Page 393 - DCAP103_Principle of operating system

Principles of Operating Systems

Notes Large directories use a different format. Instead of listing the files linearly, a B+ tree is used to
make alphabetical lookup possible and to make it easy to insert new names in the directory in
the proper place.
13.2.5 File Name Lookup

We now have enough information to see how file name lookup occurs. When a user program
wants to open a file, it typically makes a call like CreateFile(“C:\maria\web.htm”, …)
This call goes to the user-level shared library, kernel32.dll where \?? is pre-pended to the file
name giving
\??\C:\maria\web.htm
It is the name that is passed as a parameter to the system call NtFileCreate.
Then the operating system starts the search at the root of the object manager’s name space. It
then looks in the directory \?? to find C:, which it will find. This file is a symbolic link to another
part of the object manager’s name space, the directory \Device. The link typically ends at an
object whose name is something like \Device\HarddiskVolume1. This object corresponds to
the first partition of the first hard disk. From this object it is possible to determine which MFT
to use, namely the one on this partition. These steps are shown in Figure 13.10.

Figure 13.10: Steps in Looking up the File C:\maria\web.htm

The parsing of the file name continues now at the root directory, whose blocks can be found
from entry 5 in the MFT. The string “maria” is now looked up in the root directory, which
returns the index into the MFT for the directory maria. This directory is then searched for the
string “web.htm”. If successful, the result is a new object created by the object manager. The
object, which is unnamed, contains the index of the MFT record for the file. A handle to this
object is returned to the calling process. On subsequent ReadFile calls, the handle is provided,
which allows the object manager to find the index and then the contents of the MFT record for
the file. If a thread in a second process opens the file again, it gets a handle to a new file object.
In addition to regular files and directories, NTFS supports hard links in the UNIX sense, and
also symbolic links using a mechanism called reparse points. It is possible to tag a file or
directory as a reparse point and associate a block of data with it. When the file or directory is
encountered during a file name parse, exception processing is triggered and the block of data
is interpreted. It can do various things, including redirecting the search to a different part of
the directory hierarchy or even to a different partition. This mechanism is used to support both
symbolic links and mounted file systems.

386 LOVELY PROFESSIONAL UNIVERSITY