Some of the main topics in this chapter are
Disk administration is a primary task of any systems administrator. Not only is it necessary to ensure that the file system is securely backed up, but it is often necessary to configure and manage fault tolerance, set and manage security on the file system, and manage disk resources in other ways. This chapter explores disk administration in detail and provides an overview of file system options available to you under Windows NT Server. After you learn to administer the disks on your server in this chapter, you can learn how to make your disks more secure in Chapter 28, "Protecting Your Disks."
Windows NT provides support for three file systems: File Allocation Table (FAT), NT File System (NTFS), and CD File System (CDFS). CDFS provides support and performance optimization for CD-ROM drives. Because you have little control over CDFS, this chapter focuses instead on FAT and NTFS.
The FAT file system was designed originally for the DOS operating system and is the primary file system for computers running DOS/Windows 3.x and Windows 95. A new version of FAT, called FAT32, has been added to the OEM 2 release of Windows 95 and will be in Windows 98. FAT32 extends the original FAT file system but is not supported by Windows NT Server 4.0. It will be supported in version 5.0, however.
NTFS was developed specifically for Windows NT. NTFS provides much greater security and auditing than does the FAT file system. This additional security and auditing is necessary for Windows NT to support C2 level security, a standard defined by the U.S. Government. In addition, NTFS also offers more efficient storage, eliminating the waste of empty sectors, called sector slack, inherent in the FAT file system.
FAT and NTFS each offer certain advantages and disadvantages. Although performance is an important consideration, you probably need to consider other issues, such as security. The following sections explain the FAT and NTFS file systems so that you can decide which is right for your situation.
The FAT file system takes its name from the File Allocation Table (FAT), which is used to maintain information about disk space allocation (more on the actual FAT later in this section). The FAT file system has evolved within the DOS operating system to its present state and is used by DOS and Windows 95 systems, as well as Windows NT.
A disk formatted with the FAT file system contains four control areas. The first of these areas is the reserve area, which comprises one or more sectors, depending on the type of disk. The boot sector is the first sector in the reserve area and contains the partition table and bootstrap program. The partition table contains information about the partitions on the disk, including the type of partition, starting and ending sector, which partition is active, and other information. The bootstrap program executes when the system starts and is responsible for booting the operating system in the active partition.
The second control area is the FAT. The FAT essentially is a reference table that maintains a list of clusters on the disk. The value of the each cluster entry in the FAT records the status of the associated disk cluster. Table 22.1 lists possible FAT cluster entries.
| Entry | Meaning |
| 0 | Cluster is available. |
| BAD | Cluster contains bad sector and can't be used. |
| Reserved | Cluster has been set aside for use only by the operating system. |
| EOF | Marks the last cluster of a file. |
| ### (numbers) | Number identifying the next cluster in the file. |
The root directory table, the third control area of the disk, works in conjunction with the FAT. The root directory table contains the names of files in the root directory, including subdirectories (which are really nothing more than files) and the starting cluster of each file.
NOTE: The fourth control area is the files area, where file data is stored.
Consider an example to understand how the FAT works: Assume that you use WordPad to open a file named Foo.txt, located in the root directory. The operating system reads the root directory table to find the starting cluster of the file (in this example, assume that this is cluster 300). The operating system reads the data in cluster 300. Then it reads the cluster entry in the FAT for cluster 300 and finds the value 301, which is the next cluster in the file. So, the operating system reads the data from cluster 301.
Next, the operating system reads the FAT entry for cluster 301 and the value turns out to be 320, the next cluster in the file. The operating system reads the data from cluster 320 and then reads the cluster entry in the FAT for cluster 320 to find out where to go next. The entry for cluster 320 reads EOF, indicating that cluster 320 was the last cluster in the file.
NOTE: Originally, FAT entries consisted of 12 bits. DOS 4.0 introduced a 16-bit FAT to enable the FAT to accommodate a larger number of cluster entries, and thus, larger disks. The new FAT32 installable file system increases the FAT to 32 bits, further increasing the number of available clusters and possible disk size.
As of this writing, Microsoft has not incorporated FAT32 into Windows NT. FAT32 support will be made available for Windows NT as part of a Service Pack in the near future or in Windows NT 5.0.
Although the FAT file system can be difficult to understand at first, it's a logical, orderly way to track data. NTFS is equally logical and orderly but completely different in design.
NTFS stands for NT File System. NTFS was designed specifically for Windows NT and provides features that make it an attractive alternative to the FAT file system.
NTFS is a recoverable file system. If the system fails during a file operation, NTFS reconstructs the volume and recovers from the failure. This recovery happens automatically the first time the disk is accessed after a failure, requiring no intervention from you. In addition, NTFS further secures the file system by maintaining redundant copies of critical file system data, enabling it to recover if the data becomes corrupted.
NTFS provides increased security over the FAT file system. With the FAT file system, you can apply security only at the directory level (through network shares), and that level of security extends to all files and subdirectories within that directory. With Windows NT, however, you can apply security settings on a file-by-file basis. This means that you can restrict access to specific files to specific users. In addition to added levels of security, NTFS also provides for detailed transaction auditing.
TIP: The basic difference between FAT and NTFS is the number of attributes the files can have. NTFS provides additional security attributes not available in the FAT file system. This lack of attributes is the reason FAT does not support file-by-file security.
Another important NTFS feature is its support for fault tolerance such as mirroring drives. If one drive fails, the data is still available and secure on a redundant drive. Windows NT Server supports a full range of fault tolerance options, and Windows NT Workstation supports stripe sets.
See "Implementing Disk Striping with Parity," p. 521
NTFS also supports very large disk sizes. Whereas FAT allocates clusters using 16-bit numbers (32-bit numbers for FAT32), NTFS uses 64 bits to number clusters, allowing for 264 clusters--a huge number (over 16 quintillion). NTFS uses a cluster size of 512 bytes on smaller disks and a normal cluster size of 4K on large disks. Table 22.2 describes the cluster sizes NT choose for differ sizes of disks. NTFS identifies the clusters on a disk by logical cluster number, or LCN. The LCNs simply number the clusters sequentially from the beginning of the volume to its end.
| Partition Size | Cluster Size |
| <= 512MB | 512 bytes |
| 513MB-1GB | 1K |
| 1GB-2GB | 2K |
| 2GB-4GB | 4K |
| 4GB-8GB | 8K |
| 8GB-16GB | 16K |
| 16GB-32GB | 32K |
| > 32GB | 64K |
NOTE: The Disk Administrator automatically chooses a cluster size when you use it to format a disk, but you can override the default size. For more information, see the section, "Exploring the Disk Administrator," later in this chapter. In addition, you can use cluster sizes up to 64K by formatting a disk from the command line with the format command. For further information, enter format /? at a command prompt.
NTFS tracks the contents of a volume by using a relational database called the master file table, or MFT. The MFT contains a record for each file and directory (including the MFT itself) with name, security descriptor, and other attributes for the file. The MFT represents an array of data, with rows in the array representing file records and columns representing attribute fields for each record (see Figure 22.1). The size of each MFT file record is constant and is set when the volume is formatted. Depending on the disk, the size is either 1K, 2K, or 4K.
One of the fields in the MFT for each file record is the Data field. For a small file, the Data field contains the file's data, which means that a small file can be contained completely within one MFT record. As a file's attributes increase in number (such as the file becoming larger) or the file becomes greatly fragmented, multiple records are needed in the MFT to contain the file. When a file spans multiple records, the primary record that stores the location of the others is called the base file record. In some ways, the base file record is like the directory record for a file under the FAT file system because it defines the starting point in the file's data chain.
When all of a file's attributes (including its data) reside in the MFT, the attributes are called resident attributes. All but the smallest files, however, will not fit in an MFT record. With these files, NTFS creates additional 2K-sized areas on the disk called runs to contain the additional data. (On a volume with a 4K cluster size, the run is 4K in size because a cluster is the smallest unit of storage NTFS can allocate.) Attributes stored in runs are called nonresident attributes because they don't reside in the MFT. As the file's attributes grow, NTFS simply adds runs to the file as needed.
The MFT is a relational database that maintains the NTFS volume structure.
In one way, FAT and NTFS are similar. Because NTFS stores file data in runs outside the MFT and those runs can be noncontiguous, NTFS needs some means of locating all the runs for a file in sequence. This is no different from the FAT in which the cluster entries in the FAT point to the file's subsequent clusters. The implementation in NTFS is different, however.
The clusters in a file are referenced by virtual cluster number, or VCN. The VCN simply numbers the clusters in the file, starting with 0 and moving up to the last cluster in the file. The data attribute of the file in the MFT contains information that maps the logical cluster numbers with the virtual cluster numbers (see Figure 22.2). If there are too many LCN-to-VCN cluster mappings to store in one MFT record, other MFT records are added to accommodate the additional mappings.
You can see from the previous two sections that FAT and NTFS are architecturally quite different. The differences between the two file systems are most evident to the average user, however, in the features and characteristics exhibited by each (or lack thereof). In many respects, the two are identical in function. Both provide a stable, reliable file system, for example. The differences, advantages, and disadvantages in FAT and NTFS can be distilled to the following primary issues:
For large files, NTFS stores data in multiple runs with the MFT record defining the LCN-to-VCN mapping.
Performance. From the previous discussion about the architectural differences between the FAT and NTFS file systems, you might have come to the conclusion that the NTFS file system is more complex than FAT. Essentially, that conclusion is true. NTFS supports greater security and reliability, and these features can generate a performance overhead that is noticeable on some systems. For the vast majority of users, however, any performance overhead caused by NTFS will be minimal and scarcely noticeable, if at all.
Performance becomes a more critical issue in large database transactions and certain other types of file I/O, including dealing with very large data files. In these situations, the performance overhead caused by NTFS can affect throughput. However, NTFS is faster than FAT with random reads.
Robustness and Reliability. By far, NTFS is more robust and reliable than FAT. NTFS's capability to recover the file system after system failures or transaction failures is critical to many users. The fault tolerant options that NTFS supports are additional reasons why NTFS is a good choice for network servers.
Compatibility. Compatibility becomes an issue only on multiboot systems that retain a DOS or Windows 95 operating system along with Windows NT. The FAT file system is usable by all three operating systems, but NTFS is usable only by Windows NT. Therefore, if you create an NTFS partition, you won't be able to access that partition when running DOS or Windows 95 on your machine.
File compression also figures into the compatibility equation on multiboot systems. If your system contains a DriveSpace or DoubleSpace compressed volume that you use under DOS or Windows 95, you won't be able to access that volume under Windows NT because Windows NT supports neither compression utility. If Windows NT is your only operating system or you choose to create an NTFS partition on a multiboot system, you can use NTFS's compression mechanism on the NTFS partition.
Security. Security is probably the most common reason for choosing NTFS over FAT. Although you can protect a FAT volume through Windows NT's security database on a user-by-user basis, the levels of security you can apply are not as comprehensive as with NTFS. In addition, you can apply permissions only to directories on a FAT file system, not to specific files, as you can with NTFS.
The situations in which you would choose one file system over another are fairly clear:
TIP: You might decide to place Windows NT itself in an NTFS partition, along with any applications that run only under Windows NT. The other applications that you use under both Windows 95 (or DOS/Windows 3.x) and Windows NT can go in the FAT volume. Note, however, that you'll have to double-install many of the applications you use in both operating systems.For example, assume that you're using Microsoft Office, which runs under both Windows 95 and Windows NT. You would first install Office under Windows 95 in a FAT volume. Then you would boot Windows NT and install Office again in the same folder on the FAT volume. You have only one copy of all the Office files, but the necessary settings to run Office have been added to both your Windows 95 and Windows NT Registries. Applications that don't require Registry entries typically can run on both operating systems without requiring installation under both operating systems.
Disk Administrator is the utility through which most of your drive-level file system management occurs. With Disk Administrator, you can create partitions, format drives, implement RAID, and perform other drive-related tasks. Figure 22.3 shows the Disk Administrator interface.
Disk Administrator offers different ways to view and manage disk resources. Here, the Volumes view is used.
Disk Administrator is located under the Start menu in Programs/Administrative Tools (Common). When you start Disk Administrator, it displays all the hard drives and removable drives (such as CD-ROM drives) in the system. Indicated for each drive is the capacity and type of the drive, as well as its volume label (if any) and drive letter assignment. Any free space on the drive not used by a partition appears as a shaded area (see Figure 22.4).
You can switch Disk Administrator between Disk Configuration view (shown in Figure 22.4) and Volumes view (see Figure 22.5). Whereas Disk Configuration view shows unpartitioned space, Volumes view shows only partitioned volumes, although Volumes view does show unformatted partitions. Select the type of view you want from Disk Administrator's View menu, or, press Ctrl+V for Volumes view or Ctrl+D for Disk Configuration view.
You can further control Disk Administrator's display through the Options menu. Choosing Options, Disk Display enables you to select between having Disk Administrator display disks based on their size or sizing them equally. This selection determines the size of the box in which Disk Administrator shows the information about a drive in Disk Configuration view. It has no effect on the actual size of the drive itself. In Figure 22.6, all disks have been sized equally.
Disk Administrator identifies unpartitioned space, as well as partitioned space on the disk.
Fig. 22.5 Volumes view shows all partitioned volumes, even if the volumes are not yet formatted.
Fig. 22.6 Disk Administrator has been configured to show all drives the same size.
Choosing Options, Region Display opens the Region Display Options dialog box shown in Figure 22.7. The Region Display Options dialog box enables you to control how Disk Administrator shows the size relationship for each partition/logical disk on a drive. If you choose the Size All Regions Equally option, each logical drive is shown using the same size box within the drive's overall box. Selecting the Size Regions Based On Actual Size option causes Disk Administrator to size the box for each logical drive proportionally to its capacity. You can apply the size selection method to a specific drive or to all drives by using the two options in the Which Disk group.
Use the Region Display Options dialog box to control how large each partition/logical drive appears in the display.
NOTE: If a drive contains logical disks or partitions of considerably different size, choosing the Size Regions Based On Actual Size option can cause the smaller partitions/logical disks to effectively disappear. To make them reappear, select the Size All Regions Equally option. Also, note that the controls in the Disk Display Options dialog box control how the separate drives' appearances compare to one another, whereas the controls in the Region Display Options dialog box control how the regions within a drive appear compared to other regions in the same drive.
When using Disk Configuration view, you also have the option to specify different colors and patterns for these objects:
To specify color or pattern preferences, choose Options, Colors and Patterns to display the Colors and Patterns dialog box (see Figure 22.8).
In addition to the options already explained, you can customize Disk Administrator's toolbar. To customize the toolbar to your preferences, choose Options, Customize Toolbar to display the Customize Toolbar dialog box (see Figure 22.9).
To add a button to the toolbar, select the desired button from the Available Buttons list and then click Add. To remove a button from the toolbar, select the button from the Toolbar Buttons list and then click Remove. To change the order of the buttons in the toolbar, select the button you want to move and then click the Move Up or Move Down button. When you're satisfied with the new toolbar arrangement, click Close.
Many of the disk changes you make with Disk Administrator are not applied immediately. Instead, you must commit these changes to the disk. For example, you can create or delete a partition, but until you commit the changes, the disk is unaffected. If you exit Disk Administrator without committing the changes, the disk reverts to its original state.
NOTE: When you exit the program, Disk Administrator reminds you if you have not committed changes. Disk Administrator cannot commit changes to removable drives unless you exit Disk Administrator.
To commit changes you have made to a disk, choose Partition, Commit Changes Now.
A partition is an area on a disk that has been designated as a logical storage area. The partition comprises a linear set of sectors, beginning at a specific sector and ending at a specific sector. A drive can contain a maximum of four partitions, although most drives can consist of only one partition. A drive can contain one to four primary partitions or up to three primary partitions and one extended partition.
A primary partition can contain a single logical drive, which is a storage area recognized by the operating system by a drive letter, such as C or D. An extended partition can contain multiple logical drives, enabling you to break up the space in the extended partition into different logical storage areas. You might create a primary partition as drive C, for example; then create an extended partition containing logical drives D, E, F, and G.
An extended partition is not limited to a single file system. You can create both FAT and NTFS file systems within an extended partition. You first create the extended partition, create multiple logical drives in the partition, and then format each logical drive according to the file system you want on it.
NOTE: The Setup program enables you to create partitions when you install Windows NT. Disk Administrator is useful primarily when making changes to existing partitions, adding new partitions, adding new disks, and making other disk system changes after installing Windows NT.
Creating Primary Partitions. To create a primary partition, select the region containing the free space in which you want to create the partition and then choose Partition, Create. Or, right-click the free space and then choose Create. Figure 22.10 shows the Created Primary Partition dialog box that appears.
You only have to specify the desired size to create a partition. This dialog box is identical to the Create Primary Partition dialog box.
In the Create Partition of Size text box, type the size (in megabytes) of the partition you want to create. Then click OK. Disk Administrator automatically assigns a drive letter to the partition, although the drive is not yet formatted.
Creating an Extended Partition and Logical Drives. You can create one extended partition on a drive. The extended partition can contain multiple logical drives. To create an extended partition, select the unpartitioned free space in which you want to create the extended partition. Then choose Partition, Create Extended. Or, right-click the free space and then choose Create Extended. The resulting dialog box is identical to the Create Primary Partition dialog box previously shown in Figure 22.10. Specify the size of the extended partition in the Create Partition of Size text box and then choose OK.
After creating the extended partition, you must create at least one logical drive in the partition. With the newly created partition selected, choose Partition, Create (or right-click and then select Create) to display the Create Logical Drive dialog box. This dialog box is identical to the Create Primary Partition and Create Extended Partition dialog boxes. Enter the desired size for the logical drive in the Create Logical Drive of Size text box and then choose OK. Repeat the process to create other logical drives in the extended partition. After creating logical drives in the extended partition, you must format the drives.
Setting the Active Partition. Windows NT recognizes two special partitions: the boot partition and the system partition. These two can be, but are not required to be, the same partition. They have the following functions:
The active partition is the one from which the operating system will boot. You designate a partition as the active partition under Windows NT by using Disk Administrator. You use other methods with other operating systems (for example, fdisk with DOS and Unix).
NOTE: The computer can contain multiple physical disks. Only the first disk, disk 0, can be used as the boot disk. However, the boot partition doesn't have to be the first partition on disk 0. You might have Windows NT installed in the first partition and UNIX (or another version of Windows NT) installed in another partition.Any primary partition on the disk can be designated as the active partition, enabling you to boot different operating systems. For example, if the Windows NT partition is active and you want to boot UNIX, open Disk Administrator and set the UNIX partition to be active. Then, when you restart the system, it will boot from the newly activated partition, which contains UNIX. When it's time to return to Windows NT, use the UNIX fdisk command to set the Windows NT partition active; then restart the system.
To specify the active partition on an Intel-based system, open Disk Administrator and select the partition you want to make active. Then choose Partition, Mark Active.
After you create a primary partition or logical drives in an extended partition, you must format each drive before it can be used. You have the option of formatting a drive as either FAT or NTFS. To format a drive, first select the drive you want to format; then choose Tools, Format. Or, right-click the drive and then choose Format. Either action displays the Format dialog box shown in Figure 22.11.
You also can access the Format dialog box within Explorer by right-clicking a disk and then choosing Format.
The following controls appear in the Format dialog box:
Set the desired options and then choose Start.
At some point, you might decide to convert an existing FAT volume to NTFS to take advantage of the additional security, compression, or other advantages offered by NTFS. Disk Administrator doesn't include any mechanism to convert FAT volumes to NTFS. Instead, you must use a command-line utility named CONVERT to perform the conversion. The format of the CONVERT command is:
CONVERT drive /FS:NTFS [/V]
Replace the drive parameter with the drive ID of the drive to be converted. Use the /V parameter to enable verbose mode, which provides additional reporting during the conversion process. To convert drive D to NTFS, for example, use the following command:
CONVERT D: /FS:NTFS /V
If you attempt to convert the boot partition, you receive a message indicating that the boot partition can't be converted while Windows NT is running. CONVERT asks whether you want to schedule the conversion for the next time the system is restarted. If you answer yes, the drive will be converted to NTFS after you shut down and restart the system. The system will reboot several times during the conversion process, finally booting to the Windows NT GUI when the process is completed.
Windows NT automatically assigns drive letters to drives when you create a primary partition or a logical disk in an extended partition. Disk Administrator enables you to change those drive letter assignments, giving you complete flexibility in how your drives are identified.
NOTE: You assign drive letters to CD-ROM drives the same way you do for hard drives.
To assign a drive letter, open Disk Administrator, select the drive in question, and choose Tools, Assign Drive Letter. Or, right-click the drive and choose Assign Drive Letter. Either action opens the Assign Drive Letter dialog box (see Figure 22.12).
The Assign Drive Letter dialog box lets you specify a drive letter (or that there's no drive letter) for a drive.
From the Assign Drive Letter drop-down list, choose the letter you want to assign to the drive and then choose OK. Or, if you don't want to use a drive letter at all, select the Do Not Assign a Drive Letter option button and then choose OK. If you select this option, Disk Administrator removes the existing drive letter ID from the drive.
CAUTION: If you opt not to use a drive letter, you should apply a volume label to the volume to provide a means of distinguishing the volume. Keep in mind that the boot drive must have a drive letter assignment. Finally, use caution when you eliminate drive letters. Many applications rely on existing drive mappings to work properly, and removing a drive letter could prevent one or more applications from working properly.
© Copyright, Macmillan Computer Publishing. All rights reserved.