Describe the internal layout of the file system in windows 2000.
The basic entity in NTFS is a volume and a volume is created by the Windows 2000 disk administrator utility and is based on a logical disk partition. The volume may take up a portion of a disk that may occupy an entire disk or may span across several disks. Cluster is used on the unit of disk allocation. A cluster is an amount of disk sectors that is a power of 2 and the cluster size is configured when NTFS file system is formatted. This cluster size is smaller than that for the 16-bit FAT file system and the small size reduces the amount of internal fragmentation.
NTFS utilizes logical cluster numbers (LCNs) as disk addresses and it assigns them by numbering clusters from the beginning of the disk to the end. Using this system, the system is able to calculate a physical disk offset (in bytes) by multiplying the LCN by the cluster size. A file in NTFS isn't a simple byte stream as it is in UNIX rather it is a structured object consisting of attributes. Every attribute of a file is an independent byte stream that can be deleted, created, read and written. Few attributes are standard for all files including the file name and the creation time and the security descriptor that specifies access control. A directory has attributes that execute an index for the file names in the directory. Generally attributes may be added as necessary and are accessed using a file name attribute nomenclature.
Every file in NTFS is explained by one or more records in an array stored in a special file called the master file table (MFT) and the size of a record is determined when the file is created; it ranges from 1 to 4 KB. Tiny attributes are stored in the MFT record itself and are called as resident attributes. Large attributes for example unnamed bulk data called as nonresident attributes are stored in one or more contiguous extends on the disk and a pointer to each extend is stored in the MFT record.
Every file in an NTFS volume has a unique ID called a file reference and the file reference is a 64-bit quantity that consists of:
1. 48-bit file number
2. 16-bit sequence number
The file number is a record number that is the array slot in the MFT that describes the file. The sequence number is incremented each time that an MFT entry is reused. This increment allows NTFS to perform internal consistency checks such as catching a stale reference to a deleted file after the MFT entry has been reused for a new file.
As in UNIX the NTFS name space is ordered as a hierarchy of directories. Every directory uses a data structure called as a B+ tree to store an index of the file names in that directory. A B+ tree is used for the reason that it eliminates the cost of reorganizing the tree and has property that length of every path from the root of the tree to a leaf is the same. The index root of a directory encloses the top level of the B+ tree. The NTFS volume's metadata are all stored in files and the first file is the MFT. The second file is that which is used during recovery if the MFT is damaged contains a copy of the first 16 entries of the MFT. Further files are volume file, log file, attribute-definition table, bitmap file, root directory, boot file and bad-cluster file.