Page 388 - DCAP103_Principle of operating system

Unit 13: Input/Output and Security of Windows

terminology), with the block size being fixed for each volume and ranging from 512 bytes Notes
to 64 KB, depending on the volume size. Most NTFS disks use 4 KB blocks as a compromise
between large blocks (for efficient transfers) and small blocks (for low internal fragmentation).
Blocks are referred to by their offset from the start of the volume using 64 bit numbers.
The main data structure in each volume is the MFT (Master File Table), which is a linear
sequence of fixed-size 1 KB records. Each MFT record describes one file or directory. It contains
the file’s attributes, such as its name and timestamps, and the list of disk addresses where its
blocks are located. If a file is extremely large, it is sometimes necessary to use two or more MFT
records to contain the list of all the blocks, in which case the first MFT record, called the base
record, points to the other MFT records. This overflow scheme dates back to CP/M, where
each directory entry was called an extent. A bitmap keeps track of which MFT entries are free.
The MFT is itself a file and as such can be placed anywhere within the volume, thus eliminating
the problem with defective sectors in the first track. Furthermore, the file can grow as needed,
up to a maximum size of 2 records.
48
The MFT is shown in Figure. 13.5. Each MFT record consists of a sequence of (attribute header,
value) pairs. Each attribute begins with a header telling which attribute this is and how long the
value is because some attribute values are variable length, such as the file name and the data.
If the attribute value is short enough to fit in the MFT record, it is placed there. If it is too long,
it is placed elsewhere on the disk and a pointer to it is placed in the MFT record.
The first 16 MFT records are reserved for NTFS metadata files, as shown in Figure 13.5. Each of
the records describes a normal file that has attributes and data blocks, just like any other file.
Each of these files has a name that begins with a dollar sign to indicate that it is a metadata file.
The first record describes the MFT file itself. In particular, it tells where the blocks of the MFT
file are located so the system can find the MFT file. Clearly, Windows 2000 needs a way to find
the first block of the MFT file in order to find the rest of the file system information. The way
it finds the first block of the MFT file is to look in the boot block, where its address is installed
at system installation time.

Figure 13.5: The NTFS Master File Table

1KB

16 First user file
15 (Reserved for future use)
14 (Reserved for future use)
13 (Reserved for future use)
(Reserved for future use)
12
11 $Extend Extentions: quotas, etc
$Upcase Case conversion table
10
$Secure Security descriptors for all files
9
$BadClus List of bad blocks Metadata files
8
$Boot Bootstrap loader
7
$Bitmap Bitmap of blocks used
6
$ Root directory
5 $AttrDef Attribute definitions
4 $Volume Volume file
3 $LogFile Log file to revoery
2 $MftMirr Mirror copy of MFT
1 $Mft Master File Table

LOVELY PROFESSIONAL UNIVERSITY 381