[ The PC Guide | Systems and Components Reference Guide | Hard Disk Drives | Hard Disk Logical Structures and File Systems | New Technology File System (NTFS) | NTFS Reliability Features and System Management ]

Transaction Recovery

NTFS is a transaction-based file system. The use of activity logging and transaction management of file system changes allows the file system to maintain its internal integrity by preventing incomplete transactions from being implemented. One key to the operation of the transaction system is the process that is employed to check for and undo transactions that were not properly completed. This is sometimes called transaction recovery. Recovery is performed on NTFS volumes each time they are mounted on the system. Most commonly, this occurs when the system is booted or rebooted.

I mentioned in the discussion of NTFS's transactional operation that the overhead from this system reduces performance somewhat. To partially mitigate this impact, NTFS uses caching of some of the logging operations--in particular, it uses a system called "lazy commit" when transactions are completed. This means that the "commit" information associated with a completed operation is not written directly to the disk for each completed transaction, but rather cached and only written to the log as a background process. This reduces the performance hit but has the potential to complicate recovery somewhat, since a commit may not get recorded when a crash occurs. To improve the recovery process, NTFS adds a checkpoint functionality. Every eight seconds, the system writes a checkpoint to the log. These checkpoints represent "milestones" so that recovery does not require scanning back through the entire activity log.

When recovery is performed, the file system examines the NTFS volume, looking at the contents of the activity log. It scans all log entries back to the last checkpoint, and performs a three-pass recovery procedure:

• Analysis Pass: The system analyzes the contents of the log to determine what parts of the volume need to be examined and/or corrected.
• Redo Pass: The system "redoes" all completed transactions that were recorded since the last checkpoint.
• Undo Pass: The system "undoes" (or rolls back) all incomplete transactions to ensure file integrity.

Once again, I think it's important to point out that the transaction logging and recovery features of NTFS do not guarantee that no user data will ever be lost on an NTFS volume. If an update of an NTFS file is interrupted, the partially-completed update may be rolled back, so it would need to be repeated. The recovery process ensures that files are not left in an inconsistent state, but not that all transactions will always be completed.

Next: Change (USN) Journals

Home  -  Search  -  Topics  -  Up