The file system is for. What is exFAT

FAT32: An old Windows system used on small removable media. Used on small storage devices or for compatibility with digital cameras, game consoles, set-top boxes and other devices that only support FAT32.

NTFS: modern versions of Windows starting from Win XP - use it for their partitions. External media are formatted with FAT32, large 1TB external hard drives are formatted with NTFS.

HFS +: Macintosh computers use HFS + for their internal partitions as well as formatting external HFS + media. Mac reads and writes files to FAT32, but by default only reads NTFS. To write in NTFS format Macintosh requires third-party software.

Ext2 / Ext3 / Ext4: found in Linux. Ext2- This is an older file system and lacks important features such as journaling - if the power is turned off or the computer is restarted while writing to the ext2 drive, data may be lost. Ext3 adds reliability features at the expense of speed. Ext4 turns out to be a more modern, faster and standard system for most Linux distributions and is faster. Win and Mac do not support Ext2 / Ext3 / Ext4 - you need an additional tool to access the files. For this reason, it is often ideal to format Linux partitions as ext4 and leave removable devices formatted with FAT32 or NTFS if compatibility with other operating systems is required. Linux reads and writes to both FAT32 and NTFS.

Btrfs: Created for Linux, in development. It is not currently standard on most Linux distributions, but Btrfs will soon take the lead. The goal is to provide additional functionality that allows Linux to scale out for more storage.

Swap: Linux "swap" does not have a file system. A partition formatted as "swap" is used only as OS swap space - similar to a page file in Windows, but it requires a dedicated partition.

File systems for external USB drives

All external drives also have their own file systems:

• FAT- FS was developed by Microsoft corporation, it is the most widespread on memory cards and usb-flash drives. Used in household appliances such as: video camera, TV, DVD player, music center. The limitation is that it has a maximum file size of 4 GB.
• exFAT- created by Microsoft, extended version of FAT, used for flash devices. The restrictions on the size of files and the volume of partitions have been removed. Disadvantage: Not supported by most consumer devices and early versions of Win XP.
• FFS2- created in 1990 and patented by Microsoft. Continued the FFS1 system, one of the earliest FS for flash cards.
• JFFS- log-structured Linux system for NOR-usb-media.
• JFFS2- used in flash memory devices. JFFS follower. Supports Nand devices, performance improvements. Difficulty working with large flash drives.
• LogFS- under development, used for Linux, replaces JFFS2. Improved for fast layout of large flash drives.
• YAFFS- designed for NAND-flash, can be used in NOR-flash drives.

Classification, structure, characteristics of file systems !!!

1. Concept, structure and operation of the file system.

A file system is a set (order, structure and content) of organizing data storage on storage media, which directly represents access to stored data; at the household level, it is a set of all files and folders on a disk. The main "units" of the file system are considered to be a cluster, file, directory, partition, volume, disk.
The set of zeros and ones on the information carrier make up a cluster (the minimum size of space for storing information, it is also customary to call them the concept of a sector, their size is a multiple of 512 bytes).
Files - a named collection of bytes, divided into sectors. Depending on the file system, a file can have a different set of properties. For convenience, when working with files, their (symbolic identifiers) names are used.
To organize the structure of the file system, files are grouped into catalogs .
Chapter - an area of ​​the disk created during its partitioning and containing one or more formatted volumes.
Volume - the area of ​​the partition with the file system, file table and data area. One or more sections make up disk .
All information about files is stored in a special area of ​​the section - the file table. The file table allows you to associate numeric file identifiers and additional information about them (date modified, access rights, name, etc.) with the direct contents of the file stored in another area of ​​the section.

MBR (Master Boot Record) a special area located at the beginning of the disk - containing information necessary for the BIOS to boot the operating system from the hard disk.
The partition table is also located at the beginning of the disk, its task is to store information about partitions: start, length, load. The boot partition contains the boot sector, which stores the boot program for the operating system.

The counting starts from MBR (from sector with number 0) for all primary (primary) partitions, both for regular and extended, and only for primary.
All not extended logical partitions are offset from the beginning of the extended partition in which they are described.
All extended logical partitions are offset from the start of the extended primary.

The operating system boot process is as follows:
When the computer is turned on, the BIOS receives control of the processor, it is loaded (boot) from the hard drive, the first sector of the disk (MBR) is loaded into the computer's RAM and control is transferred to it).

The MBR can be written as a "standard" bootloader,

and boot loaders like LILO / GRUB.

The standard boot loader finds the first partition with the bootable flag in the primary partition table, reads its first sector (boot sector) and transfers control to the code written in this boot sector. If instead of the standard MBR bootloader there is another one, then it does not look at the bootable flag, it can boot from any partition (specified in its settings).

For example, to boot the Windows NT / 2k / XP / 2003 operating system, a code is written in the boot sector that loads the main loader (ntloader) from the current partition into memory.
Each FAT16 / FAT32 / NTFS file system uses its own bootloader. The ntldr file must be present at the root of the section. If you see the message "NTLDR is missing" when trying to boot Windows, then this is the case when the ntldr file is missing. Also, for normal operation of ntldr, the files bootfont.bin, ntbootdd.sys, ntdetect.com and a correctly written boot.ini may be needed.

Boot.ini example

C: \ boot.ini

timeout = 8
default = C: \ gentoo.bin

C: \ gentoo.bin = "Gentoo Linux"
multi (0) disk (0) rdisk (0) partition (1) \ WINDOWS = "Windows XP (32-bit)" / fastdetect / NoExecute = OptIn
multi (0) disk (0) rdisk (0) partition (3) \ WINDOWS = "Windows XP (64-bit)" / fastdetect / usepmtimer

Sample grub.conf configuration file

# grub.conf generated by anaconda
#
#Note that you do not have to rerun grub after making changes to this file
#
#NOTICE: You have a / boot partition. This means that
#all kernel and initrd paths are relative to / boot /, eg.
#root (hdO.O)
#kernel / vmlinuz-version ro root = / dev / sda2
#initrd /initrd-version.img
# boot = / dev / sda default = 0 timeout = 5
splashimage = (hdO, 0) /grub/splash.xpm.gz
hiddenmenu
title Red Hat Enterprise Linux server (2.6.18-53.el 5)
root (hdO.O)
kernel /vmlinuz-2.6.18-53.el5 ro root = LABEL = / rhgb quiet-
initrd /initrd-2.6.18-53.el5.img

Lilo.conf file structure

# LILO configuration file generated by "liloconfig"
// Section describing global parameters
# Start LILO global section
// Where Lilo is written to. In this case, it is MBR
boot = / dev / hda
// The message that is displayed when loading
message = /boot/boot_message.txt
// Display the prompt
prompt
// Time Out to choose the operating system
timeout = 1200
# Override dangerous defaults that rewrite the partition table:
change-rules
reset
# VESA framebuffer console @ 800x600x256
// Select the video mode for displaying the menu
vga = 771
# End LILO global section
// Section describing the boot parameters of windows
# DOS bootable partition config begins
other = / dev / hda1
label = Windows98
table = / dev / hda
# DOS bootable partition config ends
// Section describing QNX boot parameters
# QNX bootable partition config begins
// Path to the operating system
other = / dev / hda2
label = QNX
table = / dev / hda
# QNX bootable partition config ends
// Section describing Linux boot parameters
# Linux bootable partition config begins
// Path to the kernel image
image = / boot / vmlinuz
root = / dev / hda4
label = Slackware
read-only
# Linux bootable partition config ends

2. The most famous file systems.

• Advanced Disc Filing System
• AdvFS
• Be File System
• CSI - DOS
• Encrypting File System
• Extended File System
• Second Extended File System
• Third Extended File System
• Fourth Extended File System
• File Allocation Table (FAT)
• Files - 11
• Hierarchical File System
• HFS Plus
• High Performance File System (HPFS)
• ISO 9660
• Journaled File System
• Macintosh File System
• MINIX file system
• Microdos
• Next3
• New Implementation of a Log-structured F (NILFS)
• Novell Storage Services
• New Technology File System (NTFS)
• Protogon
• ReiserFS
• Smart File System
• Squashfs
• Unix File System
• Universal Disk Format (UDF)
• Veritas File System
• Windows Future Storage (WinFS)
• Write Anywhere File Layout
• Zettabyte File System (ZFS)

3. The main characteristics of file systems.

The operating system provides applications with a set of functions and structures for working with files. The capabilities of the operating system impose additional restrictions on the restrictions of the file system, the main restrictions include:

The maximum (minimum) volume size;
- Maximum (minimum) number of files in the root directory;
- The maximum number of files in a non-root directory;
- File-level security;
- Support for long file names;
- Self-healing;
- Compression at the file level;
- Keeping transaction logs;

4. A brief description of the most common file systems FAT, NTFS, EXT.

FAT file system.

FAT stands for file allocation table.
In the FAT file system, the logical disk space of any logical disk is divided into two areas:
- system area;
- data area.
The system area is created when formatting and updated when manipulating the file structure. The data area contains files and directories subordinate to the root and is accessible through the user interface. The system area consists of the following components:
- boot record;
- reserved sectors;
- file allocation tables (FAT);
- the root directory.
The file allocation table is a map (image) of the data area, which describes the state of each section of the data area. The data area is divided into clusters. A cluster is one or more contiguous sectors in a logical disk address space (data area only). In the FAT table, clusters belonging to the same file (non-root directory) are chained together. The FAT16 file management system uses a 16-bit word to specify the cluster number, so you can have up to 65536 clusters.
A cluster is the smallest addressable unit of disk space allocated to a file or non-root directory. The file or directory occupies an integer number of clusters. In this case, the last cluster may not be fully involved, which will lead to a noticeable loss of disk space with a large cluster size.
Since FAT is used very intensively when accessing the disk, it is loaded into RAM and stays there for as long as possible.
The root directory differs from a regular directory in that it resides in a fixed location on a logical disk and has a fixed number of elements. For each file and directory, the file system stores information according to the following structure:
- file or directory name - 11 bytes;
- file attributes - 1 byte;
- reserve field - 1 byte;
- creation time - 3 bytes;
- creation date - 2 bytes;
- date of last access - 2 bytes;
- Reserved - 2 bytes;
- time of the last modification - 2 bytes;
- number of the initial cluster in FAT - 2 bytes;
- file size - 4 bytes.
The structure of the file system is hierarchical.

The file system is FAT32.
FAT32 is a completely independent 32-bit file system and contains numerous enhancements and additions over FAT16. The fundamental difference between FAT32 is more efficient use of disk space: FAT32 uses smaller clusters, which leads to savings in disk space.
FAT32 can move the root directory and use a FAT backup instead of the standard one. FAT32 Extended Boot Record allows you to create copies of critical data structures, which increases the resilience of disks to FAT structure violations compared to previous versions. The root directory is a regular chain of clusters, so it can be located in any place on the disk, which removes the restriction on the size of the root directory.

File system NTFS.
The NTFS (New Technology File System) file system contains a number of significant improvements and changes that significantly distinguish it from other file systems. From the user's point of view, files are still stored in directories, but working on large disks in NTFS is much more efficient:
- there are tools to restrict access to files and directories;
- introduced mechanisms that significantly increase the reliability of the file system;
- removed many restrictions on the maximum number of disk sectors and / or clusters.

The main characteristics of the NTFS file system:
- reliability. High-performance computers and shared systems must have increased reliability; for this purpose, a transaction mechanism has been introduced, in which file operations are logged;
- extended functionality. NTFS introduces new features: improved fault tolerance, emulation of other file systems, powerful security model, parallel processing of data streams, creation of user-defined file attributes;
- POSIX standard support. Basic features include the optional use of case-sensitive file names, storage of the last time a file was accessed, and an alias mechanism that allows multiple names to refer to the same file;
- flexibility. The allocation of disk space is very flexible: the cluster size can vary from 512 bytes to 64 KB.
NTFS works well with large amounts of data and large volumes. The maximum volume (and file) size is 16 EB. (1 EB equals 2 ** 64 or 16000 billion gigabytes.) The number of files in the root and non-root directories is not limited. Since the NTFS directory structure is based on an efficient data structure called a "binary tree", the search time for files in NTFS is not linearly related to their number.
NTFS has some self-healing features and supports various mechanisms for checking system integrity, including transaction logging, which allows you to track file write operations against the system log.
The NTFS file system supports the security object model and treats all volumes, directories, and files as independent NTFS objects. Access rights to volumes, directories and files depends on the user account and the group to which it belongs.
The NTFS file system has built-in compression that can be applied to volumes, directories, and files.

File system Ext3.
The ext3 file system can support files up to 1 TB in size. With Linux kernel 2.4, the filesystem is limited by the maximum block device size, which is 2 terabytes. Linux 2.6 (for 32-bit processors) has a maximum block device size of 16TB, however ext3 only supports up to 4TB.
Ext3 has good NFS compatibility and does not have a performance problem when there is a lack of free disk space. Another advantage of ext3 comes from the fact that it is based on ext2 code. The ext2 and ext3 disk formats are identical; it follows that the ext3 filesystem can be mounted as ext2 without any problems if needed. And that's not all. Due to the fact that ext2 and ext3 use identical metadata, it is possible to hot upgrade ext2 to ext3.
Ext3 reliability
In addition to ext2-compatible, ext3 inherits other advantages of the common metadata format. Ext3 users have a proven fsck tool at their disposal for years. Of course, the main reason for moving to the journaling filesystem is to eliminate the need for periodic and lengthy checks for the consistency of metadata on disk. However, "journaling" does not protect against kernel crashes or disk surface damage (or anything like that). In case of emergency, you will appreciate the fact that ext3 is inherited from ext2 with its fsck.
Ext3 journaling.
Now that you have a general understanding of the problem, let's see how ext3 handles journaling. The journaling code for ext3 uses a special API called the Journaling Block Device layer or JBD. JBD was designed to be logged to any block device. Ext3 is tied to the JBD API. The ext3 filesystem code tells JBD to make a modification and asks JBD for permission to do it. The log is managed by JBD on behalf of the ext3 filesystem driver. This convention is very convenient because JBD evolves as a separate, generic object and can be used in the future for journaling to other filesystems.
Ext3 data protection
Now we can talk about how the ext3 filesystem provides journaling for both data and metadata. There are actually two methods of ensuring consistency in ext3.
Ext3 was originally designed for full data and metadata journaling. In this mode (called "data = journal" mode), the JBD journals all changes to the filesystem related to both data and metadata. In doing so, JBD can use the log to rollback and restore metadata and data. The disadvantage of "full" journaling is the rather low performance and consumption of a large amount of disk space for the journal.
Recently a new journaling mode has been added for ext3, which combines high performance and the guarantee of a consistent filesystem structure after a crash (like "normal" journaling filesystems). The new mode of operation only serves metadata. However, the ext3 filesystem driver still keeps track of the processing of entire chunks of data (if they involve modifying metadata) and groups them into a separate object called a transaction. The transaction will be completed only after all data has been written to disk. A "side" effect of this "coarse" technique (called "data = ordered" mode) is ext3 provides a higher chance of data retention (compared to "advanced" journaling filesystems) while guaranteeing metadata consistency. In this case, only changes to the file system structure are logged. Ext3 uses this mode by default.
Ext3 has many benefits. It is designed for ease of deployment. It is based on years of proven ext2 code and inherited the wonderful fsck tool. Ext3 is primarily intended for applications that do not have built-in data integrity assurance capabilities. Overall, ext3 is a great filesystem and a worthy follow-up to ext2. Another characteristic that sets ext3 positively apart from other journaled filesystems under Linux is its high reliability.

The ext4 file system is a worthy evolutionary continuation of the ext file system.

Why may a smartphone not launch programs from a memory card? How is ext4 fundamentally different from ext3? Why will a flash drive live longer if formatted to NTFS rather than FAT? What is the main problem with F2FS? The answers lie in the peculiarities of the structure of file systems. We will talk about them.

Introduction

File systems determine how data is stored. They determine what restrictions the user will face, how fast read and write operations will be, and how long the drive will work without failures. This is especially true of budget SSDs and their younger brothers - flash drives. Knowing these features, you can squeeze the maximum out of any system and optimize its use for specific tasks.

You have to choose the type and parameters of the file system every time you need to do something non-trivial. For example, you want to speed up the most frequent file operations. At the file system level, this can be achieved in a number of ways: indexing will provide fast searches, and pre-reservation of free blocks will make it easier to overwrite frequently changing files. Optimizing the data in RAM beforehand will reduce the amount of I / O required.

Features of modern file systems such as lazy writing, deduplication, and other advanced algorithms help increase uptime. They are especially relevant for cheap SSDs with TLC memory chips, flash drives and memory cards.

Separate optimizations exist for different tiers of disk arrays: for example, the file system can support lightweight volume mirroring, snapshots, or dynamic scaling without taking a volume offline.

Black box

Users mainly work with the file system offered by the operating system by default. They rarely create new disk partitions and even less often think about their settings - they just use the recommended parameters or even buy pre-formatted media.

For Windows fans, everything is simple: NTFS on all disk partitions and FAT32 (or the same NTFS) on flash drives. If there is a NAS and some other file system is used in it, then for the majority it remains beyond perception. They simply connect to it over the network and download files, as if from a black box.

On mobile gadgets with Android, ext4 is most often found in internal memory and FAT32 on microSD cards. For Apple, it doesn't matter at all what kind of file system they have: HFS +, HFSX, APFS, WTFS ... for them there are only beautiful folder and file icons drawn by the best designers. Linuxoids have the richest choice, but you can add support for file systems that are not native to the operating system in both Windows and macOS - more on that later.

Common roots

More than a hundred different file systems have been created, but a little more than a dozen can be called relevant. While they were all designed for their specific applications, many ended up being conceptually related. They are similar because they use the same type of presentation structure (meta) data - B-trees ("bi-trees").

As with any hierarchical system, the B-tree starts at the root record and further branches down to the final elements - individual records about files and their attributes, or "leaves". The main purpose of creating such a logical structure was to speed up the search for file system objects on large dynamic arrays, such as hard drives of several terabytes or even more impressive RAID arrays.

B-trees require far fewer disk accesses than other types of B-trees when performing the same operations. This is achieved due to the fact that the final objects in B-trees are hierarchically located at the same height, and the speed of all operations is just proportional to the height of the tree.

Like other balanced trees, B-trees have the same path length from root to any leaf. Instead of growing up, they branch more and grow more in width: all branch points in the B-tree store many references to child objects, which makes them easy to find in fewer calls. A large number of pointers reduces the number of the longest disk operations - head positioning when reading arbitrary blocks.

The concept of B-trees was formulated back in the seventies and has undergone various improvements since then. It is implemented in one form or another in NTFS, BFS, XFS, JFS, ReiserFS and many DBMS. They are all cousins ​​in terms of the basic principles of data organization. The differences relate to details, which are often quite important. The disadvantage of related file systems is also common: they were all created to work with disks even before the advent of SSDs.

Flash memory as an engine of progress

Solid-state drives are gradually replacing disk drives, but so far they are forced to use file systems that are inherited from them. They are built on arrays of flash memory, the principles of which differ from those of disk devices. In particular, flash memory must be erased before writing, and this operation in NAND chips cannot be performed at the level of individual cells. It is possible only for large blocks as a whole.

This limitation is due to the fact that in NAND memory, all cells are combined into blocks, each of which has only one common connection to the control bus. We will not go into the details of page organization and paint the full hierarchy. What is important is the very principle of group operations with cells and the fact that the sizes of blocks of flash memory are usually larger than the blocks addressed in any file system. Therefore, all addresses and commands for drives with NAND flash must be translated through the FTL (Flash Translation Layer) abstraction layer.

Flash memory controllers provide compatibility with the logic of disk devices and support for commands of their native interfaces. Usually FTL is implemented in their firmware, but it can (partially) run on the host - for example, Plextor writes drivers for its SSDs that accelerate writing.

You cannot do without FTL at all, since even writing one bit to a specific cell leads to the launch of a whole series of operations: the controller searches for a block containing the required cell; the block is read in full, written to the cache or to free space, then erased entirely, after which it is rewritten back with the necessary changes.

This approach resembles everyday life in the army: in order to give an order to one soldier, the sergeant makes a general formation, calls the poor fellow out of order and orders the rest to disperse. In the now rare NOR memory, the organization was spetsnaz: each cell was controlled independently (each transistor had an individual contact).

The controllers have more tasks, since with each generation of flash memory, the technical process of its manufacture decreases in order to increase the density and reduce the cost of data storage. Along with technological standards, the estimated life of the chips is also decreasing.

Modules with single-level SLC cells had a declared resource of 100 thousand rewriting cycles or more. Many of them still work in old flash drives and CF cards. The enterprise-class MLC (eMLC) claimed the resource in the range from 10 to 20 thousand, while in the usual consumer-grade MLC it is estimated at 3-5 thousand. Memory of this type is actively crowded by the even cheaper TLC, whose resource barely reaches a thousand cycles. Keeping the lifespan of flash memory at an acceptable level has to be done through software tweaks, and new file systems are becoming one of them.

Manufacturers initially assumed that the file system was unimportant. The controller itself must maintain a short-lived array of memory cells of any type, distributing the load between them in an optimal way. For the file system driver, it simulates a regular disk, and itself performs low-level optimizations on any access. However, in practice, optimization varies from magical to fictitious for different devices.

In corporate SSDs, the built-in controller is a small computer. It has a huge memory buffer (half a gig and more), and it supports many methods to improve the efficiency of working with data, thus avoiding unnecessary rewriting cycles. The chip arranges all the blocks in the cache, performs lazy writes, performs deduplication on the fly, reserves some blocks and clears others in the background. All this magic happens completely unnoticed by the OS, programs and the user. With an SSD like this, it really doesn't matter what filesystem is used. Internal optimizations have a much larger impact on performance and resource than external ones.

Budget SSDs (and even more so - flash drives) are equipped with much less smart controllers. The cache in them is truncated or absent, and advanced server technologies are not used at all. In memory cards, controllers are so primitive that it is often claimed that they are not there at all. Therefore, for cheap devices with flash memory, external load balancing methods remain relevant - primarily using specialized file systems.

JFFS to F2FS

One of the first attempts to write a file system that would take into account the principles of organization of flash memory was JFFS - Journaling Flash File System. Initially, this development by the Swedish company Axis Communications was focused on improving the memory efficiency of network devices that Axis produced in the nineties. The first version of JFFS supported only NOR memory, but already in the second version it became friends with NAND.

JFFS2 is of limited use right now. Mostly it is still used in Linux distributions for embedded systems. It can be found in routers, IP cameras, NAS, and other regulars on the Internet of Things. In general, wherever a small amount of reliable memory is required.

A further development effort for JFFS2 was LogFS, which stored inodes in a separate file. The authors of this idea are an employee of the German division of IBM Jörn Engel and a lecturer at the University of Osnabruck Robert Mertens. The source code for LogFS is available on GitHub. Judging by the fact that the last change in it was made four years ago, LogFS has not gained popularity.

But these attempts spurred the emergence of another specialized file system - F2FS. It was developed by Samsung Corporation, which accounts for a large part of the flash memory produced in the world. Samsung makes NAND Flash chips for its own devices and for other companies, and is also developing SSDs with fundamentally new interfaces instead of legacy disk ones. The creation of a specialized file system optimized for flash memory has been a long overdue necessity from Samsung's point of view.

Four years ago, in 2012, Samsung created F2FS (Flash Friendly File System). Its idea is good, but the implementation turned out to be damp. The key task when creating F2FS was simple: to reduce the number of cell rewriting operations and distribute the load on them as evenly as possible. This requires performing operations with several cells within the same block at the same time, and not rape them one by one. This means that we do not need instant rewriting of existing blocks at the first request of the OS, but caching of commands and data, adding new blocks to free space and delayed erasure of cells.

Today, F2FS support is already officially implemented in Linux (and hence in Android), but it does not provide any special advantages in practice yet. The main feature of this file system (deferred overwrite) has led to premature conclusions about its effectiveness. The old caching trick even fooled early versions of benchmarks, where F2FS showed an apparent advantage not by a few percent (as expected) or even several times, but orders of magnitude. It's just that the F2FS driver reported the execution of an operation that the controller was just planning to do. However, if the real performance gain in F2FS is small, then cell wear will definitely be less than when using the same ext4. Those optimizations that a cheap controller cannot do will be performed at the level of the file system itself.

Extents and bitmaps

While F2FS is perceived as exotic for geeks. Even Samsung's own smartphones still use ext4. Many consider it to be a further development of ext3, but this is not entirely true. This is more of a revolution than breaking the 2 TB per file barrier and simply increasing other metrics.

When computers were large and files were small, addressing was easy. Each file was allocated a certain number of blocks, the addresses of which were entered into the correspondence table. This is how the ext3 filesystem worked, which is still in use today. But in ext4, a fundamentally different way of addressing appeared - extents.

Extents can be thought of as inode extensions as discrete sets of blocks that are addressed in their entirety as contiguous sequences. One extent can contain an entire medium-sized file, and for large files, it is enough to allocate a dozen or two extents. This is much more efficient than addressing hundreds of thousands of small blocks of four kilobytes.

The writing mechanism itself has changed in ext4. Now the distribution of blocks occurs immediately in one request. And not in advance, but immediately before writing data to disk. Delayed multi-block allocation allows you to get rid of unnecessary operations that ext3 sinned: in it, blocks for a new file were allocated immediately, even if it completely fit in the cache and was scheduled to be deleted as temporary.

FAT restricted diet

Besides balanced trees and their modifications, there are other popular logical structures. There are file systems with a fundamentally different type of organization - for example, linear. You probably use at least one of them a lot.

Mystery

Guess the riddle: at twelve she began to put on weight, by sixteen she was a stupid fat woman, and by thirty-two she became fat, and remained a simpleton. Who is she?

That's right, this is a story about the FAT file system. Compatibility requirements gave her a bad inheritance. On floppy disks it was 12-bit, on hard disks - at first it was 16-bit, and to this day it has come down as 32-bit. In each subsequent version, the number of addressable blocks increased, but in the very essence nothing changed.

The still popular FAT32 file system appeared twenty years ago. Today it is still primitive and does not support ACLs, disk quotas, background compression, or other modern data optimization technologies.

Why is FAT32 needed these days? All the same for compatibility purposes only. Manufacturers rightly believe that any OS can read a FAT32 partition. Therefore, they create it on external hard drives, USB Flash and memory cards.

How to free up flash memory on your smartphone

MicroSD (HC) cards used in smartphones are formatted to FAT32 by default. This is the main obstacle to installing applications on them and transferring data from internal memory. To overcome it, you need to create a partition with ext3 or ext4 on the card. All file attributes (including owner and access rights) can be transferred to it, so any application can work as if it was launched from internal memory.

Windows cannot make more than one partition on flash drives, but for this you can run Linux (at least in a virtual machine) or an advanced utility for working with logical partitioning - for example, MiniTool Partition Wizard Free. Having found an additional primary partition with ext3 / ext4 on the card, the Link2SD application and similar ones will offer much more options than in the case of a single FAT32 partition.

Another argument in favor of choosing FAT32 is often cited as its lack of journaling, which means faster writes and less wear on NAND Flash memory cells. In practice, the use of FAT32 leads to the opposite and gives rise to many other problems.

Flash drives and memory cards just die quickly because any change in FAT32 causes the overwriting of the same sectors where two chains of file tables are located. I saved the entire web page, and it was rewritten a hundred times - with each addition of another small GIF to the flash drive. Launched the portable software? He created temporary files and constantly changes them during work. Therefore, it is much better to use NTFS on flash drives with its fault-tolerant $ MFT table. Small files can be stored directly in the main file table, and its extensions and copies are written to different areas of flash memory. In addition, NTFS indexing makes searches faster.

INFO

For FAT32 and NTFS, the theoretical limits on the nesting level are not indicated, but in practice they are the same: only 7707 subdirectories can be created in the first-level directory. Lovers of nesting dolls will appreciate it.

Another problem that most users face is that it is impossible to write a file larger than 4 GB to a FAT32 partition. The reason is that in FAT32 the file size is described by 32 bits in the file allocation table, and 2 ^ 32 (minus one, to be precise) just gives four gigs. It turns out that neither a movie in normal quality nor a DVD image can be recorded on a freshly purchased flash drive.

Copying large files is still half the trouble: when you try to do this, the error is at least immediately visible. In other situations, FAT32 acts as a time bomb. For example, you copied portable software to a USB flash drive and at first you can use it without any problems. After a long time, one of the programs (for example, accounting or mail) has a database bloated, and ... it just stops updating. The file cannot be overwritten because it has reached the 4 GB limit.

A less obvious problem is that in FAT32, the creation date of a file or directory can be specified with an accuracy of two seconds. This is not sufficient for many cryptographic applications that use timestamps. The low precision of the date attribute is another reason why FAT32 is not considered a complete file system from a security point of view. However, its weaknesses can be used for your own purposes. For example, if you copy any files from an NTFS partition to a FAT32 volume, they will be cleared of all metadata, as well as inherited and specially set permissions. FAT just doesn't support them.

exFAT

Unlike FAT12 / 16/32, exFAT has been designed specifically for USB Flash and large (≥ 32 GB) memory cards. Extended FAT eliminates the aforementioned disadvantage of FAT32 - overwriting the same sectors on any change. As a 64-bit system, it has practically no meaningful limits on the size of a single file. Theoretically, it can be 2 ^ 64 bytes long (16 Ebytes), and cards of this size will not appear soon.

Another major difference in exFAT is its support for Access Control Lists (ACLs). This is no longer that simpleton from the nineties, but the closed format hinders the implementation of exFAT. ExFAT support is fully and legally implemented only in Windows (starting from XP SP2) and OS X (starting from 10.6.5). It is supported on Linux and * BSD either with restrictions or not entirely legally. Microsoft requires licensing to use exFAT, and there are many legal disputes in this area.

Btrfs

Another prominent example of B-tree file systems is called Btrfs. This FS appeared in 2007 and was originally created in Oracle with an eye to working with SSD and RAID. For example, it can be dynamically scaled by creating new inodes on the live system, or dividing a volume into subvolumes without allocating free space to them.

The copy-on-write mechanism implemented in Btrfs and full integration with the Device mapper kernel module allow you to make almost instant snapshots via virtual block devices. Data precompression (zlib or lzo) and deduplication speed up basic operations while extending the lifetime of flash memory. This is especially noticeable when working with databases (compression is achieved by 2–4 times) and small files (they are written in orderly large blocks and can be stored directly in the "leaves").

Btrfs also supports full journaling (data and metadata), volume checking without unmounting, and many other modern features. Btrfs code is published under the GPL license. This filesystem has been maintained as stable on Linux since kernel 4.3.1.

Flight logs

Almost all more or less modern file systems (ext3 / ext4, NTFS, HFSX, Btrfs and others) belong to the general group of journaled ones, since they keep records of changes made in a separate log (journal) and check with it in case of failure during disk operations ... However, the level of verbosity and fault tolerance of these file systems is different.

Ext3 supports three logging modes: loopback, sequenced, and full logging. The first mode implies recording only general changes (metadata), performed asynchronously with respect to changes in the data itself. In the second mode, the same metadata recording is performed, but strictly before any changes are made. The third mode is equivalent to full journaling (changes in both metadata and the files themselves).

Only the latter option ensures data integrity. The other two only speed up the identification of errors during the check and guarantee the restoration of the integrity of the file system itself, but not the contents of the files.

NTFS logging is similar to ext3's second logging mode. Only changes to the metadata are recorded in the log, and the data itself may be lost in the event of a failure. This NTFS journaling method was not conceived as a way to achieve maximum reliability, but only as a trade-off between performance and fault tolerance. This is why people accustomed to working with fully journaling systems consider NTFS to be pseudo-journaled.

The NTFS approach is somewhat better than the default in ext3. In NTFS, checkpoints are additionally created periodically to ensure that all previously pending disk operations are completed. Checkpoints have nothing to do with restore points in \ System Volume Infromation \. These are just overhead entries in the log.

Practice shows that such partial NTFS journaling in most cases is enough for trouble-free operation. After all, even with a sharp power outage, disk devices do not instantly de-energize. The power supply unit and numerous capacitors in the drives themselves provide just that minimum energy reserve, which is enough to complete the current write operation. Modern SSDs, with their speed and economy, the same amount of energy is usually enough to perform pending operations. An attempt to switch to full logging would reduce the speed of most operations by several times.

We connect third-party file systems in Windows

The use of file systems is limited by their support at the OS level. For example, Windows does not understand ext2 / 3/4 and HFS +, but sometimes you need to use them. This can be done by adding the appropriate driver.

WARNING

Most drivers and plugins for supporting third-party file systems have their limitations and do not always work stably. They can interfere with other drivers, antivirus and virtualization software.

Open driver for reading and writing ext2 / 3 partitions with partial ext4 support. The latest version supports extents and partitions up to 16 TB. LVM, ACLs and extended attributes are not supported.

There is a free plugin for Total Commander. Supports reading ext2 / 3/4 partitions.

coLinux is an open source and free port of the Linux kernel. Together with a 32-bit driver, it allows you to run Linux on Windows 2000 through 7 without using virtualization technologies. Supports 32-bit versions only. The development of the 64-bit modification was canceled. coLinux allows, among other things, to organize access from Windows to ext2 / 3/4 partitions. Project support was suspended in 2014.

Windows 10 may already have native support for Linux-specific file systems, it's just hidden. These thoughts are suggested by the kernel-level driver Lxcore.sys and the LxssManager service, which is loaded as a library by the Svchost.exe process. For more on this, see Alex Ionescu's talk "The Linux Kernel Hidden Inside Windows 10," which he gave at Black Hat 2016.

ExtFS for Windows is a paid driver released by Paragon. It works on Windows 7 to 10, supports read / write access to ext2 / 3/4 volumes. Provides almost complete ext4 support on Windows.

HFS + for Windows 10 is another proprietary driver from Paragon Software. Despite the name, it works in all versions of Windows starting from XP. Provides full access to HFS + / HFSX file systems on disks with any partition (MBR / GPT).

WinBtrfs is an early development of the Btrfs driver for Windows. Already in version 0.6, it supports both read and write access to Btrfs volumes. It is able to handle hard and symbolic links, supports alternate data streams, ACL, two types of compression and asynchronous read / write mode. So far WinBtrfs cannot use mkfs.btrfs, btrfs-balance and other utilities to maintain this file system.

File System Capabilities and Limitations: Pivot Table

File system	Mac-si-mal-ny volume-size	Pre-del-size of one file	Length by own file name	Length of full file name (including path from root)	Pre-del number of files and / or catalogs	Accuracy of specifying the date of the file / catalog	Rights dos-tu-pa	Hard links	Sim-free links	Snap-shots	Compressing data in the background	Cipher-ro-va-tion of data in the background	Grandfather-pli-ka-tion of data
FAT16	2 GB in 512 byte sectors or 4 GB in 64 KB clusters	2 GB	255 bytes with LFN	—	—	—	—	—	—	—	—	—	—
FAT32	8 TB in 2 KB sectors	4 GB (2 ^ 32 - 1 byte)	255 bytes with LFN	up to 32 subdirectories with CDS	65460	10ms (create) / 2s (change)	No	No	No	No	No	No	No
exFAT	≈ 128 PB (2 ^ 32-1 clusters of 2 ^ 25-1 bytes) theoretically / 512 TB due to third-party limitations	16 EB (2 ^ 64 - 1 byte)			2796202 in catalog	10 ms	ACL	No	No	No	No	No	No
NTFS	256 TB in 64KB clusters or 16TB in 4KB clusters	16 TB (Win 7) / 256 TB (Win 8)	255 Unicode characters (UTF-16)	32,760 Unicode characters, but no more than 255 characters per element	2^32-1	100 ns	ACL	Yes	Yes	Yes	Yes	Yes	Yes
HFS +	8 EB (2 ^ 63 bytes)	8 EB	255 Unicode characters (UTF-16)	not limited separately	2^32-1	1 s	Unix, ACL	Yes	Yes	No	Yes	Yes	No
APFS	8 EB (2 ^ 63 bytes)	8 EB	255 Unicode characters (UTF-16)	not limited separately	2^63	1 ns	Unix, ACL	Yes	Yes	Yes	Yes	Yes	Yes
Ext3	32TB (theoretical) / 16TB in 4K clusters (due to limitations of e2fs programs)	2 TB (theoretical) / 16 GB for older programs	255 Unicode characters (UTF-16)	not limited separately	—	1 s	Unix, ACL	Yes	Yes	No	No	No	No
Ext4	1 EB (theoretical) / 16 TB in 4K clusters (due to limitations of e2fs programs)	16 TB	255 Unicode characters (UTF-16)	not limited separately	4 billion	1 ns	POSIX	Yes	Yes	No	No	Yes	No
F2FS	16 TB	3.94 TB	255 bytes	not limited separately	—	1 ns	POSIX ACL	Yes	Yes	No	No	Yes	No
BTRFS	16 EB (2 ^ 64 - 1 byte)	16 EB	255 ASCII characters	2 ^ 17 bytes	—	1 ns	POSIX ACL	Yes	Yes	Yes	Yes	Yes	Yes

The computer market today offers many options for storing vast amounts of personal or corporate information in digital form. Storage devices include internal and external hard drives, USB flash drives, camera / camcorder memory cards, complex RAID systems, etc. Actual documents, presentations, pictures, music, videos, databases, emails are stored as files that can take up a lot of space.

This article provides a detailed description of how information is stored on a storage device.

Any computer file is stored in storage with a given capacity. In fact, each storage is a linear space for reading or reading and writing digital information. Each byte of information in the storage has its own offset from the beginning of storage (address) and refers to this address. The storage can be represented as a grid with a set of numbered cells (each cell represents one byte). Any file that is saved to the vault receives these cells.

Typically, computer storage uses a pair of sectors and a sector offset to reference any byte of information in the storage. A sector is a group of bytes (usually 512 bytes), the smallest addressable unit of physical storage. For example, 1040 bytes on the hard disk would be referred to as sector # 3 and a sector offset of 16 bytes ([sector - 512] + [sector - 512] +). This scheme is used to optimize storage addressing and use fewer numbers to refer to any piece of information in the store.

To omit the second part of the address (sector offset), files are usually stored starting from the beginning of the sector and occupying entire sectors (for example, a 10-byte file occupies an entire sector, a 512-byte file also occupies an entire sector, while at the same time a 514-byte file the file occupies two whole sectors).

Each file is stored in "unused" sectors and can be read at a known position and size. However, how do we know which sectors are in use and which are not? Where are the size, position and file name stored? These answers are given by the file system.

In general, a file system is a structured representation of data and a collection of metadata describing the stored data. The file system is used to store all storage, and is also part of an isolated storage segment - a disk partition. Usually, the filesystem manages blocks, not sectors. Filesystem blocks are groupings of sectors that optimize storage addressing. Modern file systems typically use block sizes from 1 to 128 sectors (512-65536 bytes). Files are usually stored at the beginning of a block and take up whole blocks.

Huge file system write / delete operations lead to file system fragmentation. Thus, the files are not saved as whole units, but are divided into fragments. For example, the entire storage is occupied by files about 4 blocks in size (for example, a collection of images). The user wants to save a file that will take 8 blocks and will therefore delete the first and last files. By doing this, it clears up space by 8 blocks, however the first segment is close to the beginning of storage, and the second is near the end of the storage. In this case, the file with 8 blocks is split into two parts (4 blocks for each part) and occupies "holes" of free space. Information about both fragments as part of one file is stored in the file system.

In addition to user files, the file system also contains its own parameters (such as block size), file descriptors (including file size, file location, file fragments, etc.), File names, and directory hierarchy. It can also store security information, extended attributes, and other parameters.

To meet various requirements such as storage performance, stability, and reliability, a large number of file systems are designed to serve specific user purposes.

Windows file systems

Microsoft Windows OS uses two main file systems: FAT, inherited from old DOS with its later FAT32 extension and the widely used NTFS file systems. The recently released ReFS file system was developed by Microsoft as the next generation file system for Windows 8, 10 servers.

FAT (File Allocation Table) is one of the simplest types of file systems. It consists of a file system descriptor sector (boot sector or superblock), a file system block allocation table (called a file allocation table), and simple storage space for files and folders. FAT files are stored in directories. Each directory is an array of 32-byte entries, each of which defines files or extended file attributes (such as a long file name). The file entry assigns the first block of the file. Any next block can be found through the block allocation table, using it as a linked list.

The block allocation table contains an array of block descriptors. A value of zero indicates that a block is not used, and a nonzero value refers to the next block in a file or a special end-of-file value.

The numbers in FAT12, FAT16, FAT32 indicate the number of bits used to enumerate a file system block. This means that FAT12 can use up to 4096 different block references, while FAT16 and FAT32 can use up to 65536 and 4294967296, respectively. The actual maximum number of blocks is even smaller and depends on the implementation of the file system driver.

FAT12 was used for old floppy disks. FAT16 (or just FAT) and FAT32 are widely used for flash memory cards and USB flash drives. The system is supported by mobile phones, digital cameras and other portable devices.

FAT or FAT32 is the file system that is used on Windows-compatible external storage or disk partitions less than 2 GB (for FAT) or 32 GB (for FAT32). Windows cannot create a FAT32 file system larger than 32GB (however Linux supports FAT32 up to 2TB).

NTFS (New Technological File System) was introduced in Windows NT and is currently the primary file system for Windows. It is the default file system for disk partitions and is the only file system that supports 32 GB disk partitions. The file system is quite extensible and supports many file properties, including access control, encryption, and so on. Every file in NTFS is stored as a file descriptor in the master file table and file contents. The main file table contains all information about the file: size, distribution, name, etc. The first and last sectors of the file system contain the parameters of the file system (boot record or superblock). This file system uses 48 and 64-bit values ​​for file references, thus supporting high-capacity disk storages.

ReFS (Resilient File System) is the latest Microsoft development currently available for Windows 8 and 10 servers. The file system architecture is completely different from other Windows file systems and is mostly organized as a B + -tree. ReFS is highly resilient to failures due to new features included in the system, namely Copy-on-Write (CoW): no metadata is changed without being copied; data is written to new disk space, not over existing data. Whenever the files are modified, a new copy of the metadata is kept in free storage space, and then the system creates a link from the old metadata to the newer one. Thus, the system stores a significant amount of old backups in different locations, making it easy to restore files if this storage location is not overwritten.

For information on recovering data from these file systems, visit the page " Chances for recovery ».

MacOS file systems

Apple's MacOS uses two file systems: HFS +, an extension to its own HFS file system used on older Macintosh computers, and the recently released APFS.

The HFS + file system runs on Apple products, including Mac computers, iPods, and Apple X Server products. The advanced server products also use the Apple Xsan file system, a clustered file system built from StorNext or CentraVision file systems.

This file system stores files and folders and Finder information about directory browsing, window positions, and more.

Linux file systems

The open source Linux operating system aims to implement, test and use various concepts of filesystems.

The most popular Linux file systems are:

• Ext2, Ext3, Ext4- "native" Linux file system. This file system is under active development and improvement. The Ext3 file system is simply an Ext2 extension that uses transaction log write operations. Ext4 is an add-on enhancement to Ext3, with support for optimized file allocation (extent) information and extended file attributes. This filesystem is often used as the "root" filesystem for most Linux installations.
• ReiserFS - an alternative Linux file system for storing a huge number of small files. It has good file search capabilities and allows you to compactly distribute files by storing file tails or small files along with metadata so as not to use large filesystem blocks for the same purpose.
• XFS is a file system created by SGI and originally used for the company's IRIX servers. The XFS specifications are now implemented on Linux. The XFS file system has excellent performance and is widely used for file storage.
• JFS is a file system developed by IBM for the company's powerful computing systems. JFS1 usually stands for JFS, JFS2 is the second version. This file system is currently open source and is implemented in most modern Linux versions.

The concept " tight connection The "used in such operating systems makes most Linux file systems the same, since a file name is not considered an attribute of a file, but rather is defined as an alias for a file in a particular directory. The file object can be linked to many locations, even propagated from the same directory under different names. This can lead to serious and even insurmountable difficulties in recovering file names after deleting files or damage to the file system.

For information on recovering data from these file systems, visit the "" page.

File systems BSD, Solaris, Unix

The most common file system for these operating systems is UFS (Unix File System), also often referred to as FFS (Fast File System).

Currently, UFS (in various versions) is supported by all operating systems of the Unix family and is the main file system of BSD OS and Sun Solaris operating system. Modern computing technologies tend to implement replacements for UFS on different operating systems (ZFS for Solaris, JFS and derived filesystems for Unix, etc.).

For information on recovering data from these file systems, visit the "" page.

Clustered file systems

Clustered file systems are used in computer cluster systems. These file systems support distributed storage.

Distributed file systems include:

• ZFS- "Zettabyte File System" is a new file system developed for Sun Solaris OS distributed storage.
• Apple xsan- Apple's evolution in CentraVision and later StorNext file systems.
• VMFS- "File system of virtual machines" developed by VMware for its VMware ESX Server.
• GFS- Red Hat Linux "Global File System".
• JFS1- the original (legacy) design of the IBM JFS file system used in older AIX storage systems.

Common properties of these file systems include support for distributed storage, extensibility, and modularity.

For more information on recovering data from these file systems, visit the "" page.

Understanding file systems

Windows 8 operating system, supports multiple file systems: NTFS, FAT and FAT32... But it can only work on NTFS, that is, it can be installed only on a hard disk partition formatted in this file system. This is due to those features and security tools that are provided in NTFS but not present on previous generation Windows file systems: FAT16 and FAT32... Next, we will dwell on the entire line of file systems for Windows in order to understand what role they play in the operation of the system and how they evolved in the process of becoming Windows flesh to Windows 8.

Advantages NTFS concern almost everything: performance, reliability and efficiency of working with data (files) on disk. So, one of the main goals of creating NTFS was the provision of high-speed performance of operations on files (copying, reading, deleting, writing), as well as providing additional features: data compression, recovery of damaged system files on large disks, etc.

Another main purpose of creating NTFS there was an implementation of increased security requirements, since file systems FAT, FAT32 in this respect they were not good at all. Exactly at NTFS you can allow or deny access to any file or folder (differentiate access rights).

First, let's look at the comparative characteristics of file systems, and then dwell on each of them in more detail. Comparisons, for greater clarity, are given in tabular form.

File system FAT it is simply not suitable for modern hard drives (due to its limited capabilities). Concerning FAT32, then it can still be used, but with a stretch. If you buy a 1000 GB hard drive, then you will have to split it into at least several partitions. And if you are going to do video editing, then you will be very disturbed limitation of 4 GB as the maximum possible file size.

The file system is devoid of all of these shortcomings. NTFS... So without even going into the details and accessibility of the file system NTFS, you can make a choice in its favor.

File system	Parameters
	Volume dimensions	Maximum file size
FAT	1.44 MB to 4 GB	2GB
FAT32	The theoretically possible volume size is from 512 MB to 2 TB. Compression is not supported at the file system level	4GB
NTFS	The minimum recommended size is 1.44 MB and the maximum is 2 TB. File system compression support for files, directories and volumes.	The maximum size is limited only by the size of the volume (Theoretically - 264 bytes minus 1 kilobyte. Practically - 244 bytes minus 64 kilobytes)

Generally use FAT32 can be justified only in cases where you have several operating systems installed on your computer, and some of them do not support NTFS... But today there are practically no such people. Unless you want to install antiques like Windows 98.

FAT file system

File system FAT(usually it means FAT 16) was developed a long time ago and was intended to work with small disk and file volumes, a simple directory structure. Abbreviation FAT stands for File Allocation Table(from English file allocation table). This table is placed at the beginning of the volume, and two copies of it are kept (for greater resilience).
This table is used by the operating system to locate the file and determine its physical location on the hard drive. If the table (and its copy) is damaged, the operating system cannot read the files. It simply cannot determine where which file is, where it starts and where it ends. In such cases, the file system is said to have crashed.
File system FAT was originally developed by Microsoft for floppy disks. Only later did they start using it for hard drives. At first it was FAT12(for floppy disks and hard drives up to 16 MB), and then it grew into FAT16 which was commissioned with the MS-DOS 3.0 operating system.

FAT32 file system

Starting with Windows 95 OSR2, Microsoft begins to actively use in its operating systems FAT32- thirty-two-bit version FAT... What to do, technical progress does not stand still and opportunities FAT 16 was clearly not enough.
Compared to her FAT32 began to provide more optimal access to disks, faster I / O operations, as well as support for large file sizes (disk capacity up to 2 TB).
V FAT32 implemented more efficient use of disk space (by using smaller clusters). Benefit over FAT16 is about 10 ... 15%. That is, when using FAT32 10 ... 15% more information can be recorded on the same disk than when using FAT16.
In addition, it should be noted that FAT32 provides higher reliability and faster launching of programs.
This is due to two significant innovations:
the ability to move the root directory and backup FAT(if the main copy is damaged)

The ability to store a backup copy of system data.

File system NTFS

General information
None of the FAT versions provide any acceptable level of security. This, as well as the need for additional file mechanisms (compression, encryption) led to the need to create a fundamentally new file system. And it became the file system NT (NTFS)
NTFS- from the English. New Technology File System - new technology file system
As already mentioned, its main advantage is security: for files and folders NTFS access rights can be assigned (read, write, etc.). Thanks to this, data security and system stability have been significantly increased. The assignment of access rights allows you to prohibit / allow any users and programs to perform any operations on files. For example, without sufficient rights, an unauthorized user will not be able to change any file. Or, again, not having sufficient rights, the virus will not be able to spoil the file.
Moreover, NTFS, as stated above, provides better performance and the ability to work with large amounts of data.

Since Windows 2000, the version is NTFS 5.0, which, in addition to the standard ones, allows you to implement the following features:

Data encryption- this feature is implemented by a special NTFS add-on called Encrypting File System(EFS)- encrypting file system. Thanks to this mechanism, the encrypted data can only be read on the computer on which the encryption took place.
Disk quotas- it became possible to assign users a certain (limited) size on disk that they can use.
Efficient storage of sparse files... There are files that contain a large number of consecutive empty bytes. The NTFS file system allows you to optimize their storage.

Using the change log- allows you to register all operations of access to files and volumes.

And one more innovation NTFS - mount points... With mount points, you can define various unrelated folders and even drives on the system as one drive or folder. This is of great importance for collecting in one place heterogeneous information located in the system.

■ Finally, it should be borne in mind that if certain access rights were set for a file under NTFS, and then you copied it to a FAT partition, then all its access rights and other unique attributes inherent in NTFS will be lost. So be careful.

 NTFS device. Master file table MFT.
Like any other file system, NTFS divides all the usable space into clusters- the minimum blocks of data into which the files are split. NTFS supports almost any cluster size from 512 bytes to 64 KB. However, the generally accepted standard is a 4KB cluster. It is he who is used by default. The principle of the existence of clusters can be illustrated by the following example.
If your cluster size is 4 KB (which is most likely), and you need to save a file of 5 KB, then 8 KB will actually be allocated for it, since it does not fit into one cluster, and disk space is allocated for the file only by clusters ...
There is a special file for each NTFS disk - MFT (Master Allocation Table)... This file contains a centralized directory of all files on the disk. When creating a file, NTFS creates and fills in MFT a corresponding record that contains information about file attributes, file contents, file name, etc.

In addition to MFT, there are 15 more special files (together with MFT - 16) that are not available to the operating system and are called metafiles... Names of all metafiles start with the character $ , but it is not possible to view them by standard means of the operating system and generally not see them. The following are basic metafiles for example:

SMFT- MFT itself.
$ MFTmirr- a copy of the first 16 MFT records located in the middle of the disk (mirror).
$ LogFile- logging support file.
$ Volume- service information: volume label, file system version, etc.
$ AttrDef- a list of standard file attributes on the volume.
$. - root directory.
$ Bitmap- a map of the volume's free space.
$ Boot- boot sector (if the partition is bootable).
$ Quota- a file containing user rights to use disk space.
$ Upcase- file-table of correspondence of uppercase and lowercase letters in file names on the current volume.
It is needed mainly because in NTFS file names are encoded Unicode, which is 65 thousand different symbols, it is very nontrivial to search for large and small equivalents.

As for the principle of organizing data on an NTFS disk, it is conditionally divided into two parts. The first 12% of the disc is allocated for the so-called MFT-zone- the space into which the MFT metafile grows.
It is not possible to write any user data to this area. The MFT zone is always kept empty. This is done so that the most important service file (MFT) does not become fragmented as it grows. The remaining 88% of the drive is conventional file storage.
However, if there is not enough disk space, the MFT zone may itself shrink (if possible), so you will not notice any discomfort. In this case, the new data will already be written to the former MFT-zone.
In case of subsequent freeing up of disk space, the MFT-zone will grow again, but in a defragmented form (that is, not in a single block, but in several parts on the disk). There is nothing wrong with that, it is simply believed that the system is more reliable when MFT file not defragmented. In addition, the entire file system is faster when the MFT file is not defragmented. Accordingly, the more defragmented the MFT file is, the slower the file system works.

As for the size of the MFT file, it is roughly calculated based on 1 MB per 1000 files.

Convert FAT32 partitions to NTFS without data loss. Convert utility

You can easily convert an existing FAT32 partition to NTFS. To do this, Windows 8, Windows 8.1 provides a command line utility convert

The parameters of her work are shown in the screenshot.

Thus, to convert the D: drive to NTFS, enter the following command at the command prompt:

After that, you will be asked to enter a volume label, if any (the volume label is indicated next to the disk name in the window My computer... It serves for a more detailed designation of disks and may or may not be used. For example, it could be Files Storage (D:).
To convert a flash drive, the command looks like this:

convert e: / fs: ntfs / nosecurity / x