Windows OS File system

A file system gives an operating system a road map to data on a disk. The type of file system an operating system uses will determine how data is stored on the disk. As Windows operating system is one of the most popular OS, let us take a look at its file systems. 

Terminology

When discussing file systems, there are various terms for referring to certain concepts, and so it is necessary to understand these terms properly to learn about a file system. 

Disk: It is a permanent storage medium of a certain size. 

Sector: A sector is the smallest physical storage unit on the disk, which is the minimum unit that the disk can read or write. The sector size of most hard disks is 512 bytes.

Cluster: Sectors are grouped to form clusters, which are storage allocation units of one or more consecutive sectors. Clusters are typically 512, 1024, 2048, 4096, or more bytes each. 

Partition: A partition is a logical drive. For example, an 8 GB hard disk might contain four partitions or logical drives. 

Volume:  This term is used to refer to a disk or partition that has been initialized with a file system. A volume may be all of the sectors on a single disk, some portion of the total number of sectors on a disk, or it may even span multiple disks and be all the sectors on several disks.

Metadata: Metadata refers to information that is about something but not directly part of it. For example, the size of a file is a very important information about a file, but it is not part of the data in the file. 

Journaling: It is a method of insuring the correctness of file system metadata even in the presence of power failures or unexpected reboots.

Attribute: It is a name and value associated with the name. The value may have a defined type (string, integer, etc.), or it may just be arbitrary data. 

Overview of FAT (File Allocation Table)

File Allocation Table (FAT) is the file structure database that Microsoft originally designed for floppy disks. FAT is used on file systems before Windows NT and 2000. It is by far the most simplistic of the file systems supported by Windows NT. 

The FAT file system is characterized by the file allocation table (FAT), which is an index table that resides at the beginning of the volume to identify the chains of data storage areas associated with a file. In order to protect the volume, two copies of the FAT are kept in case one becomes damaged. 

Variants of FAT

Each entry in the FAT list is a fixed number of bits and the successive major variants of the FAT format are named after the number of table element bits: 12 (FAT12), 16 (FAT16), and 32 (FAT32).

FAT12: This version is used specifically for floppy disks, so it has a limited amount of storage space. It was originally designed for MS-DOS 1.0, the first Microsoft OS, used for floppy disk drives and drives up to 16 MB. 

FAT16: To handle large disks, Microsoft developed FAT16, which is still used on older Microsoft OSs. FAT16 supports disk partitions with a maximum storage capacity of 2 GB. 

FAT32: When disk technology improved and disks larger than 2 GB were created, Microsoft developed FAT32, which is used on Microsoft OSs such as Windows 95 (second release), 98, Me, 2000, XP, and Vista. FAT32 can access up to 2 TB of disk storage. One disk can have multiple partitions in FAT16, FAT32, or NTFS.

File Allocation System

A disk formatted with FAT is allocated in clusters, whose size is determined by the size of the volume. When a file is created, an entry is created in the directory and the first cluster number containing that data is established.

There is no organization to the FAT folder structure, and files are given the first available location on the volume. The starting cluster number indicates the address of the first cluster used by the file. Each cluster contains a pointer to the next cluster in the file, or an indication that this cluster is the end of the file.

The root folder contains an entry for each file and folder on the root. The only difference between the root folder and other folders is that the root folder is on a specified location on the disk and has a fixed size.

The FAT database contains filenames, directory names, date and time stamps, the starting cluster number, and file attributes (It has only four attributes, namely, archive, hidden, system, and read-only). 

One disadvantage of FAT file system is that it is not possible to set permissions on files that are FAT partitions. Moreover, such partitions are limited in size to a maximum of 4 Gigabytes (GB) under Windows NT and 2 GB in MS-DOS.

Overview of NTFS

New Technology File System (NTFS) was introduced when Microsoft created Windows NT. Each generation of Windows since NT has included minor changes in NTFS configuration and features. 

NTFS offers significant improvements over FAT file systems through a combination of performance, reliability, and compatibility not found in the FAT file system:

• NTFS provides more information about a file than FAT file systems. Formatting a volume with the NTFS file system results in the creation of several system files (metadata) such as $MFT (Master File Table), $Bitmap, $LogFile and others, which contains information about all the files and folders on the NTFS volume.

• It is capable of performing standard file operations such as read, write, and search much quicker and even advanced operations such as file-system recovery  on very large hard disks.

• The NTFS file system includes security features required for file servers and high-end personal computers in a corporate environment.

• The NTFS file system also supports data access control and ownership privileges that are important for the integrity of critical data. NTFS files and folders can have permissions assigned whether they are shared or not and it is the only file system on Windows NT that allows a user to assign permissions to individual files.

• NTFS has a journaling system wherein the system keeps track of transactions such as file deleting or saving. This journaling feature is helpful because it records a transaction before the system carries it out. That way, in a power failure or other interruption, the system can complete the transaction or go back to the last good setting. 

• Everything on the volume is a file and everything in a file is an attribute, from the data attribute, to the security, to the file name attribute. Every sector on an NTFS volume that is allocated belongs to some file.

Partition Boot Sector 

The first information on an NTFS volume is the Partition Boot Sector ($Boot metadata file), which starts at sector 0 and can be up to 16 sectors long. This file describes the basic NTFS volume information and a location of the main metadata file — $MFT.

Master File Table

Immediately after the Partition Boot Sector is the Master File Table (MFT) and an MFT file is created at the same time a disk partition is formatted as an NTFS volume. Each file on the volume is represented by a record in the master file table (MFT). However, the first 16 records of the table are reserved for special information, which describes the master file table itself. This is then followed by a MFT mirror record, so that, if ever the first MFT record is corrupted, NTFS can refer to this MFT mirror file.

The master file table allocates a certain amount of space for each file record. The attributes of a file are written to the allocated space in the table. In case of small files, about 512 bytes or lesser, even the file data is also stored in the MFT record. These types of records are also known as resident files since all their information are stored in the MFT record. However, in case of larger files, they are stored outside the MFT, and are thus known as nonresident files because the file’s data is stored in its own separate file outside the MFT. This design thus makes accessing the file really easy and quick.