Chapter 17 - Disk and File System Basics
This chapter describes the organization, contents, and purpose of the information on hard disks. It contains information on the following topics:
About Disks and Disk Organization
This section describes the physical structure of hard disks and floppy disks, and presents an overview of ways to logically organize areas on your disks.
Both hard disks and floppy disks work similar to an old-fashioned record player, with the record turning on the turntable and a needle playing the music. They are also similar to VCRs and stereo cassettes in that disks, cassette players, and VCRs all use a read/write head to access the information that is stored on the magnetic media.
Hard or fixed disks store information on a revolving platter of metal or glass coated with a magnetic material. The disk typically consists of several physical platters on a common spindle. This platter is similar to the record on a record player, except information is usually stored on both sides of a disk platter.
As the disk rotates, a transducer element called the head reads or writes binary data on the magnetic media. There are many methods for encoding data on the disk, such as modified frequency modulation (MFM) and run length limited (RLL). The disk controller logic determines the method used and the density of data on the disk.
Some high-end disks have as many as one head per track. Therefore, no time is lost physically moving the heads to a track in order to read information. These disks are more expensive and are normally found only on minicomputers or mainframes.
Current state-of-the-art disks do not have platters and heads, but use nonvolatile RAM (NVRAM) instead. The controller microcode organizes the memory into logical cylinders, heads, tracks, and sectors to provide a consistent interface to the operating system. Access times for these disks are measured in nanoseconds rather than the milliseconds for more conventional disks.
Each disk consists of platters, rings on each side of each platter called tracks, and sections within each track called sectors. A sector is the smallest physical storage unit on a disk, almost always 512 bytes in size.
Figure 17.1 illustrates a hard disk with two platters. The remainder of this section describes the terms used on the figure.
Figure 17.1 Illustration of a hard disk†
The cylinder/head/sector notation scheme described in this section is slowly being eliminated. All new disks use some kind of translation factor to make their actual hardware layout appear as something else, mostly to work with MS-DOS and Windows 95.
Tracks and Cylinders
On hard disks, the data are stored on the disk in thin, concentric bands called tracks. There can be more than a thousand tracks on a 3Ĺ inch hard disk. Tracks are a logical rather than physical structure, and are established when the disk is low-level formatted. Track numbers start at 0, and track 0 is the outermost track of the disk. The highest numbered track is next to the spindle. If the disk geometry is being translated, the highest numbered track would typically be 1023. Figure 17.2 shows track 0, a track in the middle of the disk, and track 1023.
A cylinder consists of the set of tracks that are at the same head position on the disk. In Figure 17.2, cylinder 0 is the four tracks at the outermost edge of the sides of the platters. If the disk has 1024 cylinders (which would be numbered 0-1023), cylinder 1023 consists of all of the tracks at the innermost edge of each side.
Figure 17.2 Tracks†
Most disks used in personal computers today rotate at a constant angular velocity. The tracks near the outside of the disk are less densely populated with data than the tracks near the center of the disk. Thus, a fixed amount of data can be read in a constant period of time, even though the speed of the disk surface is faster on the tracks located further away from the center of the disk.
Modern disks reserve one side of one platter for track positioning information, which is written to the disk at the factory during disk assembly. It is not available to the operating system. The disk controller uses this information to fine tune the head locations when the heads move to another location on the disk. When a side contains the track position information, that side cannot be used for data. Thus, a disk assembly containing two platters has three sides that are available for data.
Heads and Sides
A head is a small transducer that can be positioned over a disk track by using a solenoid or servomotor. The head can change the properties of the magnetic media as it rotates underneath.
A specific area can be switched to either magnetic north or south, which corresponds to a binary state of 0 or 1. This series of binary information is the data stream the disk controller passes to and receives from the operating system.
There is one head for each side of each platter. The heads are normally attached to a common head-movement mechanism, so that the heads all move in unison. The heads are always positioned at the same logical track on each side of each platter.
Because disk tracks are concentric bands, the heads must move to the track that contains the data to be accessed. The moving of the heads from the current track to the track that contains the next data is called seeking. The heads are moved over the surface of the disk in small increments called steps. Each step corresponds to one track.
Sectors and Clusters
Each track is divided into sections called sectors. A sector is the smallest physcial storage unit on the disk. The data size of a sector is always a power of two, and is almost always 512 bytes.
Each track has the same number of sectors, which means that the sectors are packed much closer together on tracks near the center of the disk. Figure 17.3, presented later in this section, shows sectors on a track. You can see that sectors closer to the spindle are closer together than those on the outside edge of the disk. The disk controller uses the sector identification information stored in the area immediately before the data in the sector to determine where the sector itself begins.
Note On Multiple Zone Recording (MZR) disks, the number of sectors on each track is not the same across the entire disk, but the hardware makes the number appear to be the same. For more information, see the section titled "Multiple Zone Recording," presented later in this chapter.
The Windows NT file systems allocate storage in clusters, where a cluster is one or more contiguous sectors. Windows NT bases the cluster size on the size of the partition.
As a file is written to the disk, the file system allocates the appropriate number of clusters to store the file's data. For example, if each cluster is 512 bytes and the file is 800 bytes, two clusters are allocated for the file. Later, if you update the file to, for example, twice its size (1600 bytes), another two clusters are allocated.
If contiguous clusters (clusters that are next to each other on the disk) are not available, the data are written elsewhere on the disk, and the file is considered to be fragmented. Fragmentation is a problem when the file system must search several different locations to find all the pieces of the file you want to read. The search causes a delay before the file is retrieved. A larger cluster size reduces the potential for fragmentation, but increases the likelihood that clusters will have unused space.
Using clusters larger than one sector reduces fragmentation, and reduces the amount of disk space needed to store the information about the used and unused areas on the disk. Because the FAT file system can use only 16 bits for the cluster number, using clusters enables FAT volumes to be larger than 65,535 sectors. There is more information about the FAT file system presented later in this chapter, and in Chapter 18, "Choosing a File System."
Figure 17.3 shows a sector on one track and the grouping of four sectors into a cluster.
Figure 17.3 Sectors and clusters†
Translation is the conversion of physical disk geometry (the number of cylinders on the disk, number of heads per cylinder, and sectors per track) to a logical configuration that is compatible with the operating system.
Since sector translation works between the disk itself and the system BIOS or firmware, the operating system is unaware of the actual characteristics of the disk. The disk could become inaccessible if the parameters used to set up the disk are lost, which can happen if the CMOS (described later in this section) or nonvolatile RAM (NVRAM) is corrupted or modified. In this case, the controller might translate to a configuration that adds up to the same total amount of disk space, but the operating system is not able to read data from the new arrangement. The disk has to be reformatted.
Many state-of-the-art disks now have a feature called Translation Mode. The disk controller queries the system BIOS (x86-based computers) or firmware (RISC-based computers) to determine the logical parameters the computer needs. If the number of cylinders, heads, and sectors per track the computer needs is within the range supported by the disk, the controller automatically configures itself to match those parameters. If the system BIOS or firmware does not support translation, the disk configures itself to its largest possible size, which is typically around 500 MB.
For example, all SCSI disks use some kind of translation, and many SCSI disks support hot swapping of sectors to fix bad sectors. This means that a SCSI disk maintains a set of unused sectors at the end of a disk. When a used sector goes bad, it is remapped to an unused sector and the data are written to the new sector. Windows NT uses absolute sector notation (also called logical sector notation, or LSN) for accessing disks. The translation of the sector number to the physical sector on the disk is handled by low-level disk device drivers and the hardware.
The translation is especially important when there are more than 1024 physical cylinders on the disk. The section titled "Using Hard Disks With More Than 1024 Cylinders (x86-based Computers)," presented later in this chapter, contains more details.
Multiple Zone Recording (MZR)
Some modern disks use MZR to solve the problem of wasted space on the outer tracks of the disk. The controller provides a layer of abstraction in disguising the physical layout of the sectors. The controller presents the disk to the system BIOS and the operating system as if each track had the same number of sectors per track.
MZR disks alter the operating frequency of the disk electronics, based on disk zones. Each zone is a contiguous group of cylinders. Using different frequencies means that each zone can have a different number of sectors per track. Since the zone frequency corresponds to the different data densities in each zone, the effect is to maintain a constant data density across the whole disk.
All this technology takes place entirely at the hardware level. The computer's operating system still sees the disk in the conventional logical layout of cylinders, heads, and sectors, where there is a constant number of sectors per cylinder.
When you format an MZR disk, you need to use the same parameters for sector size, tracks per cylinder, and sectors per track for all partitions.
CMOS (x86-based Computers)
The Complementary Metal Oxide Semiconductor (CMOS) chip in the computer stores information about the devices connected to the computer. When you install or change a non-SCSI disk in your computer, you need to use the BIOS setup program provided on your computer to update the information in the CMOS. (SCSI disks have their own configuration program, typically provided by the manufacturer.)
It is possible for the CMOS battery to run down if you do not turn your computer on for a long time. And the CMOS chip sometimes fails. See Chapter 21, "Troubleshooting Startup and Disk Problems," for information about identifying CMOS problems.
Logical Organization: Partitions, Volumes, Volume Set, and Stripe Sets
The Master Boot Record on each hard disk contains an area called the Partition Table that the computer uses to determine how to access the disk. It has room for four entries, called partitions, that you create to make it easier to organize information. A partition must be completely contained on one physical disk.
Use Disk Administrator to create and format partitions. The next figure is a Disk Administrator screen shot for a computer with a single disk.
Figure 17.4 Disk Administrator screen shot of primary partitions and an extended partition
Disk Administrator screen shows you the layout of each of your disks, including:
The remainder of this section describes partitions, and explains what you see in the Figure 17.4.
There are two types of partitions in the Master Boot Record, primary and extended. A primary partition is one into which you can install the files needed to load an operating system. A primary partition is formatted for a particular file system and is assigned a drive letter. Having multiple primary partitions enables you to install and start operating systems that do not use the same file system, such as Windows NT and UNIX. There are three primary partitions in Figure 17.4: C, D, and L.
You can have one extended partition on a hard disk. An extended partition is effectively a logical disk. Unlike a primary partition, you do not format the extended partition, nor does it get assigned a drive letter. Instead, you can create one or more logical drives within the extended partition, and each logical drive is assigned a drive letter. You format each logical drive for a particular file system.
An extended partition is a method for avoiding the four-partition limit and configuring a hard disk into more than four logical areas. An extended partition entry looks much like an entry for a primary partition in the Master Boot Record, except that it points to space on the disk that can contain one or more logical drives. The important information about an extended partition is how much of the disk it takes up and where it starts.
Note In this chapter, and other chapters in the "Reliability and Recoverability" part of this book, the term logical drive means a contiguous area in an extended partition, which is assigned a drive letter.
There is an extended partition in Figure 17.4, but it is not as obvious as the primary partitions. The extended partition consists of all the disk area between primary partitions D and L. If there are logical drives on a disk, then you have an extended partition on that disk. If you have free space for which the diagonal lines look like the ones for the 4 MB of free space to the left of L, then you have an extended partition on the disk.
Figure 17.4 shows an important point. The unpartitioned space at the end of the disk (to the right of primary partition L) cannot be used. You can have only three primary partitions and one extended partition on a hard disk, or four primary partitions. This disk already has the maximum for each of these types.
Note The distinction between the two areas of free space is that the one to the left of L is free space within an extended partition, while the free space on the right of L, which has a different background pattern, is not a part of any partition.
If you have more than one primary partition or logical drive on the same disk, you can format them for different file systems. However, the format program will use the same sector size, number of tracks per cylinder, and number of sectors per track for each partition or logical drive. The cluster size can be different for each one.
The system partition is the partition on a disk that contains the hardware-specific files used in loading and initializing the operating system. Only a primary partition can be used as a system partition. Some programs, such as Disk Administrator and the MS-DOS-based program Fdisk, use the term active partition to refer to the same thing. This book uses the term system partition unless it is specifically describing dialog boxes or menus that use the term active or active partition.
The boot partition is also used in starting the operating system. It contains the operating system files and other support files needed by the operating system. Both a primary partition and a logical drive in an extended partition can be used as a boot partition. The system partition and the boot partition can be the same partition, or they can even be on different disks. Chapter 19, "What Happens When You Start Your Computer," contains more information about the system and boot partitions.
Note To summarize, you can have as many as four primary partitions on a hard disk. If you have an extended partition on the disk, you can have up to three primary partitions. If the disk does not contain the system partition, you do not need to create any primary partitions. You can use the entire hard disk as an extended partition, and create as many logical drives within it as you want to have.
Windows NT requires that the system partition be a primary partition.
Some computers create an EISA configuration partition as the first primary partition on the hard disk. On these computers, you can only have three other primary partitions on the disk, or two primary partitions and one extended partition.
You create a volume set by combining multiple areas of free space on one or more hard disks into a single logical disk. When you create a volume set, Windows NT uses the HKEY_LOCAL_MACHINE \SYSTEM \DISK Registry subkey to access the areas on the disk(s) that are part of the volume set.
A volume set can be made from:
You use Disk Administrator to create and extend volume sets. See Disk Administrator Help for information about creating volume sets.
Each volume set can include up to 32 areas of free space from one or more physical disks. When creating a volume set, the free space can be an unallocated area within an extended partition, or an unpartitioned area elsewhere on the disk. Figure 17.4 shows a volume set E, which is made up of two areas in the extended partition on disk 0. Figure 17.4 also shows the two different types of free space. The free space between drives E and L is unallocated space in an extended partition. The free space at the right side of the screen shot is unpartitioned space.
You cannot use volume sets to avoid the limit of four Partition Table entries for a disk. For example, the Disk Administrator screen shot in Figure 17.4 shows three primary partitions (drives C, D, and L) and one extended partition. The free space between the second part of volume set E and the primary partition L is part of the extended partition. It can be used to create one or more logical drives in the extended partition. However, the free space to the right of primary partition L is wasted disk space, because there are already three primary partitions and an extended partition.
You can tell whether free space is unallocated space in an extended partition or is unpartitioned space, because the diagonal lines go in different directions for the two types of free space.
A stripe set is composed of unpartitioned areas on from 2 to 32 disks. You use Disk Administrator to create stripe sets. The amount of space used on each disk will be equal to the smallest unpartitioned space that you selected on the disks. Like volume sets, Windows NT must use the Registry subkey HKEY_LOCAL_MACHINE \SYSTEM \DISK to know how to access the disks.
Volume is the general term that refers to all of the following entities that you can create and use on a computer running Windows NT Workstation.
A volume has a single drive letter assigned to it, and is formatted for use by a file system.
Which Programs to Use to Create and Format Volumes
This section provides information about how to create and format volumes. You can create and format a volume in one of the following ways:
Note Converting a volume from the FAT file system to the NTFS file system can take a long time, depending on the amount of fragmentation and size of the FAT volume. For example, converting a 1 GB volume can take up to several hours. The conversion process has to read all of the files to build the information that NTFS needs to have about the data on the volume. When using the Convert program or converting the volume in Windows NT Setup, no status information is displayed to indicate that the conversion is proceeding. Although it looks like the conversion process is hung, it might just be taking a long time. For a large volume, it might be a good idea to run the file system conversion process overnight.
It might be faster to back up the data on the FAT volume to tape or a remote computer, reformat the volume as NTFS, and then restore the data.
If you create a single primary partition that occupies the entire disk, you cannot change the way your disk is organized without deleting the primary partition (which deletes all of the information in it) and creating new, smaller primary partitions or an extended partition. You have to back up the information that you need to save to a backup tape or a disk on a remote computer, reinstall Windows NT, and restore the data to the new volumes that you have created.
If there is no unpartitioned space left on your disk, the Create and Create Extended options on the Disk Administrator Partition menu are not available.
When you use Disk Administrator to create volumes, you have to write the changes to the Partition Table before you can format the volume. You can write the changes by using one of these methods:
If you have created a volume but not formatted it, Disk Administrator displays the volume as unformatted. You cannot access the volume in either My Computer or Windows NT Explorer until it has been formatted.
You cannot see an NTFS volume when you are running any operating system other than Windows NT. This means that your drive letters will probably be different when you are running Windows NT and other operating systems. For example, if you have two FAT volumes (C and E), and an NTFS volume (D), and you start MS-DOS, the second FAT volume will be labeled D. Because MS-DOS does not recognize the NTFS volume, the drive letter that was assigned to the NTFS volume when running Windows NT is used for the second FAT volume when running MS-DOS.
In Disk Administrator, you cannot delete the Windows NT boot partition when you are running Windows NT. You can delete the Windows NT boot partition if it is not the same primary partition as the system partition and you start another operating system that does not use the Windows NT boot partition as its boot partition.
Formatting Hard Disks and Floppy Disks
Before you can use a hard disk or a floppy disk, you must format the disk.
There are three steps to formatting a hard disk:
Formatting a floppy disk is much simpler than formatting a hard disk, because there are fewer steps. You cannot create partitions on a floppy disk, so there are only two steps:
When you format a floppy disk, the format program performs both a low-level format and a logical format, so there is really only one step. However, the low-level format on a floppy disk is not as thorough as on a hard disk.
The rest of this section discusses low-level formatting, creating primary partitions or volumes, and logical formatting. See the section "Which Programs to Use to Create and Format Volumes," presented earlier in this chapter, for more details.
Each disk vendor provides the low-level format program to use for the disk. Consult your disk documentation or contact the vendor to find out how to do low-level formatting.
Each low-level format program determines the correct sector size to use, the number of tracks, and the number of sectors per track. This format program selects sector size based upon the disk and the information about the sectors in its circuitry. The program for almost all disks used in the United States uses a sector size of 512 bytes. The program also writes error correction and sector identification information for each sector onto the disk.
SCSI disks should always be low-level formatted when put on a new controller. The reason for this is that the translation in use on the disk varies from controller to controller, and can even vary between two identical controllers based upon the controller settings.
On x86-based computers, you must enable the BIOS on the SCSI controller if your system partition in on a SCSI disk. Depending upon your disk configuration, you might need to turn off translation in the SCSI controller. Also make sure that the CMOS has no entries for SCSI disks. For more information about the SCSI controller, see Chapter 20, "Preparing for and Performing Recovery."
There are some older IDE disks that you should not low-level format, because the factory formatting puts information on the disk that a low-level format erases. However, newer IDE disks, and all enhanced IDE disks (also known as EIDE) need to be low-level formatted. You must configure an IDE or EIDE disk in the CMOS before you can use it on the computer. See your hardware documentation for information about changing information in the CMOS.
If you have created and formatted volumes on your hard disk, but are getting errors from Chkdsk or other disk scan utilities about bad sectors on your disk, the only way to permanently eliminate them is to do a low-level format. Low-level formatting maps around the bad sectors. However, a low-level format erases all data on the disk. Therefore, be sure to back up any data on the disk before you low-level format it. You then need to create volumes (primary partitions or logical drives in an extended partition), and logically format them before you can restore the data to the disk.
Caution Do not low-level format IDE hard disks unless the manufacturer's literature describes that you should do so.
Creating Partitions on the Disk
When you create primary partitions or an extended partition on a disk, you logically divide it into one or more areas that can be formatted for use by a file system. The first partition on the disk (whether it is a primary partition or an extended partition) always starts at the outside of the disk, at cylinder 0, head 0, and sector 1. Because partition boundaries are always cylinder boundaries, the smallest partition that you can create on a disk consists of all of the tracks on a single cylinder.
When you have Windows NT installed on your computer, you should use Disk Administrator to create partitions. However, if you are setting up a new computer, you might not have any operating system. But you still need to create and format a partition into which to install Windows NT.
On x86-based computers, if you have an MS-DOS bootable floppy disk with the Fdisk program on it, you can start your computer from the MS-DOS floppy disk and create partitions by using Fdisk. On RISC-based computers, you can use the Arcinst program on the Windows NT Workstation CD to create partitions. Windows NT Setup displays an option to create a partition to use for Windows NT, provided that there is enough unpartitioned space on a hard disk.
Note On x86-based computers, you might not be able to access all your hard disk when using fdisk. If you have a disk that is larger than 4 gigabyte (GB), MS-DOS cannot see the space beyond 4 GB. Depending on the geometry, this limitation could even be 1 GB, because MS-DOS cannot access volumes that go beyond cylinder 1023. If you have more than 2 SCSI disks, MS-DOS generally does not see any disks after the first two, unless you load a SCSI device driver.
When you create the first partition on a disk (either a primary partition or an extended partition), the program that you use creates the Master Boot Record and writes it to the first sector on the disk (cylinder 0, head 0, sector 1). The Master Boot Record contains the Partition Table, which has information about each partition defined on the disk. When you make any changes to volumes on the disk, such as creating, deleting, or formatting them, the program that you are using updates the Partition Table.
You can configure the entire disk as one primary partition, and logically format it for one file system. Or you can create more than one primary partition, and use different file systems on them. You can also create an extended partition, and create one or more logical drives within the extended partition.
For more information about partitions, logical drives, and extended partitions, see "Logical Organization: Partitions, Volumes, Volume Sets, and Stripe Sets," presented earlier in this chapter. For more information about the Master Boot Record and Partition Table, see "Disk Sectors Critical to the Startup Process," presented later in this chapter.
Before you can write any data to the volume, you must do a logical format; that is, format it for use by a file system. Logical formatting writes information needed by the file system onto the disk. The information includes:
There is more information about each of these data in the remainder of this chapter.
When you have Windows NT installed on your computer, you should use Disk Administrator to format the partitions.
On x86-based computers, you can format primary partitions and logical drives for the FAT file system before you install any operating systems by starting the computer from a MS-DOS bootable floppy disk that has the Format program on it. You can use the Format program only for volumes that do not go beyond cylinder 1023.
On Alpha-based computers and MIPS-based computers, you can run the Arcinst program from the Windows NT Workstation CD to format the hard disk.
On both x86-based computers and RISC-based computers, you can create and format a primary partition to use for Windows NT during Setup, provided that there is enough unpartitioned space on a hard disk.
About File Systems
This section contains information about the two file systems that Windows NT supports:
With Windows NT, you can create and use long filenames as well as short filenames. Long and short filenames can be used on both NTFS or FAT volumes. A long filename can be up to 256 characters long. Short filenames are in the format xxxxxxxx.yyy, and are compatible with MS-DOS and OS/2.
Information about long and short filenames that is unique to each file system is described in the "Filenames on FAT Partitions" and "Filenames on NFTS Partitions" sections, presented later in this chapter. The section "Generating and Viewing Short Filenames," presented later in this chapter, contains general information about short filenames for both NTFS and FAT volumes.
The FAT File System
The FAT file system is a simple file system originally designed for small disks and simple folder structures. The FAT file system is named for its method of organization, the file allocation table, which resides at the†beginning of the volume. To protect the volume, two copies of the table†are kept, in case one becomes damaged. In addition, the file allocation tables and†the root folder must be stored in a fixed location so that the†files needed to start the system can be correctly located.
A volume formatted with the FAT file system is allocated in clusters. The default cluster size is†determined by the size of the volume. For the FAT file system, the cluster number must fit in 16 bits and must be a power of two. The default cluster sizes are shown in the following table. You can specify a different cluster size if you format an FAT volume by using the format program from the command prompt. However, the size you specify cannot be less than that shown in the table.
The FAT file system is not recommended for volumes larger than 511 MB because of its overhead. You cannot use the FAT file system on volumes larger than 4†GB, regardless of the cluster size.
Note On volumes with the number of sectors less than 32680, the cluster sizes can be up to 8 sectors per cluster. The format program, whether you format the volume by using Disk Administrator or run format at the command prompt, creates a 12-bit FAT. Volumes less than 16 MB†will usually be formatted for 12-bit FAT, but the exact size depends on the disk geometry. The disk geometry also determines the point at which a larger cluster size will be needed, because the number of clusters on the volume must fit into 16 bits. Therefore, you might have a 33 MB volume that still has only 1 sector per cluster.
Structure of a FAT Volume
Figure 17.5 illustrates how the FAT file system organizes a volume. See the section titled "Relative Sectors and Number of Sectors Fields," presented later in this chapter, for information about the area between the Partition Boot Sector and FAT1.
Figure 17.5 Organization of FAT volume
The file allocation table (areas FAT1 and FAT2 in Figure 17.5) contains the following types of information about each cluster on the volume:
The root folder contains an entry for each file and folder on the root. The only difference between the root folder and other folders is that the root folder is on a specified location on the disk and has a fixed size (512 entries for a hard disk, number of entries on a floppy disk depends on the size of the disk).
Folders have a 32-byte entry for each file and folder contained in the folder. The entry includes the following information:
There is no organization to the FAT folder structure, and files are†given the first available location on the volume. The starting cluster number is the address of the first cluster used by the file. Each cluster contains a pointer to the next cluster in the file, or an indication (0xFFFF) that this cluster is the end of the file. These links and end of file indicators are shown in Figure 17.6.
Figure 17.6 File Allocation Table†
This illustration shows three files. The file File1.txt is a file that is large enough to use three clusters. A small file, File3.txt, fits completely in one cluster. The third file, File2.txt, is a fragmented file that also requires three clusters. In each case, the folder entry points to the first cluster of the file.
The information in the folder is used by all operating systems that support the FAT file system. In addition, Windows NT can store additional time stamps in a FAT folder entry. These time stamps show when the file was created or last accessed and are used principally by POSIX applications.
Because all entries in a folder are the same size, the attribute byte for each entry in a folder describes what kind of entry it is. One bit indicates that the entry is for a subfolder, while another bit marks the entry as a volume label. Normally, only the operating system controls the settings of these bits.
A FAT file has four attributes bits that can be turned on or off by the user — archive file, system file, hidden file, and read-only file.
Filenames on FAT Volumes
Beginning with Windows NT 3.5, files created or renamed on FAT volumes use the attribute bits to support long filenames in a way that does not interfere with how MS-DOS or OS/2 accesses the volume. Whenever a user creates a file with a long filename, Windows NT creates an eight-plus-three name for the file. In addition to this conventional entry, Windows NT creates one or more secondary folder entries for the file, one for each 13 characters in the long filename. Each of these secondary folder entries stores a corresponding part of the long filename in Unicode. Windows NT sets the volume, read-only, system, and hidden file attribute bits of the secondary folder entry to mark it as part of a long filename. MS-DOS and OS/2 generally ignore folder entries with all four of these attribute bits set, so these entries are effectively invisible to these operating systems. Instead, MS-DOS and OS/2 access the file by using the conventional eight-plus-three filename contained in the folder entry for the file.
Figure 17.7 shows all of the folder entries for the file Thequi~1.fox, which has a long name of The quick brown.fox. The long name is in Unicode, so each character in the name uses two bytes in the folder entry. The attribute field for the long name entries has the value 0x0F. The attribute field for the short name is 0x20.
Figure 17.7 Long filename on a FAT volume†
Note Windows NT and Windows 95 use the same algorithm to create long and short filenames. On computers that dual-boot these two operating systems, files that you create when running one of the operating systems can be accessed when running the other.
For information about how Windows NT creates the short filename, see "Generating and Viewing Short Filenames," presented later in this chapter.
By default, Windows NT versions 3.5 and higher support long filenames on FAT volumes. You can turn off creation of long filenames by setting the Win31FileSystem parameter in the following Registry entry to 1:
HKEY_LOCAL_MACHINE \System \CurrentControlSet \Control \FileSystem
Setting this value prevents Windows NT from creating new long filenames on all FAT volumes, but it does not affect existing long filenames.
Using the FAT File System with Windows NT
The FAT file system works the same in Windows NT as it does in MS-DOS, Windows 3.1x, and Windows 95. In fact, you can install Windows NT on an existing FAT primary partition or logical drive. When running Windows NT, you can move or copy files between FAT and NTFS volumes.
Note You cannot use Windows NT with any compression or partitioning software that requires disk drivers to be loaded by MS-DOS. Therefore, you cannot use MS-DOS 6.0 DoubleSpace‚ or MS-DOS 6.22 DiskSpaceš on a FAT primary partition or logical drive that you want to access when running Windows NT.
If you have a dual-boot configuration with Windows 95, you can create FAT partitions when running Windows 95 that you cannot use when running Windows NT. See the section "System ID Field," presented later in this chapter, for details.
The NTFS File System
The Windows NT file system (NTFS) provides a combination of performance, reliability, and compatibility not found in the FAT file system. It is designed to quickly perform standard file operations such as read, write, and search — and even advanced operations such as file-system recovery — on very large hard disks.
The NTFS file system includes security features required for file servers and high-end personal computers in a corporate environment. The NTFS file system also supports data access control and ownership privileges that are important for the integrity of critical data. While folders shared on a Windows NT computer are assigned particular permissions, NTFS files and folders can have permissions assigned whether they are shared or not. NTFS is the only file system on Windows NT that allows you to assign permissions to individual files. However, when you move or copy a file from an NTFS to a FAT volume, permissions and other attributes unique to the NTFS file system are lost.
The NTFS file system has a simple, yet very powerful design. Basically, everything on the volume is a file and everything in a file is an attribute, from the data attribute, to the security attribute, to the file name attribute. Every sector on an NTFS volume that is allocated belongs to some file. Even the file system metadata (information that describes the file system itself) is part of a file.
Structure of an NTFS Volume
Like the FAT file system, the NTFS file system uses clusters as the fundamental unit of disk allocation. In the NTFS file system, the default cluster size depends on the volume size. In Disk Administrator, you can specify a cluster size up to 4K. If you use the command prompt program format to format your NTFS volume, you can specify any cluster size shown in the next table.
The default cluster sizes for the NTFS file system are shown in the following table.
Note You cannot use NTFS compression when your cluster size is greater than 4K. See "NTFS Compression" in Chapter 18, "Choosing a File System," for more information.
Formatting a volume with the NTFS file system results in the creation of several system files and the Master File Table (MFT), which contains information about all the files and folders on the NTFS volume.
The first information on an NTFS volume is the Partition Boot Sector, which starts at sector 0 and can be up to 16 sectors long. It consists of two structures:
The first file on an NTFS volume is the Master File Table (MFT). The next section of this chapter, "Master File Table and the NTFS System Files," contains more information.
The following figure illustrates the layout of an NTFS volume when formatting has finished.
Figure 17.8 NTFS volume layout†
Master File Table (MFT) and NTFS System Files
When you format an NTFS volume, the format program creates a set of files that contains the metadata used to implement the file system structure. The NTFS file system reserves the first 16 records in the MFT for the information about these metadata files. The NTFS file system uses approximately 1 MB for the metadata files and the first 16 records in the MFT. The next table describes these records.
The first record of the MFT describes the MFT itself, followed by the MFT mirror record. If the first MFT record is corrupted, the NTFS file system reads the second record to find the MFT mirror file, which is a copy of the first three records of the MFT. The locations of the data segments for both the MFT and the MFT mirror file are recorded in the Partition Boot Sector. A duplicate of the Partition Boot Sector is located at the end of the volume (Windows NT version 4.0) or the logical center of the volume (Windows NT version 3.51 and earlier).
The third record of the MFT is the log file, which the operating system uses to restore consistency to the NTFS file system in the event of a system crash. The log file size depends upon the volume size, and can be as large as 4 MB. The log file is discussed in more detail in the section titled "NTFS Recoverability" in Chapter 18, "Choosing a File System."
The MFT contains records that describe each file on an NTFS volume. The NTFS file system allocates space for each of the MFT records based upon the cluster size. The attributes of a file are written to the allocated space in the MFT. Small files and folders, such as the file illustrated in Figure 17.9, can be contained entirely within the MFT record.
Figure 17.9 MFT Record for a Small File or Folder†
Records for folders are contained within the MFT, just like records for files. All of the information for small folders reside entirely within the MFT record. Large folders are organized into B-trees, having records with pointers to external clusters containing folder entries that could not be contained within the MFT structure.
NTFS File Attributes
The NTFS file system views each file (or folder) as a set of file attributes. Elements such as the file's name, its security information, and even its data, are all file attributes. Each attribute is identified by an attribute type code and, optionally, an attribute name.
When a file's attributes can fit within the MFT file record, they are called resident attributes. For example, information such as filename and time stamp are always included in the MFT file record. When all of the information for a file is too large to fit in the MFT file record, some of its attributes are nonresident. The nonresident attributes are allocated one or more clusters of disk space elsewhere in the volume. NTFS creates the Attribute List attribute to describe the location of all of the attribute records.
Table 17.2 lists all of the file attributes currently defined by the NTFS file system. This list is extensible, meaning that other file attributes can be defined in the future.
Filenames on NTFS Volumes
By default, Windows NT version 3.5 and later support MS-DOS-readable filenames on all NTFS volumes. To improve performance on volumes with many long, similar names, you can disable this feature by setting the NtfsDisable8dot3NameCreation parameter of the following Registry entry to 1:
HKEY_LOCAL_MACHINE \System \CurrentControlSet \Control \FileSystem
Windows NT does not generate short (eight-plus-three) filenames for files created by POSIX-based applications on an NTFS volume. This means that MS-DOS-based and Windows-based applications cannot view these filenames if they are not valid eight-plus-three filenames. If you want to use files that are created by a POSIX application with MS-DOS-based or Windows-based applications, be sure to use standard MS-DOS eight-plus-three naming conventions.
For general information about long and short filenames for both FAT and NTFS volumes, see the section "Generating and Viewing Short Filenames," presented later in this chapter.
Using MS-DOS-based Disk Programs
Do not use any third-party MS-DOS-based disk program to repair or defragment a FAT primary partition or logical drive used by Windows NT unless the disk program has been certified as being compatible with Windows NT version 3.5 or later. While instances of third-party utilities corrupting FAT volumes are relatively rare, some problems have occurred. Using non-Windows NT utilities is simply not worth the risk of losing an entire volume. Even the MS-DOS-based program Defrag might not work correctly if you have long filenames in the FAT volume.
You can use the Windows NT command prompt program Chkdsk to scan and repair FAT and NTFS volumes. This program incorporates all of the functionality of the MS-DOS-based Chkdsk and Scandisk utilities, including a surface scan. To do a surface scan, use chkdsk /r.
There is a Windows NT–based program available that can defragment both FAT and NTFS volumes. Microsoft has a directory that contains information about hardware and software products that are available for Windows NT, including defragmentation utilities. This directory is called InfoSource. For information about InfoSource, see http://www.microsoft.com/infosource.
Disk media verification can be done with the SCSI utilities that ship with most SCSI controllers. Consult the documentation accompanying your hardware or contact your hardware vendor for information on verification of disk media. It is always a good idea to do a complete backup of the disk before starting a procedure of this type.
Generating and Viewing Short Filenames
Filenames on Windows NT platforms can be up to 256 characters, and can contain spaces, multiple periods, and special characters that are illegal in MS-DOS filenames. These long filenames use the 16-bit Unicode character set. Windows NT makes it possible to access files with long names from other operating systems by automatically generating an MS-DOS-readable (eight-plus-three) name for each file. This way, files are accessible over a network by computers using the MS-DOS, Windows 3.1x, and OS/2 operating systems, as well as by computers using Windows NT and Windows 95 operating systems.
By creating eight-plus-three filenames for files, Windows NT also enables MS-DOS-based and Windows-based 3.x applications to recognize and load files that have long filenames. In addition, when an application saves a file on a computer running Windows NT, both the eight-plus-three filename and long filename are retained.
Note Use caution with MS-DOS-based or Windows 3.x-based applications when running under Windows NT. With these applications, if you save a file to a temporary file, delete the original file, and rename the temporary file to the original filename, the long filename is lost. Any unique permissions set on that file are also lost.
If the long name of a file or folder contains spaces, be sure to surround the name with quotation marks. For instance, if you have a program called DUMP DISK FILES that you want to run from the Start icon and you enter the name without quotation marks, you will get an error message that says "cannot find the program DUMP or one of its components."
You must also use quotation marks when a path typed at the command line includes spaces, as in the following example:
move "c:\This month's reports\*.*" "c:\Last month's reports"
Use wildcards such as * and ? carefully in conjunction with the del and copy command prompt commands. Windows NT searches both long and short filenames for matches to the wildcard combination you specify, which can cause extra files to be deleted or copied.
To copy or move files with case-sensitive long filenames, it is safest to select the files using a mouse in Windows NT Explorer and My Computer. That way, you can clearly identify which files you want to copy or move.
Because both the FAT file system and the NTFS file system use the Unicode character set for their names, there are several illegal characters that MS-DOS cannot read in any filename. To generate a short MS-DOS-readable filename for a file, Windows NT deletes all of these characters from the long filename and removes any spaces. Since an MS-DOS-readable filename can have only one period, Windows NT also removes all extra periods from the filename. Next, Windows NT truncates the filename, if necessary, to six characters and appends a tilde (~) and a number. For example, each nonduplicate filename is appended with ~1. Duplicate filenames end with ~2, ~3, and so on. Filename extensions are truncated to three or fewer characters. Finally, when displaying filenames at the command line, Windows NT translates all characters in the filename and extension to uppercase.
When there are five or more files that would result in duplicate short filenames, Windows NT uses a slightly different method for creating short filenames. For the fifth and subsequent files, Windows NT:
This method provides substantially improved performance when Windows NT must create short filenames for a large number of files with similar long filenames. Windows NT uses this method to create short filenames for both FAT and NTFS volumes.
For example, these are the long and short filenames for six files that you create in the order test 1 through test 6.
However, when you create the files in the order shown in this table, you get the following short filenames.
Windows NT displays the long names for folders and files. You can use Windows NT Explorer and My Computer to see the short name by selecting the file or folder and selecting Properties on the File menu.
From the command line, to see both the long and short filenames for each file in the folder, type the following command:
Tip To display both long and short filenames automatically when using the dir command, use the System option in Control Panel to set the dircmd variable to the value /x.
Disk Sectors Critical to the Startup Process
There are two sectors on every startup disk that are critical to starting the computer:
These sectors contain both executable code and the data required by the code. For more information about the startup process, see Chapter 19, "What Happens When You Start Your Computer." For a description of problems that you might encounter with these two sectors, see Chapter 21, "Troubleshooting Startup and Disk Problems."
Note Numbers larger than one byte are stored on x86-based computers in little endian format. For example, the sample value for the Relative Sector field in Table 17.3, 0x3F000000, is a little endian representation of 0x0000003F. The decimal equivalent of this little endian number is 63. Because most problems with the Master Boot Record and Partition Boot Sector occur on x86-based computers, the examples of these disk sectors are hexidecimal dumps from x86-based computers.
Master Boot Record
The Master Boot Record, created when you create the first partition on the hard disk, is probably the most important data structure on the disk. It is the first sector on every disk. The location is always track (cylinder) 0, side (head) 0, and sector 1.
The Master Boot Record contains the Partition Table for the disk and a small amount of executable code. On x86-based computers, the executable code examines the Partition Table, and identifies the system partition. The Master Boot Record then finds the system partition's starting location on the disk, and loads an copy of its Partition Boot Sector into memory. The Master Boot Record then transfers execution to executable code in the Partition Boot Sector.
Note Although there is a Master Boot Record on every hard disk, the executable code in the sector is used only if the disk is connected to an x86-based computer and the disk contains the system partition.
Figure 17.10 shows a hex dump of the sector containing the Master Boot Record. The figure shows the sector in two parts. The first part is the Master Boot Record, which occupies the first 446 bytes of the sector. The disk signature (FD 4E F2 14) is at the end of the Master Boot Record code. The second part is the Partition Table.
Physical Sector: Cyl 0, Side 0, Sector 1
00000000: 00 33 C0 8E D0 BC 00 7C - 8B F4 50 07 50 1F FB FC .3.....|..P.P.. 00000010: BF 00 06 B9 00 01 F2 A5 - EA 1D 06 00 00 BE BE 07 ................ 00000020: B3 04 80 3C 80 74 0E 80 - 3C 00 75 1C 83 C6 10 FE ...<.t..<.u..... 00000030: CB 75 EF CD 18 8B 14 8B - 4C 02 8B EE 83 C6 10 FE .u......L....... 00000040: CB 74 1A 80 3C 00 74 F4 - BE 8B 06 AC 3C 00 74 0B .t..<.t.....<.t. 00000050: 56 BB 07 00 B4 0E CD 10 - 5E EB F0 EB FE BF 05 00 V.......^....... 00000060: BB 00 7C B8 01 02 57 CD - 13 5F 73 0C 33 C0 CD 13 ..|...W.._s.3... 00000070: 4F 75 ED BE A3 06 EB D3 - BE C2 06 BF FE 7D 81 3D Ou...........}.= 00000080: 55 AA 75 C7 8B F5 EA 00 - 7C 00 00 49 6E 76 61 6C U.u.....|..Inval 00000090: 69 64 20 70 61 72 74 69 - 74 69 6F 6E 20 74 61 62 id partition tab 000000A0: 6C 65 00 45 72 72 6F 72 - 20 6C 6F 61 64 69 6E 67 le.Error loading 000000B0: 20 6F 70 65 72 61 74 69 - 6E 67 20 73 79 73 74 65 operating syste 000000C0: 6D 00 4D 69 73 73 69 6E - 67 20 6F 70 65 72 61 74 m.Missing operat 000000D0: 69 6E 67 20 73 79 73 74 - 65 6D 00 00 80 45 14 15 ing system...E.. 000000E0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000000F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000100: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000110: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000120: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000130: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000140: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000150: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000160: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000170: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000180: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 00000190: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000001A0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 00 00 ................ 000001B0: 00 00 00 00 00 00 00 00 - FD 4E F2 14 00 00 .........N...... 80 01 .. 000001C0: 01 00 06 0F 7F 96 3F 00 - 00 00 51 42 06 00 00 00 .....?...QB.... 000001D0: 41 97 07 0F FF 2C 90 42 - 06 00 A0 3E 06 00 00 00 A....,.B...>.... 000001E0: C1 2D 05 0F FF 92 30 81 - 0C 00 A0 91 01 00 00 00 .-....0......... 000001F0: C1 93 01 0F FF A6 D0 12 - 0E 00 C0 4E 00 00 55 AA ...........N..U.
Figure 17.10 Hex Dump of the Master Boot Record for an x86-based computer†
The disk signature is a unique number at offset 0x1B8 that Windows NT uses as an index to store and retrieve information about the disk in the Registry subkey HKEY_LOCAL_MACHINE \SYSTEM \DISK.
The first time that you open Disk Administrator after formatting a hard disk, it displays this dialog box to inform you that no disk signature was found on the disk. You should select Yes, or Windows NT will not be able to access the disk.
Viruses Can Infect the Master Boot Record
Many destructive viruses damage the Master Boot Record and make it impossible to start the computer from the hard disk. Because the code in the Master Boot Record executes before any operating system is started, no operating system can detect or recover from corruption of the Master Boot Record. You can use the DiskProbe program on Windows NT Workstation Resource Kit CD to display the Master Boot Record, and compare it to the Master Boot Record shown in Figure 17.10. There are also utilities on the Resource Kit that enable you to save and restore the Master Boot Record. See Chapter 21, "Troubleshooting Startup and Disk Problems," and Chapter 22, "Disk, File System, and Backup Utilities," for more information.
The information about primary partitions and an extended partition is contained in the Partition Table, a 64-byte data structure located in the same sector as the Master Boot Record (cylinder 0, head 0, sector 1). The Partition Table conforms to a standard layout that is independent of the operating system. Each Partition Table entry is 16 bytes long, making a maximum of four entries available. Each entry starts at a predetermined offset from the beginning of the sector, as follows:
The last two bytes in the sector are a signature word for the sector and are always 0x55AA.
The next figure is a printout of the Partition Table for the disk shown in Figure 17.4, presented earlier in this chapter. When there are fewer than four partitions, the remaining fields are all zeros.
80 01 .. 000001C0: 01 00 06 0F 7F 96 3F 00 - 00 00 51 42 06 00 00 00 .....?...QB.... 000001D0: 41 97 07 0F FF 2C 90 42 - 06 00 A0 3E 06 00 00 00 A....,.B...>.... 000001E0: C1 2D 05 0F FF 92 30 81 - 0C 00 A0 91 01 00 00 00 .-....0......... 000001F0: C1 93 01 0F FF A6 D0 12 - 0E 00 C0 4E 00 00 55 AA ...........N..U.
Figure 17.11 Partition Table from an x86-based computer†
The following table describes each entry in the Partition Table. The sample values correspond to the information for partition 1 in Figure 17.11.
The remainder of this section describes the uses of these fields. Definitions of the fields in the Partition Table is the same for primary partitions, extended partitions, and logical drives in extended partitions.
Boot Indicator Field
The Boot Indicator field indicates whether the volume is the system partition. On x-86-based computers, only one primary partition on the disk should have this field set. This field is used only on x86-based computers. On RISC-based computers, the NVRAM contains the information for finding the files to load.
On x86-based computers, it is possible to have different operating systems and different file systems on different volumes. For example, a computer could have MS-DOS on the first primary partition and Windows 95, UNIX, OS/2, or Windows NT on the second. You control which primary partition to use to start the computer by setting the Boot Indicator field for that partition in the Partition Table. For a description of how to set the field, see the section "Setting the System Partition," in Chapter 19, "What Happens When You Start Your Computer."
System ID Field
For primary partitions and logical drives, the System ID field describes the file system used to format the volume. Windows NT uses this field to determine what file system device drivers to load during startup. It also identifies the extended partition, if there is one defined.
These are the values for the System ID field:
Figure 17.11, presented earlier in this section, has examples of a BIGDOS FAT partition, an NTFS partition, an extended partition, and a 12-bit FAT partition.
If you install Windows NT on a computer that has Windows 95 preinstalled, the FAT partitions might be shown as unknown. If you want to be able to use these partitions when running Windows NT, your only option is to delete the partitions.
OEM versions of Windows 95 support the following four partition types for FAT file systems that Windows NT cannot recognize.
When you create a volume set or a stripe set, Disk Administrator sets the high bit of the System ID field for each primary partition or logical drive that is a member of the volume. For example, a FAT primary partition or logical drive that is a member of a volume set or a stripe set has a System ID value of 0x86. An NTFS primary partition or logical drive has a System ID value of 0x87. This bit indicates that Windows NT needs to use the HKEY_LOCAL_MACHINE \SYSTEM \DISK Registry subkey to determine how the members of the volume set or stripe set relate to each other. Volumes that have the high bit set can only be accessed by Windows NT.
When a primary partition or logical drive that is a member of a volume set or a stripe set has failed due to write errors or cannot be accessed, the second most significant bit is set. The System ID byte is set to C6 in the case of a FAT volume, or C7 in the case of an NTFS volume.
Note If you start up MS-DOS, it can only access primary partitions or logical drives that have a value of 0x01, 0x04, 0x05, or 0x06 for the System ID. However, you should be able to delete volumes that have the other values. If you use a MS-DOS-based low-level disk editor, you can read and write any sector, including ones that are in NTFS volumes.
On Windows NT Server, mirror sets and stripe sets with parity also require the use of the Registry subkey HKEY_LOCAL_MACHINE \SYSTEM \DISK to determine how to access the disks.
Starting and Ending Head, Sector, and Cylinder Fields
On x86-based computers, the Starting and Ending Head, Cylinder, and Sector fields on the startup disk are very important for starting up the computer. The code in the Master Boot Record uses these fields to find and load the Partition Boot Sector.
The Ending Cylinder field in the Partition Table is ten bits long, which limits the maximum number of cylinders that can be described in the Partition Table to 1024. The Starting and Ending Head fields are one byte long, which limits this field to the range 0 – 255. The Starting and Ending Sector field is 6 bits long, limiting its range to 0 – 63. However, sectors start counting at 1 (versus 0 for the other fields), so the maximum number of sectors per track is 63.
Since current hard disks are low-level formatted with the industry standard 512-byte sector size, the maximum capacity disk that can be described by the Partition Table can be calculated as follows:
MaxCapacity = (sector size) x (sectors per track) x (cylinders) x (heads)
Substituting the maximum possible values yields:
512 x 63 x 1024 x 256 = 8,455,716,864 bytes or 7.8 GB
The maximum formatted capacity is slightly less than 8 GB.
However, the maximum cluster size that you can use for FAT volumes when running Windows NT is 64K, when using a 512 byte sector size. Therefore, the maximum size for a FAT volume is 4 GB.
If you have a dual-boot configuration with Windows 95 or MS-DOS, FAT volumes that might be accessed when using either of those operating systems are limited to 2 GB. In addition, Macintosh computers that are viewing volumes on a computer running Windows NT cannot see more than 2 GB. If you try to use a FAT volume larger than 2 GB when running MS-DOS or Windows 95, or access it from a Macintosh computer, you might get a message that there are 0 bytes available. The same limit applies to OS/2 system and boot partitions.
The maximum size of a FAT volume on a specific computer depends on the disk geometry, and the maximum values that can fit in the fields described in this section. The next table shows the typical size of a FAT volume when translation is enabled, and when it is disabled. The number of cylinders in both situations is 1024.
Note RISC-based computers do not have a limit on the size of the system or boot partitions.
If a primary partition or logical drive extends beyond cylinder 1023, all of these fields will contain the maximum values.
Relative Sectors and Number of Sectors Fields
For primary partitions, the Relative Sectors field represents the offset from the beginning of the disk to the beginning of the partition, counting by sectors.†The Number of Sectors field represents the total number of sectors in the partition. For a description of these fields in extended partitions, see the section "Logical Drives and Extended Partitions," presented later in this chapter.
Windows NT uses these fields to access all partitions. When you format a partition when running Windows NT, it puts data into the Starting and Ending Cylinder, Head, and Sector fields only for backward compatibility with MS-DOS and Windows 95, and to maintain compatibility with the BIOS interrupt (INT) 13 for startup purposes.
See the section titled "Using Hard Disks With More Than 1024 Cylinders (x86-based Computers)," presented later in this chapter, for more information about the use of these fields.
Logical Drives and Extended Partitions
When more than four logical disks are required on a single physical disk, the first partition should be a primary partition. The second partition can be created as an extended partition, which can contain all the remaining unpartitioned space on the disk.
Note A primary partition is one that can be used as the system partition. If the disk does not contain a system partition, you can configure the entire disk as a single, extended partition.
Some computers create an EISA configuration partition as the first partition on the hard disk.
Windows NT detects an extended partition because the System ID byte in the Partition Table entry is set to 5. There can be only one extended partition on a hard disk.
Within the extended partition, you can create any number of logical drives. As a practical matter, the number of available drive letters is the limiting factor in the number of logical drives that you can define.
When you have an extended partition on the hard disk, the entry for that partition in the Partition Table (at the end of the Master Boot Record) points to the first disk sector in the extended partition. The first sector of each logical drive in an extended partition also has a Partition Table, which is the last 66 bytes of the sector. (The last two bytes of the sector are the end-of-sector marker.)
These are the entries in an extended Partition Table:
This format repeats for every logical drive. The last logical drive has only its own partition entry listed. The entries for partitions 2-4 are all zeroes.
The Partition Table entry is the only information on the first side of the first cylinder of each logical drive in the extended partition. The entry for partition 1 in each Partition Table contains the starting address for data on the current logical drive. And the entry for partition 2 is the address of the sector that contains the Partition Table for the next logical drive.
The use of the Relative Sector and Total Sectors fields for logical drives in an extended partition is different than for primary partitions. For the partition 1 entry of each logical drive, the Relative Sectors field is the sector from the beginning of the logical drive that contains the Partition Boot Sector. The Total Sectors field is the number of sectors from the Partition Boot Sector to the end of the logical drive.
For the partition 2 entry, the Relative Sectors field is the offset from the beginning of the extended partition to the sector containing the Partition Table for the logical drive defined in the Partition 2 entry. The Total Sectors field is the total size of the logical drive defined in the Partition 2 entry.
Note If a logical drive is part of a volume set, the Partition Boot Sector is at the beginning of the first member of the volume set. Other members of the volume set have data where the Partition Boot Sector would normally be located.
This Disk Administrator screen shot shows a disk having an extended partition. The extended partition contains a volume set (drive E), two logical drives (drives I and K), and 4 MB of free space. This screen shot is identical to the one shown in Figure 17.4.
The following example is a printout from the DiskMap program of the information in the Master Boot Record (the section titled MBR) and the extended Partition Table entries (the sections titled EBR) for the disk configuration shown in the preceding Disk Administrator screen shot. For information about DiskMap, see Chapter 22, "Disk, File System, and Backup Utilities."
MBR: Starting Ending System Relative Total Cylinder Head Sector Cylinder Head Sector ID Sector Sectors * 0 1 1 406 15 63 0x06 63 410193 407 0 1 812 15 63 0x07 410256 409248 813 0 1 914 15 63 0x05 819504 102816 915 0 1 934 15 63 0x01 922320 20160 EBR: (sector 819504) Starting Ending System Relative Total Cylinder Head Sector Cylinder Head Sector ID Sector Sectors 813 1 1 832 15 63 0x87 63 20097 833 0 1 848 15 63 0x05 20160 16128 EBR: (sector 839664) Starting Ending System Relative Total Cylinder Head Sector Cylinder Head Sector ID Sector Sectors 833 1 1 848 15 63 0x01 63 16065 849 0 1 872 15 63 0x05 36288 24192 EBR: (sector 855792) Starting Ending System Relative Total Cylinder Head Sector Cylinder Head Sector ID Sector Sectors 849 1 1 872 15 63 0x07 63 24129 873 0 1 905 15 63 0x05 60480 33264 EBR: (sector 879984) Starting Ending System Relative Total Cylinder Head Sector Cylinder Head Sector ID Sector Sectors 873 1 1 905 15 63 0x87 63 33201 0 0 0 0 0 0 0x00 0 0
Partition Boot Sector
The Partition Boot Sector contains information that the file system uses to access the volume. On x86-based computers, the Master Boot Record use the Partition Boot Sector on the system partition to load the operating system kernel files, or in the case of Windows NT, the boot loader.
The Windows NT Partition Boot Sector consists of:
The BIOS Parameter Block (bytes 11 through 35 of the Partition Boot Sector) describes physical parameters of the volume. The extended BIOS Parameter Block begins immediately after the BIOS Parameter Block. The length of this structure is different for FAT and NTFS volumes. The information in the BIOS Parameter Block and the extended BIOS Parameter Block is used by disk device drivers to read and configure volumes.
The Partition Boot Sector is the first 512-byte sector at the beginning of the volume. The sector always ends with 0x55AA, which is a sector signature word that marks the end of the sector.
FAT Partition Boot Sector
Table 17.4 describes the fields in the Partition Boot Sector for a volume formatted with the FAT file system. The sample values are the data in the corresponding fields in the hex dump in Figure 17.12, presented later in this section.
The following figure is a hex printout of the Partition Boot Sector for a FAT volume. The printout is formatted in three sections:
Physical Sector: Cyl 0, Side 1, Sector 1 00000000: EB 3C 90 4D 53 44 4F 53 - 35 2E 30 <.MS-DOS5.0
00 02 08 01 00 ..... 00000010: 02 00 02 00 00 F8 C9 00 - 3F 00 10 00 3F 00 00 00 ........?...?... 00000020: 51 42 06 00 80 00 29 CE - 13 46 30 4E 4F 20 4E 41 QB....)..F0NO NA
00000030: 4D 45 20 20 20 20 46 41 - 54 31 36 20 20 20 ME FAT16
33 C0 3. 00000040: 8E D0 BC 00 7C 68 C0 07 - 1F A0 10 00 F7 26 16 00 ....|h......&.. 00000050: 03 06 0E 00 50 91 B8 20 - 00 F7 26 11 00 8B 1E 0B ....P.. ..&..... 00000060: 00 03 C3 48 F7 F3 03 C8 - 89 0E 08 02 68 00 10 07 ...H........h... 00000070: 33 DB 8F 06 13 02 89 1E - 15 02 0E E8 90 00 72 57 3.............rW 00000080: 33 DB 8B 0E 11 00 8B FB - 51 B9 0B 00 BE DC 01 F3 3.......Q....... 00000090: A6 59 74 05 83 C3 20 E2 - ED E3 37 26 8B 57 1A 52 .Yt... ...7&.W.R 000000A0: B8 01 00 68 00 20 07 33 - DB 0E E8 48 00 72 28 5B ...h. .3...H.r([ 000000B0: 8D 36 0B 00 8D 3E 0B 02 - 1E 8F 45 02 C7 05 F5 00 .6...>....E..... 000000C0: 1E 8F 45 06 C7 45 04 0E - 01 8A 16 24 00 EA 03 00 ..E..E.....$.... 000000D0: 00 20 BE 86 01 EB 03 BE - A2 01 E8 09 00 BE C1 01 . .............. 000000E0: E8 03 00 FB EB FE AC 0A - C0 74 09 B4 0E BB 07 00 .........t...... 000000F0: CD 10 EB F2 C3 50 4A 4A - A0 0D 00 32 E4 F7 E2 03 .....PJJ...2.... 00000100: 06 08 02 83 D2 00 A3 13 - 02 89 16 15 02 58 A2 07 .............X.. 00000110: 02 A1 13 02 8B 16 15 02 - 03 06 1C 00 13 16 1E 00 ................ 00000120: F7 36 18 00 FE C2 88 16 - 06 02 33 D2 F7 36 1A 00 .6........3..6.. 00000130: 88 16 25 00 A3 04 02 A1 - 18 00 2A 06 06 02 40 3A ..%.......*...@: 00000140: 06 07 02 76 05 A0 07 02 - 32 E4 50 B4 02 8B 0E 04 ...v....2.P..... 00000150: 02 C0 E5 06 0A 2E 06 02 - 86 E9 8B 16 24 00 CD 13 ............$... 00000160: 0F 83 05 00 83 C4 02 F9 - CB 58 28 06 07 02 76 11 .........X(...v. 00000170: 01 06 13 02 83 16 15 02 - 00 F7 26 0B 00 03 D8 EB ..........&..... 00000180: 90 A2 07 02 F8 CB 42 4F - 4F 54 3A 20 43 6F 75 6C ......BOOT: Coul 00000190: 64 6E 27 74 20 66 69 6E - 64 20 4E 54 4C 44 52 0D dn't find NTLDR. 000001A0: 0A 00 42 4F 4F 54 3A 20 - 49 2F 4F 20 65 72 72 6F ..BOOT: I/O erro 000001B0: 72 20 72 65 61 64 69 6E - 67 20 64 69 73 6B 0D 0A r reading disk.. 000001C0: 00 50 6C 65 61 73 65 20 - 69 6E 73 65 72 74 20 61 .Please insert a 000001D0: 6E 6F 74 68 65 72 20 64 - 69 73 6B 00 4E 54 4C 44 nother disk.NTLD 000001E0: 52 20 20 20 20 20 20 00 - 00 00 00 00 00 00 00 00 R ......... 000001F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 55 AA ..............U.
Figure 17.12 Partition Boot Sector for a FAT volume on x86-based computer†
Table 17.5 shows the layout of the BIOS Parameter Block and the extended BIOS Parameter Block. The sample values correspond to data in Figure17.10.
For the Media Descriptor field, the following table lists some of the recognized media descriptor values and their associated media. A media descriptor value can be associated with more than one disk capacity.
NTFS Partition Boot Sector
Table 17.6 describes the fields in the Partition Boot Sector for a volume formatted with the NTFS file system. The sample values are the data in the corresponding fields in the hex dump in Figure 17.13, presented later in this section.
Note The bootstrap code for an NTFS volume is longer than the 426 bytes shown here. When you format an NTFS volume, the format program allocates the first 16 sectors for the Partition Boot Sector and the bootstrap code.
The extra data fields after the BIOS Parameter Block form an extended BIOS Parameter Block for NTFS. The data in these fields enable the boot loader to find the Master File Table (MFT) during the startup process. In the NTFS file system, the MFT is not located in a predefined sector as is the case for the file allocation table on a FAT volume. Thus, the MFT can be moved if there is a bad sector in its normal location. However, if these data are corrupt, the MFT cannot be located and Windows NT assumes the volume has not been formatted.
The following figure is a hex dump of the Partition Boot Sector for an NTFS volume (formatted when running Windows NT 4.0). The printout is formatted in three sections:
Physical Sector: Cyl 407, Side 0, Sector 1 00000000: EB 5B 90 4E 54 46 53 20 - 20 20 20 .[.NTFS
00 02 01 00 00 ..... 00000010: 00 00 00 00 00 F8 00 00 - 3F 00 10 00 90 42 06 00 ........?....B.. 00000020: 00 00 00 00 80 00 80 00 - A0 3E 06 00 00 00 00 00 .........>...... 00000030: 10 00 00 00 00 00 00 00 - 51 1F 03 00 00 00 00 00 ........Q...... 00000040: 02 00 00 00 04 00 00 00 - 5B 1F DD 2C 4F DD 2C A2 ........[.,O.,. 00000050: 00 00 00 00 .... 00 00 00 00 - 00 00 00 00 00 FA 33 C0 ..........3. 00000060: 8E D0 BC 00 7C FB B8 C0 - 07 8E D8 C7 06 54 00 00 ....|........T.. 00000070: 00 C7 06 56 00 00 00 C7 - 06 5B 00 10 00 B8 00 0D ...V.....[...... 00000080: 8E C0 2B DB E8 07 00 68 - 00 0D 68 56 02 CB 50 53 ..+....h..hV..PS 00000090: 51 52 06 66 A1 54 00 66 - 03 06 1C 00 66 33 D2 66 QR.f.T.f....f3.f 000000A0: 0F B7 0E 18 00 66 F7 F1 - FE C2 88 16 5A 00 66 8B .....f......Z.f. 000000B0: D0 66 C1 EA 10 F7 36 1A - 00 88 16 25 00 A3 58 00 .f....6....%..X. 000000C0: A1 18 00 2A 06 5A 00 40 - 3B 06 5B 00 76 03 A1 5B ...*.Z.@;.[.v..[ 000000D0: 00 50 B4 02 8B 16 58 00 - B1 06 D2 E6 0A 36 5A 00 .P....X......6Z. 000000E0: 8B CA 86 E9 8A 36 25 00 - B2 80 CD 13 58 72 2A 01 .....6%.....Xr*. 000000F0: 06 54 00 83 16 56 00 00 - 29 06 5B 00 76 0B C1 E0 .T...V..).[.v... 00000100: 05 8C C2 03 D0 8E C2 EB - 8A 07 5A 59 5B 58 C3 BE ..........ZY[X.. 00000110: 59 01 EB 08 BE E3 01 EB - 03 BE 39 01 E8 09 00 BE Y.........9..... 00000120: AD 01 E8 03 00 FB EB FE - AC 3C 00 74 09 B4 0E BB .........<.t.... 00000130: 07 00 CD 10 EB F2 C3 1D - 00 41 20 64 69 73 6B 20 .........A disk 00000140: 72 65 61 64 20 65 72 72 - 6F 72 20 6F 63 63 75 72 read error occur 00000150: 72 65 64 2E 0D 0A 00 29 - 00 41 20 6B 65 72 6E 65 red....).A kerne 00000160: 6C 20 66 69 6C 65 20 69 - 73 20 6D 69 73 73 69 6E l file is missin 00000170: 67 20 66 72 6F 6D 20 74 - 68 65 20 64 69 73 6B 2E g from the disk. 00000180: 0D 0A 00 25 00 41 20 6B - 65 72 6E 65 6C 20 66 69 ...%.A kernel fi 00000190: 6C 65 20 69 73 20 74 6F - 6F 20 64 69 73 63 6F 6E le is too discon 000001A0: 74 69 67 75 6F 75 73 2E - 0D 0A 00 33 00 49 6E 73 tiguous....3.Ins 000001B0: 65 72 74 20 61 20 73 79 - 73 74 65 6D 20 64 69 73 ert a system dis 000001C0: 6B 65 74 74 65 20 61 6E - 64 20 72 65 73 74 61 72 kette and restar 000001D0: 74 0D 0A 74 68 65 20 73 - 79 73 74 65 6D 2E 0D 0A t..the system... 000001E0: 00 17 00 5C 4E 54 4C 44 - 52 20 69 73 20 63 6F 6D ...\NTLDR is com 000001F0: 70 72 65 73 73 65 64 2E - 0D 0A 00 00 00 00 55 AA pressed.......U.
Figure 17.13 Partition Boot Sector for a NTFS volume on an x86-based computer†
The next table describes the fields for the BIOS Parameter Block and the Extended BIOS Parameter Block. The fields starting at 0x0B, 0x0D, 0x15, 0x18, 0x1A, and 0x1C are the same as the corresponding fields for FAT volumes, as described in Table 17.5.
For information about the Master File Table and the $MFT and $MFTMirr files, see "Master File Table (MFT) and NTFS System Files," presented earlier in this chapter.
Using Hard Disks With More Than 1024 Cylinders (x86-based Computers)
Windows NT can take advantage of hard disks with more than 1024 cylinders if you enable extended translation. Windows NT does not have a limit to the number of cylinders it can address, but the system and boot partitions are limited to 1024 cylinders by the system BIOS, which must use INT 13 to access the disk during startup. The section "Starting and Ending Head, Sector, and Cylinder Fields," presented earlier in this chapter, contains more information about the system and boot partitions.
The following error messages might appear when extended translation is not enabled on disks larger than 1024 cylinders, and the Master Boot Record is unable to locate the Partition Boot Sector:†
If you create your system and boot partitions in Windows NT Setup, you do not have to concern yourself with these details, because Setup will not create a partition that cannot be used to start Windows NT.
When Windows NT has completed startup, it does not use the values in the Starting and Ending Head, Sector, and Cylinder fields of the Partition Table. Instead, it uses the Relative Sectors and Number Of Sectors fields. These fields provide a full 32 bits to represent sectors, which results in volumes of up to 232 sectors.
With a standard sector size of 512 bytes, the 32-bit fields used for the Relative Sectors and Number of Sectors result in a maximum possible volume size of:
512 bytes x 4,294,967,296 = 2,199,023,255,552 bytes, or 2 TB.
When creating partitions or logical drives on a disk, Windows NT writes the correct values to the Partition Table fields whenever possible. When the Ending Cylinder field for an entry in the Partition Table goes beyond cylinder 1023, Windows NT writes the maximum permitted values to these fields in the Partition Table. This prevents the system BIOS from calculating the Starting and Ending addresses based on erroneous data.†
There are several Knowledge Base articles that discuss using large disks. Knowledge Base articles are included on the Windows NT Workstation Resource Kit CD.
SCSI Hard Disks
If your SCSI controller can be configured to perform translation, you can create a boot partition or system partition that is within the first 1 or 4 GB of the disk, depending upon the translation used by the controller. To create the largest possible system and boot partitions, enable translation and recreate the partitions on the disk. If translation was not already enabled, you will need to low-level format the hard disk before recreating the partitions. Check with your hardware manufacturer for specific advice and details.
Once Windows NT has been initialized, it uses its SCSI disk device drivers to directly interact with the disk without using the BIOS INT 13 interface. Therefore, the Starting and Ending Head, Sector, and Cylinder fields are not important after the computer has completed startup.
IDE and EIDE Hard Disks
The system and boot partitions on IDE hard disks are also limited to 1024 cylinders if the controller does not translate the disk address. Secondary disks that do not contain the system or boot partition might not be limited to 1024 cylinders, depending on the translation scheme used by the controller and disk.
IDE disks use a different data structure for representing the number of cylinders, number of heads, and number of sectors per track than the Partition Table and BIOS INT 13 interface. According to the IDE specifications, the maximum number of cylinders is 65536, the maximum number of heads is 16, and the maximum number of sectors per track is 255. The maximum size is 136.9 GB. Because the BIOS/IDE interface has been constrained to use the lowest common denominator, the result is a limit of about 504 MB for an IDE disk on an Intel-based ISA bus computer.
There are new controllers and disk device drivers that use an Enhanced Disk Parameter Table to translate between the logical sector layout internal to the IDE disk and the logical sector layout addressable by the BIOS INT 13 interface. These disk device drivers and devices can support larger disks. These disks and controllers are referred to as enhanced IDE, or EIDE, devices.
ESDI Hard Disks
ESDI disks are an older type that came before the IDE disks.
ESDI use the CHS (cylinder, head, sector) addressing and has a 1024 cylinder limitation. Some controller cards get around this limitation by implementing a translation scheme in the onboard controller BIOS.
The translation is totally transparent to Windows NT, and the standard disk device driver works without any change.
ESDI disks are capable of being low-level formatted with various values of sector per track, such as 53 or 63. Here are two examples:
1024 cylinders x 15 heads x 53 sectors per track x 512 bytes per sector = 398 MB
1024 cylinders x 15 heads x 63 sectors per track x 512 bytes per sector = 472 MB
Thus, using 63 sectors per track yields 74 MB more space. Windows NT is compatible with either geometry, and, depending on the disk or controller, can access cylinders beyond 1023. You can use Windows NT to create and format the disk space beyond cylinder 1023, but it cannot be accessed by MS-DOS. However, some controllers can remap the remaining cylinders beyond 1023 so that either MS-DOS or Windows NT can use the entire capacity. For example:
1632 cylinders x 15 heads x 53 sectors per track x 512 bytes per sector = 634 MB
Microsoft has tested the ESDI controllers described in the following table.
Using Removable Disks and Floppy Disks
Most types of removable media can work with Window NT. Even though removable media are assigned a floppy disk icon in My Computer and Windows NT Explorer, they are not handled by the same part of the operating system. Floppy disks are handled by Floppy.sys. All SCSI-based removable media are handled through the normal SCSI disk device drivers. Most magneto-optical, Bernoulli, Syquest, and similar removable-media disks are treated like hard disks under Windows NT, and do not require special disk device drivers.
You can use My Computer or Windows NT Explorer to remove media while Windows NT is running. When pointing at the device, click the right mouse button. If the media can be ejected, the Eject command is available. If there is no Eject command in the menu, or the command is grayed, you cannot eject the media.
Note WORM and other types of "Write once" media are not supported in Windows NT.
There are several limitations that are unique to removable media in Windows NT.