Why NTFS deletes more than 4G large files or database files after the file record size is represented as 0

Source: Internet
Author: User

Why does NTFS delete more than 4G large files or database files after the file record size is shown as 0?


A: NTFS deletes a file, it must complete the following processes before the end is counted:

1, change the file system $bitmap, free space

2. Change the properties of the $MFT Filerecord item to delete

3, change $MFT: The bitmap information of the $bitmap is 0, free up this filerecord space

4. Clear the item information about this file in the table of contents list.

This process is the ideal processing rule, but in fact, the most headache is the OS to consider this problem: if the above 4 steps to interrupt (such as sudden power outage, panic, etc.), how to let the next operation can continue, or maintain the file system is consistent (the simplest, if the file is deleted, but the directory is still in, That is always inappropriate, the overall Lee detection and too time-consuming, and in the end who is wrong, and sometimes not clear, in order to solve this problem, NTFS introduced $logfile, the same day log, simply said to be performing a full IO operation (such as deleting a file) in advance to record the status, If not successful, the next time to rollback back to the status of not doing a successful.

But again, if a file is too large, or the storage list is too long (that is, there are too many fragments). The document meta-Information section will become very large, such as a file size is 4G, according to 4K block size, a continuous bitmap must have at least 1 m, in order not to save too much information in the log file (such as a 4T file, first save 1g bitmap, too slow and the variable is increased), NTFS is processed in batches for complex files or large files: that is, a file may be continuously smaller and smaller, until it changes to 0.

In order to maintain the consistency of the operation. Guess, NTFS sets two cases, if it is determined that one log can be enough to complete an IO atomic operation, you do not have to clear Filerecord size and location information (runlist). However, if NTFS cannot complete an IO atom operation at a time, it will need to be divided into separate IO atomic operations, each IO atomic operation logging once, and updating to a new state when it is finished-in this way, deleting a large file or multi-fragmented file, after the last IO atomic operation, it will be cleared to 0 size, Runlist clears the state.

In this case, 4G is actually not a variable, guess from the 4K block size, and the file once released 1M cluster range of the area caused. Databases are often not easy to recover, even if the size is less than 4G, the reason is because the database is growing, more fragments, fragmentation results in a large amount of metadata, the location is scattered, can not be completed one-time release operations.

-------North Asia Data Recovery Center Tommy Cheung

This article is from the "Zhang Yu (Data Recovery)" blog, please be sure to keep this source http://zhangyu.blog.51cto.com/197148/1827150

Why NTFS deletes more than 4G large files or database files after the file record size is represented as 0

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.