this procedure. If your computer is connected to a network, network policy settings may also prevent you from completing this procedure.

You cannot format the system or boot partition. Compression is supported only on NTFS volumes. Quick Format removes files from the disk, but does

not scan the disk for bad sectors. Use this option only if this disk has been previously formatted and you are sure the disk is not damaged.


As an example we'll use the following disk layout:

Here we have two primary partitions (C: and H:), and one extended that has two logical drives (D: and E:).

Partition Recovery Concepts


NTFS vs. FAT

Criteria NTFS5 NTFS FAT32 FAT16

Operating System

Windows 2000,

Windows XP

Windows NT,

Windows 2000,

Windows XP

Windows 98,Windows

ME,Windows

2000,Windows XP

DOS,All versions

of Microsoft Windows



Limitations

Max Volume Size

256TB 256TB 2TB 2GB

Max Files on Volume

Nearly Unlimited

Nearly Unlimited

Nearly Unlimited

~65000

Max File SizeLimited by

Volume SizeLimited by

Volume Size4GB 2GB

Max Clusters Number

Nearly Unlimited

Nearly Unlimited

268435456 65535

Max File Name Length

Up to 255 characters



Standard – 8.3Extended – up

to 255

NTFS vs. FAT



File System Features

Unicode File Names

Unicode Character Set

Unicode Character Set

System Character Set

System Character Set

System Records Mirror

MFT Mirror File

MFT Mirror File

Second Copy of FAT

Second Copy of FAT

Boot Sector Location

First and Last Sectors

First and Last Sectors

First Sector First Sector

File AttributesStandard and

CustomStandard and

CustomStandard Set Standard Set

Alternate Streams

Yes Yes No No

Compression Yes Yes No No

NTFS vs. FAT



File System Features

Encryption Yes No No No

Object Permissions

Yes Yes No No

Disk Quotas Yes No No No

Sparse Files Yes No No No

Reparse Points

Yes No No No

Volume Mount Points

Yes No No No

NTFS vs. FAT



Overall Performance

Built-In Security Yes Yes No No

Recoverability Yes Yes No No

PerformanceLow on small

volumes,High on Large

Low on small volumes,

High on Large

High on small volumes,

Low on large

Highest on small volumes,Low on large

Disk Space Economy

Max Max AverageMinimal on

large volumes

Fault Tolerance Max Max Minimal Average

NTFS vs. FAT


Partition Recovery


For the machine to be able to start booting properly, the following conditions should apply:

• The Master Boot Record (MBR) exists and is safe. • The Partition Table exists and contains at least one active

partition.• If so, the executable code in the MBR selects an active

partition and passes control there; thus it can start loading proper files (COMMAND.COM, NTLDR, ... ) depending on the file system type in that partition. However, if these files are missing or corrupted then the OS will be unbootable – remember the famous error "NTLDR is missing ..." ?



For the partition/drive to be visible to the Operating System, the following conditions should apply:

• The Partition/Drive can be found via Partition Table • The Partition/Drive boot sector is safe• If so, the OS can read the partition/drive parameters and

display the drive in the list of the available drives. However, if the file system itself is damaged (Root, FAT area on FAT12/FAT16/FAT32, or system MFT records on NTFS), the drive's content might not be displayed and we might see errors like "MFT is corrupted“ or "Drive is invalid."



• The simplest way to repair or re-create the MBR is to run Microsoft's standard utility called FDISK with a parameter /MBR, like

A:\> FDISK.EXE /MBR(This is a standard utility that is included with MS-DOS, Win95, Win98, and WinME)

• If you have Windows NT / 2000 / XP, you can boot from the startup floppy disks or CD-ROM; choose the repair option during setup, and run Recovery Console. When you are logged on, you can run the FIXMBR command to fix the MBR.


Documents

UNT in partnership with TEA, Copyright ©. All rights reserved1 Computer Maintenance File System Formats