Hi,
I have a couple of questions relating to NTFS on-disk
update behavior, and it would be really helpful if
someone can provide info on these.
I was examining the disk traffic generated by NTFS
(with knowledge of the set of bitmap blocks). My goal
was to track from within the disk, information on
which blocks (clusters) were being considered “live”
by ntfs at any given point. When a bitmap (cluster
map) block is written, the disk looks at which bits
are reset in the cluster map and considers the
clusters corresponding to reset bits as “dead”, and on
a write to a cluster or a set bit in a bitmap block,
the disk considers those clusters live. In this
context, I see a few strange behaviors:
-
I observe quite a few reads issued by NTFS to “dead”
blocks – blocks that were marked dead in an earlier
bitmap write, and had no write subsequently. This
means that NTFS for some reason looks at the contents
of “free” blocks, which is unexpected. Any idea why
this happens ? Is it because of the “undelete”
feature? When I just returned zeroed data to those
“dead reads”,
things work fine, so it appears that ntfs doesn’t rely
on the data returned by those reads, but in any case
it was strange that ntfs would issue those reads in
the first place. -
Data blocks get written even after being deleted. I
create a file and delete it immediately – after a
while, when the actual disk I/O occurs, the deleted
data blocks are also written. I would have expected a
file delete to have invalidated the cache copy of the
data blocks, thus squashing disk writes for those
deleted files. Is this behavior expected ?
thanks a lot!
Muthian
Do you Yahoo!?
Win 1 of 4,000 free domain names from Yahoo! Enter now.
http://promotions.yahoo.com/goldrush