CSMC 412
Operating Systems Prof. Ashok K Agrawala
2008 Ashok Agrawala Set 11

April 2008

CMSC 412 Set 11
File System Implementation
File-System Structure File-System Implementation Directory Implementation Allocation Methods Free-Space Management Efficiency and Performance Recovery Log-Structured File Systems NFS Example: WAFL File System

CMSC 412 Set 11 2

Objectives
To describe the details of implementing local file systems and directory structures To describe the implementation of remote file systems To discuss block allocation and free-block algorithms and trade-offs

File-System Structure

File structure
Logical storage unit Collection of related information
File system resides on secondary storage (disks) File system organized into layers File control block storage structure consisting of information about a file
April 2008 CMSC 412 Set 11 4

Layered File System

A Typical File Control Block
In-Memory File System Structures

Virtual File Systems

Virtual File Systems (VFS) provide an objectoriented way of implementing file systems.
VFS allows the same system call interface (the API) to be used for different types of file systems. The API is to the VFS interface, rather than any specific type of file system.
April 2008 CMSC 412 Set 11 8
Schematic View of Virtual File System

Directory Implementation

Linear list of file names with pointer to the data blocks.
simple to program time-consuming to execute
Hash Table linear list with hash data structure.
decreases directory search time collisions situations where two file names hash to the same location fixed size
April 2008 CMSC 412 Set 11 10

Allocation Methods

An allocation method refers to how disk blocks are allocated for files:

Contiguous allocation

Linked allocation Indexed allocation
April 2008 CMSC 412 Set 11 11

Contiguous Allocation

Each file occupies a set of contiguous blocks on the disk
Simple only starting location (block #) and length (number of blocks) are required Random access Wasteful of space (dynamic storage-allocation problem) Files cannot grow
Mapping from logical to physical

Q LA/512 R

Block to be accessed = Q + starting address Displacement into block = R
Contiguous Allocation of Disk Space

Extent-Based Systems

Many newer file systems (I.e. Veritas File System) use a modified contiguous allocation scheme
Extent-based file systems allocate disk blocks in extents An extent is a contiguous block of disks
Extents are allocated for file allocation A file consists of one or more extents.
April 2008 CMSC 412 Set 11 15

Linked Allocation

Each file is a linked list of disk blocks: blocks may be scattered anywhere on the disk.

block =

pointer
Linked Allocation (Cont.)
Simple need only starting address Free-space management system no waste of space No random access Mapping

LA/511

Block to be accessed is the Qth block in the linked chain of blocks representing the file. Displacement into block = R + 1 File-allocation table (FAT) disk-space allocation used by MS-DOS and OS/2.

File-Allocation Table

Indexed Allocation
Brings all pointers together into the index block. Logical view.

index table

Example of Indexed Allocation
Indexed Allocation (Cont.)
Need index table Random access Dynamic access without external fragmentation, but have overhead of index block. Mapping from logical to physical in a file of maximum size of 256K words and block size of 512 words. We need only 1 block for index table.
Q LA/512 R Q = displacement into index table R = displacement into block
Indexed Allocation Mapping (Cont.)
Mapping from logical to physical in a file of unbounded length (block size of 512 words). Linked scheme Link blocks of index table (no limit on size).

Q1 LA / (512 x 511) R1

Q1 = block of index table R1 is used as follows:

Q2 R1 / 512 R2

Q2 = displacement into block of index table R2 displacement into block of file:
Two-level index (maximum file size is 5123)

Q1 LA / (512 x 512) R1

Q1 = displacement into outer-index R1 is used as follows:

outer-index

Combined Scheme: UNIX (4K bytes per block)

Free-Space Management

Bit vector (n blocks)
bit[i] = block[i] free block[i] occupied
Block number calculation (number of bits per word) * (number of 0-value words) + offset of first 1 bit
Free-Space Management (Cont.)
Bit map requires extra space

Example:

block size = 212 bytes disk size = 230 bytes (1 gigabyte) n = 230/212 = 218 bits (or 32K bytes) Easy to get contiguous files Linked list (free list)
Cannot get contiguous space easily No waste of space

Grouping Counting

April 2008 CMSC 412 Set 11 28

Need to protect:

Pointer to free list Bit map
Must be kept on disk Copy in memory and disk may differ Cannot allow for block[i] to have a situation where bit[i] = 1 in memory and bit[i] = 0 on disk Set bit[i] = 1 in disk Allocate block[i] Set bit[i] = 1 in memory

Solution:

Linear list of file names with pointer to the data blocks
Hash Table linear list with hash data structure
April 2008 CMSC 412 Set 11 30
Linked Free Space List on Disk
Efficiency and Performance

Efficiency dependent on:

disk allocation and directory algorithms types of data kept in files directory entry

Performance

disk cache separate section of main memory for frequently used blocks free-behind and read-ahead techniques to optimize sequential access improve PC performance by dedicating section of memory as virtual disk, or RAM disk
April 2008 CMSC 412 Set 11 32

Page Cache

A page cache caches pages rather than disk blocks using virtual memory techniques Memory-mapped I/O uses a page cache
Routine I/O through the file system uses the buffer (disk) cache
This leads to the following figure
April 2008 CMSC 412 Set 11 33
I/O Without a Unified Buffer Cache

Unified Buffer Cache

A unified buffer cache uses the same page cache to cache both memory-mapped pages and ordinary file system I/O
I/O Using a Unified Buffer Cache
Various Disk-Caching Locations

Recovery

Consistency checking compares data in directory structure with data blocks on disk, and tries to fix inconsistencies
Use system programs to back up data from disk to another storage device (floppy disk, magnetic tape, other magnetic disk, optical) Recover lost file or disk by restoring data from backup
April 2008 CMSC 412 Set 11 38
Log Structured File Systems
Log structured (or journaling) file systems record each update to the file system as a transaction All transactions are written to a log

Directories

The inode type field distinguishes between plain files and directories. Directory entries are of variable length; each entry contains first the length of the entry, then the file name and the inode number. The user refers to a file by a path name,whereas the file system uses the inode as its definition of a file.
The kernel has to map the supplied user path name to an inode Directories are used for this mapping.
April 2008 CMSC 412 Set 11 44

Directories (Cont.)

First determine the starting directory:
If the first character is /, the starting directory is the root directory. For any other starting character, the starting directory is the current directory.
The search process continues until the end of the path name is reached and the desired inode is returned. Once the inode is found, a file structure is allocated to point to the inode. 4.3BSD improved file system performance by adding a directory name cache to hold recent directory-to-inode translations.
April 2008 CMSC 412 Set 11 45
Mapping of a File Descriptor to an Inode
System calls that refer to open files indicate the file is passing a file descriptor as an argument. The file descriptor is used by the kernel to index a table of open files for the current process. Each entry of the table contains a pointer to a file structure. This file structure in turn points to the inode. Since the open file table has a fixed length which is only setable at boot time, there is a fixed limit on the number of concurrently open files in a system.
File-System Control Blocks

Disk Structures

The one file system that a user ordinarily sees may actually consist of several physical file systems, each on a different device. Partitioning a physical device into multiple file systems has several benefits.
Different file systems can support different uses. Reliability is improved Can improve efficiency by varying file-system parameters. Prevents one program form using all available space for a large file. Speeds up searches on backup tapes and restoring partitions from tape.
April 2008 CMSC 412 Set 11 48

Disk Structures (Cont.)

The root file system is always available on a drive. Other file systems may be mounted i.e., integrated into the directory hierarchy of the root file system. The following figure illustrates how a directory structure is partitioned into file systems, which are mapped onto logical devices, which are partitions of physical devices.

Three Independent File Systems

Mounting in NFS

Mounts
April 2008 CMSC 412 Set 11

Cascading mounts

NFS Mount Protocol
Establishes initial logical connection between server and client Mount operation includes name of remote directory to be mounted and name of server machine storing it
Mount request is mapped to corresponding RPC and forwarded to mount server running on server machine Export list specifies local file systems that server exports for mounting, along with names of machines that are permitted to mount them
Following a mount request that conforms to its export list, the server returns a file handlea key for further accesses File handle a file-system identifier, and an inode number to identify the mounted directory within the exported file system The mount operation changes only the users view and does not affect the server side

NFS Protocol

Provides a set of remote procedure calls for remote file operations. The procedures support the following operations:
searching for a file within a directory reading a set of directory entries manipulating links and directories accessing file attributes reading and writing files
NFS servers are stateless; each request has to provide a full set of arguments (NFS V4 is just coming available very different, stateful) Modified data must be committed to the servers disk before results are returned to the client (lose advantages of caching) The NFS protocol does not provide concurrency-control mechanisms
Three Major Layers of NFS Architecture
UNIX file-system interface (based on the open, read, write, and close calls, and file descriptors)
Virtual File System (VFS) layer distinguishes local files from remote ones, and local files are further distinguished according to their file-system types
The VFS activates file-system-specific operations to handle local requests according to their file-system types Calls the NFS protocol procedures for remote requests
NFS service layer bottom layer of the architecture
Implements the NFS protocol
April 2008 CMSC 412 Set 11 61
Schematic View of NFS Architecture
NFS Path-Name Translation

Performed by breaking the path into component names and performing a separate NFS lookup call for every pair of component name and directory vnode To make lookup faster, a directory name lookup cache on the clients side holds the vnodes for remote directory names
April 2008 CMSC 412 Set 11 63

NFS Remote Operations

Nearly one-to-one correspondence between regular UNIX system calls and the NFS protocol RPCs (except opening and closing files) NFS adheres to the remote-service paradigm, but employs buffering and caching techniques for the sake of performance File-blocks cache when a file is opened, the kernel checks with the remote server whether to fetch or revalidate the cached attributes
Cached file blocks are used only if the corresponding cached attributes are up to date
File-attribute cache the attribute cache is updated whenever new attributes arrive from the server Clients do not free delayed-write blocks until the server confirms that the data have been written to disk
April 2008 CMSC 412 Set 11 64
Example: WAFL File System
Used on Network Appliance Filers distributed file system appliances Write-anywhere file layout Serves up NFS, CIFS, http, ftp Random I/O optimized, write optimized

NVRAM for write caching

Similar to Berkeley Fast File System, with extensive modifications
April 2008 CMSC 412 Set 11 65

The WAFL File Layout

Snapshots in WAFL
Windows File System - Terminology
Sectors: hardware-addressable blocks on a storage medium Typical sector size on hard disks for x86-based systems is 512 bytes File system formats: Define the way data is stored on storage media Impact a file system features: permissions & security, limitations on file size, support for small/large files/disks Clusters: Addressable blocks that many file system formats use Cluster size is always a multiple of the sector size Cluster size tradeoff: space efficiency vs. access speed Metadata: Data stored on a volume in support of file system format management
Metadata includes the data that defines the placement of files and directories on a volume, for example
Typically not accessible to applications
April 2008 CMSC 412 Set 11 68
Formats Supported by Windows
CD-ROM File System (CDFS) Universal Disk Format (UDF) File Allocation Table (FAT12, FAT16, and FAT32) New Technology File System (NTFS)

CMSC 412 Set 11 69

CDFS is a relatively simple format that was defined in 1988 as the readonly formatting standard for CD-ROM media. Windows 2000 implements ISO 9660-compliant CDFS in \Winnt\System32\Drivers\Cdfs.sys, with long filename support defined by Level 2 of the ISO 9660 standard Because of its simplicity, the CDFS format has a number of restrictions
Directory and file names must be fewer than 32 characters long Directory trees can be no more than eight levels deep

CDFS is considered a legacy format because the industry has adopted the Universal Disk Format (UDF) as the standard for read-only media

CMSC 412 Set 11 70

OSTA (Optical Storage Technology Association) defined UDF in 1995 as a format to replace CDFS for magneto-optical storage media, mainly DVD-ROM
The Windows 2000 UDF file system implementation is ISO 13346compliant and supports UDF versions 1.02 and 1.5
UDF file systems have the following traits:
Filenames can be 255 characters long The maximum path length is 1023 characters
Although the UDF format was designed with rewritable media in mind, the Windows 2000 UDF driver (\Winnt\System32\Drivers\Udfs.sys) provides read-only support

CMSC 412 Set 11 71

FAT (File Allocation Table) file systems are a legacy format that originated in DOS and Windows 9x Reasons why Windows supports FAT file systems:
to enable upgrades from other versions of Windows compatibility with other operating systems in multiboot systems as a floppy disk format
Windows FAT file system driver is implemented in \Winnt\System32\Drivers\Fastfat.sys Each FAT format includes a number that indicates the number of bits the format uses to identify clusters on a disk

Boot sector

File allocation table 1
File allocation table 2 (duplicate)

CMSC 412 Set 11 72

Root directory Other directories and all files

FAT format organization

FAT12's 12-bit cluster identifier limits a partition to storing a maximum of 212 (4096) clusters
Windows uses cluster sizes from 512 bytes to 8 KB in size, which limits a FAT12 volume size to 32 MB Windows uses FAT12 as the format for all 5-inch floppy disks and 3.5-inch floppy disks, which store up to 1.44 MB of data

CMSC 412 Set 11 73

FAT16, with a 16-bit cluster identifier, can address 216 (65,536) clusters
On Windows, FAT16 cluster sizes range from 512 bytes (the sector size) to 64 KB, which limits FAT16 volume sizes to 4 GB The cluster size Windows uses depends on the size of a volume

CMSC 412 Set 11 74

FAT32 is the most recently defined FAT-based file system format
it's included with Windows 95 OSR2, Windows 98, and Windows Millennium Edition

You can create junctions with the junction tool from Sysinternals or the linkd tool from the Resource Kits

CMSC 412 Set 11 90

Change Logging
Many types of applications, such as incremental backup utilities, need to monitor a volume for changes An obvious way to watch for changes is to perform a full scan
Very performance inefficient
There is a way for an application to wait on a directory and be told of notifications
An application can miss changes since it must specify a buffer to hold them
April 2008 CMSC 412 Set 11 91
With Windows 2000, NTFS introduces the change log, which is a sparse metadata file that records file system events (not enabled by default)
As the file exceeds its maximum on-disk size, NTFS frees the disk space for the oldest portions marking them empty An application uses Win32 APIs to read events The log file is shared, and generally large enough that an application wont miss changes even during heavy file system activity

CMSC 412 Set 11 92

Per-User Volume Quotas
NTFS quota-management support allows for per-user specification of quota enforcement
Can be configured to log an event indicating the occurrence to the system Event Log if a user surpasses his warning limit If a user attempts to use more volume storage then her quota limit permits, NTFS can log an event to the system Event Log and fail the application file I/O that would have caused the quota violation with a "disk full" error code
User disk space is tracked on a per-volume basis by summing the logical sizes of all the files and directories that have the user as the owner in their security descriptors

CMSC 412 Set 11 93

Link Tracking
Several types of symbolic file links are used by layered applications
Shell shortcuts allow users to place files in their shell namespace (on their desktop, for example) that link to files located in the file system namespace Object linking and embedding (OLE) links allow documents from one application to be transparently embedded in the documents of other applications
In the past, these links were difficult to manage
If someone moved a link source (what a link points to), the link broke
Windows now has a link-tracking service, TrkWks (it runs in services.exe), tags link sources with a unique object ID
NTFS can return the name of a file given a link, so if the link moves the service can query each of a systems volume for the object ID A distributed link-tracking service, TrkSvr, works to track link source movement across systems

Write the cache Cache manager
Access the mapped file or flush the cache Virtual memory manager

CMSC 412 Set 11 100

Components related to NTFS

Cache Manager

System wide caching
for NTFS and other file systems drivers Including network file system drivers (server and redirectors)
Cached files are mapped into virtual memory
Specialized interface from Cache Manager to NT virtual memory manager Memory manager calls NTFS to access disk driver and obtain file

Log File Service

2 copies of transaction logs Transaction log is flushed to disk before write-data is sent to disk Cache manager performs actual flush operation

CMSC 412 Set 11 101

NTFS & File Objects
Process Handle table Stream control blocks Data attribute File control block Master file table

File object

Object manager data structures File object
NTFS data structures App accesses files as NT objects by handles. Object Manager and security subsystem verify access rights

Userdefined attribute

(used to manage the on-disk structure)

NTFS database

(on disk)

CMSC 412 Set 11 102

NTFS On-Disk Structure
Volumes correspond to logical partitions on disk Fault tolerant volumes may span multiple disks
Windows 2000 Disk Administrator utility
Volume consists of series of files + unallocated space
FAT volume: some areas specially formatted for file system NTFS volume: all data are stored as ordinary files
NTFS refers internally to clusters
Cluster factor: #sectors/cluster; varies with volume size; (integral number of physical sectors; always a power of 2)
Logical Cluster Numbers (LCNs):
refer to physical location LCNs are contiguous enumeration of all clusters on a volume

CMSC 412 Set 11 103

NTFS Cluster Size
Default cluster size is disk-size dependent
512 bytes for small disks (up to 512 MB) 1 KB for disks up to 1 GB 2 KB for disks between 1 and 2 GB 4 KB for disks larger than 2 GB
Tradeoff: disk fragmentation versus wasted space NTFS refers to physical locations via LCNs
Physical cluster = LCN * cluster-factor
Virtual Cluster Numbers (VCNs):
Enumerates clusters belonging to a file; mapped to LCNs LCNs are not necessarily physically contiguous

CMSC 412 Set 11 104

Master File Table
All data stored on a volume is contained in a file MFT: Heart of NTFS volume structure

Implemented as array of file records One row for each file on the volume (including one row for MFT itself) Metadata files store file system structure NTFS information metadata (hidden files; $MFT; $Volume.) file More than one MFT record for highly fragmented files Nfi.exe Utility from OEM Support Tools allows to dump MFT content (see support.microsoft.com/support/ kb/articles/Q253/0/66.asp)
MFT MFT copy (partial) Log file Volume file Attribute def. table Root directory Bitmap file Boot file Bad cluster file. User files and dirs.
April 2008 CMSC 412 Set 11 105

NTFS operation

Mounting a volume
1. 2. NTFS looks in boot file for physical address of MFT ($MFT) 2nd entry in MFT points to copy of MFT ($MFTMirr)
used to locate metadata files if MFT is corrupted
MFT entry in MFT contains VCN-to-LCN mapping info NTFS obtains from MFT addresses of metadata files

NTFS opens these files

NTFS performs recovery operations File system is now ready for user access

CMSC 412 Set 11 106

NTFS metadata
NTFS writes to log file ($LogFile) Record all commands that change volume structure Root directory: When NTFS tries to open a file, it starts search in the root directory Once the file is found, NTFS stores the files MFT file reference Subsequent read/write ops. may access files MFT record directly Bitmap file ($Bitmap): stores allocation state volume; each bit represents one cluster Boot file ($Boot): Stores bootstrap code Has to be located at special disk address Represented as file by NTFS -> file ops. possible (!) (no editing)

CMSC 412 Set 11 107

NTFS metadata (contd.)
Bad-cluster file ($BadClus)
Records bad spots on the disk

Volume file ($Volume)

Contains: volume name, NTFS version Bit, which indicates whether volume is corrupted
Attribute Definition Table ($AttrDef)
Defines attribute types supported on the volume Indicates whether they can be indexed, recovered, etc.
April 2008 CMSC 412 Set 11 108
File Records & File Reference Numbers
Sequence number File number 0
File on NTFS volume is identified by file reference
File number == index in MFT Sequence number used by NTFS for consistency checking; incremented each time a reference is re-used

File Records:

File is collection of attribute/value pairs (one of which is data) Unnamed data attribute Other attributes: filename, time stamp, security descriptor,. Each file attribute is stored as separate stream of bytes within a file

CMSC 412 Set 11 109

File Records (contd.)
NTFS doesnt read/write files:
It reads/writes attribute streams Operations: create, delete, read (byte range), write (byte range) Read/write normally operate on unnamed data attribute

NTFS filename Security desc. Startin g VCN
Data Startin g LCN Number of clusters 4 4
VCN-to-LCN mappings for a nonresident data attribute

LCN 1357 1358

April 2008 CMSC 412 Set 11 118

LCN 1590 1591

Data Compression
NTFS supports compression Per-file, per-directory, per-volume basis NTFS compression is performed on user data only, not NTFS metadata
Inspect files/volume via Winndows API: GetVolumeInformation(), GetCompressedFileSize() Change settings for files/directories: DeviceIoControl()
with flags FSCTL_GET_COMPRESSION, FSCTL_SET_COMPRESSION

CMSC 412 Set 11 119

Compression of sparse files
NTFS zeroes all file contents on creation (C2 req.) Many sparse files contain large amount of zero-bytes
These bytes occupy space on disk unless files are compressed
NTFS filename Security desc. Startin g VCN 0
Data Startin g LCN Number of clusters 16 16

3 Data

15 1370

LCN 1357 1358.

VCN 32

LCN 1590 1591.

Certain ranges of VCNs have no 1603 disk allocation (16-31, 64-127)

CMSC 412 Set 11 120

Compressing Nonsparse Data
NTFS divides the files unprocessed data into compression units 16 clusters long Certain sequence might not compress much
NTFS determines for each compression unit whether it will shrink by at least on cluster If data does not compress, NTFS allocates cluster space and simply writes data If data compresses at least one cluster, NTFS allocates only the clusters needed for compressed data
When writing data, NTFS ensures that each run begins on virtual 16-cluster boundary
NTFS reads/writes at least one compression unit when accessing a file Read-ahead + asynch. decompression improves performance

CMSC 412 Set 11 121

Data runs of a compressed file

Compressed data

LCN 19

Noncompressed data

97 Startin g VCN Startin g LCN No. of cluster s

112 63

121 122

97 113

MFT record for a compressed file

CMSC 412 Set 11 122

Windows - NTFS Extensions
Disk quotas on per-user bases Security descriptors (ACLs) can be stored once but referenced in multiple files Native support for properties (OLE), including indexing Reparse points implementation of symbolic links Mount points for arbitrary file system volumes Support for sparse files Distributed link tracking (via global object Ids) Renaming the target file will no longer break links (shortcuts.) Add disk space to an NTFS volume without reboot No decompressing when transmitting files over network

CMSC 412 Set 11 123

File System Driver Architecture
Local File System Drivers (Local FSDs):
Ntfs.sys, Fastfat.sys, Udfs,sys, Cdfs,sys Responsible for registering with the I/O manager and volume recognition/integrity checks FSD creates device objects for each mounted file system format I/O manager makes connection between volumes device objects (Created by storage device) and the FSDs device object Local FSDs use cache manager to improve file access performance Dismount operation permits the system to disconnect FSD from volume object When media is changed or when application requires raw device access I/O manager reinitiated volume mount operation on next access to media

CMSC 412 Set 11 124

Layered Drivers I/O System Architecture

1)Call I/O service

Environment subsystem or DLL Services

I/O manager

7)Return I/O pending status User mode Kernel mode
2)The I/O manager creates an IRP, initializes first stack location and calls file system driver IRP 3)File system driver fills in a 2nd IRP stack location and calls the disk driver
6)Return I/O pending status File system driver

IRP Disk driver

5)Return I/O pending status
4)Send IRP data to device (or queue IRP), and return
Optimization: associated IRPs may work in parallel on a single I/O request

CMSC 412 Set 11 125

File System Driver Architecture (contd.)
Remote File System Drivers (Remote FSDs):

Application user mode

Client-side FSD translates I/O requests from applications into network file system protocol commands Server-side FSD listens for network commands and issues I/O I/O manager requests to local FSD Windows client-side remote FSD: LANMan Redirector Remote FSD Implemented as port/miniport driver (redirector) Includes Windows service Workstation Server-side FSD server: LANMan Server client Includes Windows service Server CIFS common internet file system (enhancement of Server Message Block protocol)

kernel mode

server Remote FSD (server)

Local FSD

volume
April 2008 CMSC 412 Set 11 126

Storage device driver

Windows Remote File Drivers:
Server Message Block (SMB) protocol
SMB is a client server, request-response protocol.
Addl. info at http://anu.samba.org/ cifs/docs/what-is-smb.html
The only exception to the request-response nature of SMB is when the client has requested opportunistic locks (oplocks) and the server subsequently has to break an already granted oplock because another client has requested a file open with a mode that is incompatible with the granted oplock. In this case, the server sends an unsolicited message to the client signaling the oplock break.
April 2008 CMSC 412 Set 11 127

SMB and the OSI model

Clients connect to servers using TCP/IP (actually NetBIOS over TCP/IP as specified in RFC1001 and RFC1002), NetBEUI or IPX/SPX. SMB was also sent over the DECnet protocol. Digital (now HP) did this for their PATHWORKS product
April 2008 CMSC 412 Set 11 128

SMB characteristics

NetBIOS Names

If SMB is used over TCP/IP, DECnet or NetBEUI, then NetBIOS names must be used in a number of cases. NetBIOS names are up to 15 characters long, and are usually the name of the computer that is running NetBIOS. Microsoft, and some other implementers, insist that NetBIOS names be in upper case, especially when presented to servers as the CALLED NAME.
Protocol functionality (Core protocol):
connecting to and disconnecting from file and print shares opening and closing files opening and closing print files reading and writing files creating and deleting files and directories searching directories getting and setting file attributes Locking and unlocking byte ranges in files

CMSC 412 Set 11 129

SMB characteristics (contd.)

Security

The SMB model defines two levels of security: Share level.
Each share can have a password, and a client only needs that password to access all files under that share. This was the first security model that SMB had and is the only security model available in the Core and CorePlus protocols.

User Level.

Protection is applied to individual files in each share and is based on user access rights. Each user (client) must log in to the server and be authenticated by the server. When it is authenticated, the client is given a UID which it must present on all subsequent accesses to the server. This model has been available since LAN Manager 1.0.

CMSC 412 Set 11 130

SMB Clients and Servers

Clients:

Included in WfW 3.x, Win 95, Win98, Win ME and Windows NT/2000/XP/Server 2003/Vista. smbclient from Samba, smbfs for Linux, SMBlib

Servers:

Microsoft Windows for Workgroups 3.x, Win95, Win98, Win ME, Windows NT/2000/XP/Server 2003/Vista Samba (Linux, Solaris, SunOS, HP-UX, ULTRIX, DEC OSF/1, Digital UNIX, Dynix (Sequent), IRIX (SGI), SCO Open Server, DG-UX, UNIXWARE, AIX, BSDI, NetBSD, NEXTSTEP, A/UX) The PATHWORKS family of servers from Digital LAN Manager for OS/2, SCO, etc VisionFS from SCO Advanced Server for UNIX from AT&T (NCR?) LAN Server for OS/2 from IBM

CMSC 412 Set 11 131

Administrators Pak
Ten Powerful Tools for System Repair, Data Recovery, and Troubleshooting

ERD Commander 2005

Autoruns: View programs configured to start automatically when the system boots or at user login Console: Run batch files or CHKDSK from a command prompt Crash Analyzer Wizard: Diagnose the cause of a system crash Disk Commander : Repair damaged partition tables and retrieve data from corrupted or deleted volumes Map Network Drive: Assign a drive letter to a network computer or folder Notepad: Edit/create text-based files such as INI files RegEdit: Import and export registry files Search: Locate files and folders Service and Driver Manager: Enable or disable services and drivers Solution Wizard: Determine which ERD Commander 2005 utility can best solve your system problem System Compare: Compare the files and registry settings of an unbootable system and a functioning system for differences System File Repair Wizard: Walk through the DLLCache directory to ensure key Windows files are not corrupt System Info: View OS info, service packs, and configuration System Restore: Roll back Windows XP systems to a working state TCP/IP Configuration: Customize NIC settings for network access Volumes: View detailed info on logical and physical drives
ERD Commander 2005 is a powerful, easy-to-use utility for repairing dead and locked-out Windows NT4 /2000 /XP /Server 2003 machines. ERD Commander 2005 allows you to bypass the OS of a dead system and boot into a self-contained windowing environment with full access to the damaged machines volumes and configuration settings. The ERD Commander 2005 environment offers you numerous repair, data recovery, and diagnostic tools to identify and correct problems on the dead computer, and includes support for network and Internet access.
Disk Management: Partition disks and create or format volumes Disk Wipe: Erase disks or volumes via single pass or four-pass secure overwrite with verification Event Log Viewer: Review System, Security, and Application logs Explorer: Copy and move files FileRestore: Find and recover deleted files File Sharing: Copy files to or from a system via the network Hotfix Uninstall Wizard: Remove a Windows hotfix or service pack Internet Browser: Browse the Internet Locksmith : Change Administrator or other local user account passwords
Administrators Pak Navigator
The Administrators Pak Navigator helps users select and utilize the appropriate Administrators Pak tool to solve a particular Windows system emergency. It also provides a centralized starting point for creating various boot media (diskettes and CDs) and includes a multimedia demo that demonstrates some of the most powerful features of the various tools.

TROUBLESHOO T I N G

D ATA R E C O V E RY

S Y S T E M R E PA I R

Remote Recover
Salvages data via the network from an unbootable systems drives Allows disinfection of remote systems volumes using your local antivirus software Includes the Locksmith utility to change the Administrator password on client systems Supports CD, diskette, and PXE boot options Quickly and easily mount and interact with a remote systems disks as if they were local. Remote Recover allows for data recovery, antivirus scanning and repair, CHKDSK scanning and repair, and more, of remote volumes. A Windows PE-based CD boot client allows one boot CD to work across all systems, and allows for the easy addition of any Windows 2000, Windows XP, or Windows Server 2003 network controller and storage controller device driver. Diskette-based and PXE-based clients are also available for systems with no CD-bootable drive or diskette drive.

NTFSDOS Professional

Provides full read/write access to NTFS volumes Supports long file names under MS-DOS Supports running of CHKDSK from within DOS Works with DOS antivirus tools to safely scan and clean systems while they are offline With NTFSDOS Professional, you can access the NTFS volumes on a Windows NT4/2000/XP/Server 2003 system that is unbootable due to damaged, missing, or misconfigured system files. Use the NTFSDOS Professional DOS boot diskette to access NTFS volumes from a DOS prompt and restore systems to a bootable condition. It provides unrestricted read/write access to NTFS partitions so you can run third party applications such as virus scanners or disk imaging software, as well as the NTFSCHK Check Disk program to verify and repair the NTFS disk structure.

Crash Analyzer Wizard

Debug a Windows crash dump to diagnose system errors Pinpoint the most likely cause among the drivers on the crashed system View diagnosed results and verbose results Utilizes a copy of the Microsoft Debugging Tools for Windows Quickly and easily diagnose the cause of a Windows crash dump with an easy-to-understand diagnosis of the driver that caused the problem. Crash Analyzer is also included in the ERD Commander 2005 environment.

FileRestore

Easy-to-use searching and sorting gets you started quickly Supports all Windows file systems-NTFS, FAT, and FAT32 Designed for Windows 9x/Me/NT4/2000/ XP/Server 2003 Recovers files deleted from Jaz, Zip, diskette drives, USB Flash Drives and CompactFlash photo cards Recover files that have been lost or deleted from your computer. FileRestore can bring back files that would otherwise be gone for good, including files emptied from the Recycle Bin, deleted by application programs and remote processes, lost with removed directories, or deleted via a command prompt.
Filemon Enterprise Edition
Display data on all file activity on your local system or a remote system Indicate when each access is performed and by which application Automatically highlight the types of output that you select Compatible with Windows NT4/2000/XP/ Server 2003 With Filemon Enterprise Edition you can track file system activity on local and remote systems. Quickly find file accesses that coincide with error messages to identify missing, corrupt, duplicate, and out-of-date files in real time.

Regmon Enterprise Edition
Display data on all registry activity on your local system or a remote system Indicate when each access is performed and by which application Automatically highlight the types of output that you select Compatible with Windows NT4/2000/XP/ Server 2003 Regmon Enterprise Edition provides real-time reports of registry accesses that help you pinpoint and correct faulty registry settings, learn where registry settings are stored, and learn which keys affect application behavior.

AD Explorer

Explore Active Directory quickly and easily Modify or delete a selected attribute or insert a new attribute Rename, delete, copy, or insert a new object Create custom Favorites lists for fast navigation AD Explorer enables you to find, modify, add, and delete Active Directory objects and attributes. AD Explorer displays information in two panes. The Object Pane is the left-hand pane that displays Active Directory objects. The Attribute Pane is the right-hand pane that displays attributes of the object selected in the Object Pane.
Insight for Active Directory
Diagnose problems by installing on systems running email, databases, ERP, and other applications to troubleshoot authentication issues Diagnose problems by installing on domain controllers to view replication events sent via LDAP Diagnose problems by installing on workstations to troubleshoot issues with Windows logon, printing, le sharing, and client applications Double-click an event in the display to open AD Explorer View the LDAP calls made from any computer to the Active Directory and the corresponding results. Insight for Active Directory allows you to pinpoint AD configuration issues, analyze application usage of Active Directory, and guide troubleshooting of applications and services that depend on Active Directory.
TCP Tools (TCPView Professional and TCPVStat)
Provides a continuous, real-time display of all TCP/IP activity Shows which process has an address open Displays the IP addresses that individual processes are accessing Indicates the amount of data being sent and received Can be configured to capture only activity from selected processes or IP addresses With TCPView Professional and TCPVStat you can easily monitor TCP/IP network activity on Windows systems. It shows you the process associated with each TCP/IP address in real-time, making it easy to determine the application responsible for specific connections and activity. It also lets you see the amount of data sent and received over a network connection. A range of configuration options let you auto-refresh its display, save output to a file, and filter and highlight entries by process, IP address, or port.

Requirements

1. ERD Commander 2005 ERD Commander 2005 requires that the target system have a bootable CD-ROM drive, and one of the following operating systems: Windows Windows Windows Windows NT 4 Service Pack 6a 2000 XP (x86 versions) Server 2003 (x86 versions) 3. NTFSDOS Professional NTFSDOS Professional requires a working Windows NT4/2000/XP/Server 2003 Workstation or Server installation, a licensed MS-DOS 7.0 or higher boot diskette, and 2 to 3 blank diskettes. NTFSDOS Professional does not recognize software volume sets, striped sets, or mirror sets. 4. Crash Analyzer Wizard The Crash Analyzer Wizard requires Internet access and a writable volume formatted with NTFS or FAT. 5. FileRestore FileRestore runs on all Windows platforms. FileRestore recovers files from local drives only; in order to recover files on a network drive the application must run on the file server. Because FileRestore provides access to all deleted files on a system, regardless of which user they originally belonged to, you must have Administrator privilege in order to run it. 6. FileMon Enterprise Edition FileMon Enterprise Edition runs on all Windows platforms. You need a network using the TCP/IP protocol to access other computers on your network. If you wish to run Filemon Enterprise Edition on Windows 95 you must install the WinSock 2 update. 7. RegMon Enterprise Edition RegMon Enterprise Edition runs on all Windows platforms. You need a network using the TCP/IP protocol to access other computers on your network. If you wish to run Regmon Enterprise Edition on Windows 95 you must install the WinSock 2 update. 8. AD Explorer AD Explorer runs on Windows 2000/XP/Server 2003. You must have an account with Administrator rights to view or log activity on a system. 9. Insight for Active Directory Insight for Active Directory runs on Windows 2000/XP/ Server 2003. You must have an account with Administrator rights to view or log activity on a system. 10. TCP Tools TCP Tools runs on all Windows platforms; on Windows 95 you will need COMCTL32.DLL version 4.7 or higher and the Windows 95 WinSock 2 update.
2005 Winternals Software LP. All rights reserved. Winternals is a registered trademark of Winternals Software LP. Administrators Pak, ERD Commander, Disk Commander, Locksmith, Remote Recover, NTFSDOS Professional, Crash Analyzer Wizard, FileRestore, Filemon Enterprise Edition, Regmon Enterprise Edition, AD Explorer, Insight for Active Directory, TCP Tools, TCPView Professional, and TCPVStat are trademarks of Winternals Software LP. Windows 95, Windows 98, Windows Me, Windows NT, Windows 2000, Windows XP, Windows Server 2003, and Active Directory are registered trademarks of Microsoft Corporation in the US and/or other countries.

3101 Bee Caves Road Suite 150 Austin, TX 78746 www.winternals.com Ph 512.330.9130 Fax 512.330.9131
Regardless of the operating system, ERD Commander 2005 requires a minimum of 64MB (128MB recommended) of system RAM and an Intel Pentium (or compatible) 166 MHz or faster processor, as well as a CD-ROM drive and a computer with BIOS support booting from that CD-ROM drive. The ERD Commander 2005 Boot CD-ROM Creation Wizard runs on x86 versions of Windows 2000, Windows XP and Windows Server 2003. It is not supported on earlier versions of Windows, or 64-bit versions of Windows XP or Windows Server 2003 running on Intel Itanium or 64-bit Extended systems. For more specific information about the requirements for the individual utilities included in ERD Commander 2005, refer to the documentation available at www.winternals.com/support/. 2. Remote Recover You must have the following components in order to install and run Remote Recover: A system running Windows 2000, or a 32-bit version of Windows XP, or Windows Server 2003 A network using the TCP/IP protocol A network interface card and corresponding Windows 2000, Windows XP, or Windows Server 2003 driver for each client system (if using CD-based boot clients). If your clients utilize mass storage controller drivers not supported by Windows (referred to as an OEM storage controller) then you need to provide drivers at client creation time. A network interface card and corresponding NDIS2 driver for each client system (if using PXE or floppy disk-based boot clients). If you choose to boot client systems using a Remote Recover client CD, you will need Recordable CD media for each client boot CD you require. If you choose to boot client systems using a Remote Recover client floppy disk, you will need a formatted floppy diskette for each client boot diskette you require. If you choose to boot client systems using the Remote Recover PXE boot image, you will need a DHCP server that supports the PXE boot protocol, and the client system must have a system BIOS network interface card that implements PXE.