Hindsight in filesystem design

By -

NT4 (NTFS 1.2) did not store numbers of MFT records. If MFT became fragmented, it appeared that there are millions of file records linked in the tree based on the record numbers. However, it was difficult to establish what number belonged to what record. Algorithms for detecting record numbers were complex, unstable, and requiring a lot of resources. Starting with Windows XP, the MFT entry number is stored inside the entry itself that, as it was planned, had to facilitate data recovery. 

When the volume was updated, for example, when a volume created in NT4 was connected to Windows XP for a first time, all records remained in the old format, without numbers. Records were brought into a new format only when a file, which the records referred to, was changed. So, we were encountering hybrid volumes over the several years thereafter. When at last, users ceased to format disks using NT4, all the records were numbered and data recovery software eventually stopped to support the old NTFS version.

The old ext2 implementation has the similar quirk when a superblock did not contain the number of group to which the superblock belonged to. Thus, the redundancy that designers have planned to have could not be used. The reason is that in case of the failure of the first superblock it was possible to find all the remaining superblocks, but even knowing all superblocks it was impossible to detect the first one. Therefore there was no chance to know where the files were. In the newer version of ext2 a superblock contains the numbers of groups that simplifies data recovery significantly.

Comments

Post a Comment

Popular posts from this blog

QNAP revisited

By Geek -
For reference, we were using QNAP TS-639 Pro with six WD20EADS disks. After about half a year of use, the web-interface was running slower, so that we needed to wait for several minutes to obtain the list of the disks. Gradually, we noted that the array performance decreased significantly. It seemed obvious to assume that one of the member disks has been dropped from the array and a RAID5 was working in the degraded mode. However, all the member disks were marked as GOOD in the web-interface. It was suspicious that LEDs on the disk bays indicating the state and activity of the disks were blinking unevenly. Logically, for RAID5 one should expect almost symmetric load on the disks, but in fact, one of the disk LED was blinking much more frequently. Once we had run the bad blocks check on this disk through the web-interface, the disk dropped from the array in less than half an hour and its bay LED turned red. At this point, the web-interface began to work properly again. The disk taken fr
Read more

APFS Data Recovery

By -
Apple File System, APFS for short, is a brand-new filesystem released in 2017. The goal is to replace HFS+ which has been in use on Apple computers since 1998. Formally released in late 2017, APFS filesystem began to be used by default on Apple computers running under MacOS High Sierra. Among the main features of APFS filesystem are 64-bit pointers allowing to address 2^56 blocks More accurate created/accesses/modification time measured in nanoseconds since 1970-01-01 Copy-on-write Sharing blocks between APFS volumes Native full-disk encryption We are happy to announce that now ReclaiMe data recovery software is capable of recovering data from APFS-formatted devices be it a USB thumb drive, or external hard drive, or internal SSD boot drive. You can download the latest build of ReclaiMe at www.ReclaiMe.com .
Read more