Home
				Free Downloads
				Product FAQs (NT)
				Product FAQs (OpenVMS)
				Product Alerts
				Technical References
				Links
	Data Recovery One of the most valuable features of the NTFS file system is datarecoverability. NTFS Logging is an automatic feature which allows NTFS to protect the file system data structures(see the earlier articles The Master File Table (MFT) and FAT versus NTFS ). Any I/O operation that affects the file system data or directory structure on thevolume is recorded in the Log File before the operation is done on the partition. Thus, if there is a system crash,any interrupted operations can be undone or redone as needed. The first time an NTFS volume is accessed after thesystem is booted, NTFS does a volume recovery. If there is little or nothing to do, the procedure is finished veryquickly. This whole procedure is fully automatic, and is always done on allNTFS volumes. It provides safety for the file system and directory structure, but does nothing for the actual data.So how can you recover lost data? There is a Windows NT driver called FtDisk (Fault Tolerant Disk Driver).It resides between Windows NT and the hard disk drivers. Its major functions are: Create stripe sets Create volume sets Create mirror sets Create duplex sets Recover lost data Stripe Sets A stripe set consists of several different partitions, all of thesame size, and each on a different physical disk. To the system, a stripe set appears as a single volume whosesize is the sum of its partitions. When a file is written to a stripe set, the data is written across all of thepartitions simultaneously, so that writing and later reading of the file can be much faster than to a single physicaldisk. If you are running Windows NT Server, FtDisk can make a stripe setinto a fault-tolerant volume by adding parity. In this case, special sections of the stripe set, called paritystripes, contain data to allow FtDisk to reconstruct any data that gets lost from the stripe set. You could actuallylose one entire disk from such a stripe set and still recover all of the data that was on that partition. Volume Sets A volume set is a partition that consists of several different physicaldisks. Let's say you have 5MB on disk C:, 20 on disk D:, and 10 on disk E:. You can make a volume set, partitionF:, out of these pieces, and have a 35MB partition. Or, you can take six 500MB physical disks and make a single3GB partition out of them. A volume set is not fault-tolerant, though. Mirror Sets A mirror set is a volume, which consists of two partitions of thesame size on different physical disks. If you are running Windows NT Server, it can be made fault-tolerant. Thepartitions have the same name. When data is written to one of them, it is simultaneously written to the other.Thus, the two partitions always contain identical data. If you lose one of the disks, or if you lose some dataon one of them, the data can be reconstructed because you have the other copy. Duplex Sets This is simply a mirror set where the partitions are under differentcontrollers. It does not protect data any better than a mirror set, but it is a little faster, and it allows youto keep working if one of the controllers fails. If you are running Windows NT Server, it can be made fault-tolerant. Recovering Lost Data There is a technique called Sector Sparing, in which some sectorsof a disk are set aside as spares. When a disk sector goes bad, FtDisk can automatically replace the bad sectorwith one of these spares and, if the sector is on a fault-tolerant volume, FtDisk will restore the data. In otherwords, it's a complete and transparent recovery. It should be noted that not all disks provide spare sectors, buteven without spares, FtDisk can still recover the data. On any fault-tolerant volume, when a sector goes bad, FtDisk willrecover the data. If it's on a SCSI disk with spare sectors, the sector will be replaced and the recovered datawritten to the new sector, and that's the end of it. On any other disk, the data is sent to NTFS, which maps anew cluster to replace the bad sector, transfers the data to the new cluster, and assigns the bad sector to thebadblock file. If the volume is not fault-tolerant, when a sector goes bad, FtDiskwill report the error to NTFS, which maps a new cluster to replace the bad sector and assigns the bad sector tothe badblock file. The data in the bad sector is not recovered. Of course, FtDisk must be installed before any of this can be done. So, for full data recoverability, you need: FtDisk installed Stripe sets with parity and/or Mirror sets and/or Duplex sets Diskeeper will defragment any of these partition sets. Of course,it's still a very good idea to maintain full current backups, and a copy of the backups off-site. After all, NTFSwill not protect your data from a fire.   If you have any comments about this article orany requests for new technical articles e-mail
	Executive Software Europe