Page 392 - DCAP103_Principle of operating system

Unit 13: Input/Output and Security of Windows

high-order zero-bytes. These can be omitted. The data header tells how many are omitted, that Notes
is, how many bytes are actually used per address. Other kinds of compression are also used. In
practice, the pairs are often only 4 bytes.
Our first example was easy—all the file information fit in one MFT record. What happens if the
file is so large or highly fragmented that the block information does not fit in one MFT record?
The answer is simple—use two or more MFT records. In Figure 13.8 we see a file whose base
record is in MFT record 102. It has too many runs for one MFT record, so it computes how
many extension records it needs, say, two, and puts their indices in the base record. The rest of
the record is used for the first k data runs.
Figure 13.8: A File that Requires Three MFT Records to Store All Its Runs

Note that Figure 13.8 contains some redundancy. In theory, it should not be necessary to specify
the end of a sequence of runs because this information can be calculated from the run pairs.
The reason for “overspecifying” this information is to make seeking more efficient: to find the
block at a given file offset, it is only necessary to examine the record headers, not the run pairs.
When all the space in record 102 has been used up, storage of the runs continues with MFT
record 105. As many runs are packed in this record as fit. When this record is also full, the rest
of the runs go in MFT record 108. In this way many MFT records can be used to handle large
fragmented files.
A problem arises if so many MFT records are needed that there is no room in the base MFT to
list all their indices. There is also a solution to this problem: the list of extension MFT records
is made nonresident (i.e., stored on disk instead of in the base MFT record). Then it can grow
as large as needed.
An MFT entry for a small directory is shown in Figure 13.9. The record contains a number of
directory entries, each of which describes one file or directory. Each entry has a fixed-length
structure followed by a variable-length file name. The fixed part contains the index of the MFT
entry for the file, the length of the file name, and a variety of other fields and flags. Looking for
an entry in a directory consists of examining all the file names in turn.

Figure 13.9: The MFT Record for a Small Directory

LOVELY PROFESSIONAL UNIVERSITY 385