A File System for the 21st Century Previewing the Windows NT 50 File System.docx

1、A File System for the 21st Century Previewing the Windows NT 50 File SystemA File System for the 21st Century: Previewing the Windows NT 5.0 File SystemJeffrey Richter and Luis Felipe CabreraBecause of the way NTFS stores attributes, it is possible for all of the attributes of a single file, includi

2、ng its Data attribute, to be resident. This improves performance when accessing small files. NTFS also stores the most common attributes of a file in the files directory entry.This article assumes youre familiar with C+ and Win32Code for this article: Nov98NTFS.exe (5KB)Jeffrey Richter wrote Advance

3、d Windows, Third Edition (Microsoft Press, 1997) and Windows 95: A Developers Guide (M&T Books, 1995). Jeff can be reached at www.JeffreyR. Luis Felipe Cabrera is an architect in the Windows NT Base Development group at Microsoft. His responsibilities are in Windows NT 5.0 storage management.Many of

4、 your programming tasks will be simplified when you take advantage of the new innovations in the Windows NT 5.0 file system (NTFS). Lets go on a whirlwind tour of these new features. Remember, we are discussing software that is in beta, so everything is subject to change. Please check Microsofts mos

5、t recent documentation before writing any code based on this information. Lets begin with an overview of the NTFS file system layout on disk. While this information is programmatically off-limits to the application developer, a high-level explanation will make it much easier for you to understand ma

6、ny of the new NTFS features. At the heart of the NTFS file system is a special file called the master file table (MFT). This file is created when you format a volume for NTFS. The MFT consists of an array of 1KB entries; each entry identifies a single file on the volume. When you create a file, NTFS

7、 must first locate an empty entry within the MFT array (growing the array if necessary); then it fills the 1KB entry with information about the file. A files information consists of a collection of attributes. Figure 1 shows a list of standard attributes that can be associated with a single file (or

8、 directory). When a file is created, the system creates the set of attributes for the MFTs file entry and attempts to place them inside the 1KB block. But there are two problems: most attributes are variable length, and many attributes (like Name, Data, and Named Data) can be much larger than 1KB. S

9、o NTFS cant just simply throw all the attributes inside an MFT entry. Instead, NTFS must examine the attributes; if the length of an attributes value is small, the attributes value is placed inside the MFT entry. This is called a resident attribute. If the attributes value is large, then the system

10、places the attribute value in another location on the disk (making this a nonresident attribute), and simply places a pointer to the attributes value inside the MFT entry. Today, everybody has lots and lots of small files stored throughout their hard drives. We all have lots of shortcut (.LNK) files

11、 and probably lots of DESKTOP.INI files sprinkled around. Because of the way that NTFS stores attributes in an MFT entry, it is possible for all of the attributes of a single file, including its Data attribute, to be resident. This greatly improves performance when accessing small files. In addition

12、, NTFS also stores the most common attributes of a file in the directory entry that represents the file. This means that when the system does a FindFirstFile/FindNextFile operation to retrieve a files name or basic attributes, the data for these attributes is found in the directory entry, so no othe

13、r disk access is needed. Prior to Windows NT 4.0, an MFT entry in NTFS was 4KB in size. This, of course, allowed files with slightly more data to have their data resident. In Windows NT 4.0, Microsoft pared the size of an MFT entry to 1KB. Microsoft studied the number of files and their sizes on man

14、y typical systems and saw that NTFS was wasting a lot of space in MFT entries and that it would be more efficient to make the MFT entry 1KB. Now lets go over some of the features offered by NTFS that software developers can (and should) take advantage of.StreamsIts little known that NTFS allows a si

15、ngle file to have multiple data streams. This feature has actually been in NTFS since its very first version (in Windows NT 3.1) but has been downplayed by Microsoft. This is unfortunate because streams can be incredibly useful in many situations. For instance, lets say that you are developing a bit

16、map-editor application. When the user saves their data, you create a BMP file on the hard disk. Youd also like to store a thumbnail version of the image as well. Thumbnails are typically stored at the end of a file, after the main bitmap image. To show the thumbnail image, you must open the file, pa

17、rse the header information, seek to the bytes following the main images data, read in the thumbnail images data, and then display the thumbnail. You could store the thumbnail data in a separate file, but its not a good idea because its too easy for the main image file and the thumbnail file to get s

18、eparated. An NTFS named stream offers the best of both worlds. When your application creates its file, you can write the main images data to the default (unnamed) stream and then create another (named) data stream inside the same file for the thumbnail images data. You have only one file, but it con

19、tains two data streams. To understand how this works, lets perform an experiment. On a Windows NT-based machine (any version) open a command shell. Then change to an NTFS partition and enter the following: C:ECHO Hi Reader XX.TXT:MyStreamWhen you execute this command, the system creates a file calle

20、d XX.TXT. This file contains two streams: an unnamed stream that contains 0 bytes and a named stream (called MyStream) that contains the text Hi Reader. If you havent guessed by now, you access a files named stream by placing a colon after the file name followed by the name of the stream. As with fi

21、le names, Win32 functions treat stream names as case-preserved and searches are case- insensitive. Unfortunately, the tools supplied with the system treat streams as second class citizens at best. For example, execute the following command: C:DIR XX.TXT Volume in drive C is Wizard Volume Serial Numb

22、er is 40E5-92D4 Directory of C: 03/18/98 08:36a 0 XX.TXT 1 File(s) 0 bytes 0 Dir(s) 3,399,192,576 bytes freeAs you can see, DIR reports that the file size is 0 bytes, but this is not true. The DIR command only reports to the user the size of a files unnamed stream; the sizes of named streams within

23、the file are not shown to the user. By the way, Explorer also reports a file size of 0 bytes. This allows for some geeky party games where you can allocate a large stream in a file on a friends disk. The friend wont be able to discover where all the disk space has gone because all of the tools repor

24、t that the file occupies only 0 bytes! When working with streams, remember that its only the tools that dont treat streams with the respect that they deserve; NTFS has full support for streams (they even count against your storage quota). Now, to see the contents of the stream, execute this command:

25、 C:MORE XX.TXT:MyStream Hi Reader Heres another way to use streams. Say that you are writing a word-processing application. When the user opens up an existing document, you will probably create a temporary file that holds all of the users changes. Then, when the user decides to save the changes, you

26、 will write all of the updated information to the temporary file, delete the original file, and finally move the temporary file back to the original files location while renaming the file. This sounds fairly simple and straightforward, but youre probably forgetting a few things. The final file shoul

27、d have the same creation timestamp as the original, so youll have to fix that. The final file should also have the same file attributes and security information as the original. It is very easy to miss properly updating some of these attributes during this file-save operation. If you use streams, al

28、l of these problems go away. All streams within a single file share the files attributes (timestamp, security, and so on). You should revise your application so that the users temporary information is written to a named stream within the file. Then, when the user saves the data, rename the temporary

29、 named data stream to the unnamed data stream, and NTFS will delete the old unnamed data stream and do the rename in an all-or-nothing manner. You wont have to do anything to the files attributes at all; theyll all just be the same. Before we leave streams, let us just point out a few more things. F

30、irst, if you copy a file containing streams to a file system that doesnt support streams (like the FAT file system used on floppy disks), only the data in the unnamed stream is copied over; the data in any named streams does not get copied. Second, named data streams can also be associated with a di

31、rectory. Directories never have an unnamed data stream associated with them but they certainly can have named streams. Some of you may be familiar with the DESKTOP.INI file used by the Explorer. If the Explorer sees this file in a directory, it knows to load a shell namespace extension and allows th

32、e shell namespace extension to parse the contents of the directory. The system uses this for folders such as My Documents, Fonts, Internet Channels, and many more. Since the DESKTOP.INI file describes how the Explorer should display the contents of a directory, wouldnt it make more sense for Microsoft to place the DESKTOP.INI data into a named stream within a directory? The reason Microsoft doesnt do this is backward compatibility. Streams are implemented only on NTFS drives; they do not exist on FAT file systems or on CD-ROM drives. For