NTFS is based on the Windows NT operating system, which is called "NT File System", Chinese meaning is NT file system, and now is the main partition format in the Windows class operating system. Its advantages are extremely safe and stability, which is not easy to generate file fragments in use, and the NTFS partition has made very strict restrictions on user rights. Each user can only follow the authority given by the system, any trial. The operation will be prohibited by the system, and it also provides fault tolerance structure logs, which can record all the user's operation, thereby protecting the security of the system. This paper is mainly discussed to recover file systems after NTFS in system crash or disk failure.
NTFS is a file system with error warning. Since NTFS uses redundant storage to system information of the key file system, the NTFS can still access critical data on the volume when a sector is corrupted on the disk. The first 16 sectors of the NTFS partition are partition boot sectors, which are used to save partition boot code, which is the main file table (MFT). If the disk sector where the MFT is located, the NTFS file system transfer MFT transfer To other sectors of the hard disk, this guarantees the NTFS file system and the normal operation of the Windows operating system. The FAT (file allocation table) of the previous FAT16 and FAT32 file system, FAT can only be fixed behind the partition boot sector, once the sector, the entire file system is paralyzed, the NTFS file system is obviously more advanced. . However, this mobile MFT is not a perfect, if the partition boot code points to the MFT part of the MFT, then the NTFS file system will not know where to find MFT, thus report "Disk is not formatted" error message. . In order to avoid such a problem, the partition boot code will contain a checkpoint, which is responsible for detection.
The NTFS file system successfully ensures the consistency of the NTFS volume by transaction logging and recovery techniques, and implements the recoverableity of the file system. When performing Chkdsk on FAT or HPFS, the system will check the consistency of pointers in the directory, assignment, and file tables; A submission point can restore the consistency in the file system. System overhead required by the transaction log method is small. NTFS is not accessing records directly in the log file, but is read by LFS. LFS provides an open, write, forward, rearward, update, etc. to help NTFS processing log files.
We regard each specific I / O operation of the NTFS volume file as a transaction, each of which is an atomic operation. In this way, any complex operation can be broken down into many transactions. The system is facing a lot of different transactions. When a transaction begins, it is either successful, or when some accident is encountered, it can go back to the previous submission point, this time the NTFS volume is in the state before the transaction. Many reasons can result in failure of the transaction, such as the magnetic disk, insufficient memory, equipment connection error, etc.
To ensure that each transaction can be completed or erroneous back to the previous state, the following steps are performed for each transaction NTFS file system:
(1) Record the sub-operation in this transaction to the log file that has been cached;
(2) Record the actual sub-operation data to memory;
(3) Tag this transaction as submitted in the log file cached;
(4) Write the log into the disk;
(5) Write the data into the disk.
In fact, for steps (4) and steps (5), NTFS is not instantly written to disk, but is a lazy-write technology, selecting a lot of data in the best time after the next appropriate timing Batch to disk. The use of delayed write technologies greatly reduces the frequency of disk operation, which greatly improves the performance of the system, but it is possible to cause inconsistency in the disk when the system crashes, there is a risk. In our own written applications, you can use file_flag_write_through to let the system do not talk directly to the disk directly through the cache - this time the system still caught the write operation only without delaying writing disks. The NTFS file system guarantees that the cache logs are stored in the disk before the transaction. When the file system update cache, NTFS submits these transactions through records that are labeled as completed in the cache log. When the cache log is refreshed on the disk, all the transactions that are labeled as submit must be completed, even if the system may crash before the actual changes of these transactions are stored.
When an error occurs, there is sufficient information in the log of the NTFS file system to complete or interrupt any problematic transactions. When performing recovery operations, the NTFS file system redo the transaction that is marked as submitted in the log; then the file system finds a transaction that is not submitted when the last system crashes, and puts these uncommitted transactions in the log. Operation is revoked. Because the NTFS file system has written these changes before writing to the hard disk, NTFS has all valid information that requires rollback sub-action in the recovery process.
However, in fact, NTFS is not so insurance with this transaction log technology to recover data. Moreover, because the system is recovered through the log, the recovered process is possible to affect all the data of the file system - unless the user uses the file_flag_write_through flag when the user is accessed. If the user program does not use file_flag_write_through to access data, the user data is likely to be lost after the system crashes. It is possible that the system only resumes very distant data, or restores an irreted error data, or cannot recover any data.
Repair of hard disk failure
The NTFS file system utilizes Cluster Remapping technology to reduce the impact of the bad sector of the disk on the NTFS volume. NTFS automatically detects and fixes logic errors and physical errors on hard drives, but in the FAT16 and FAT32 era, we need to mark this bad sector on disk, but when discrete errors, data is often Written on the bad sector, the loss has been caused.
If the NTFS file system, it will check whether the sector is correct when you read and write. When the error is found, NTFS reports this error; when writing files to disk, the NTFS will be very intelligently changed to a complete location storage data, and the operation will not be affected. In both cases, NTFS will mark on a bad sector to prevent future use. This mode of work makes a disk error can be discovered earlier to avoid catastrophic accidents.
Under FAT or HPFS, as long as one of the sectors in the special body of the file system fails, simple sector failure will happen. NTFS blocks the happening in two aspects: First, not on disk using special data and tracks and protects all objects on the disk. Second, under NTFS, multiple copies (quantity are determined by the size of the volume) main file table.
summary:
