NTFS Documentation: Log File Technique

Interest

When you want to write a file on a storage unit, you have to update the file itself plus some tables of the filesystem (say as an example the date of the file). At this point, you need a transaction made of 2 operations (update the file itself, update the date of the file).

If the transaction is realized, you are sure that your file is written on the storage unit, and that the filesystem has been left in a defined state.

If the transaction is not realized (in case of e.g. power failure, or system failure in general), the filesystem is in an undefined state. The only way for you to put it back in a defined (and sane) state (this operation is called a roll-back) is to log in a special file, the log file, which operations of the transaction have been successfully completed.

What Windows NT® does

At the first access to the disk after a system failure, the system read the log file and rolls back all the operations to the beginning of the last transaction.

What is important with this technique

• When the system writes to the log file, the operation must be atomic and immediate.
• You can put back your volume in sane state in a short time which is not related to the size of your disk but only to the complexity of the transaction that failed.

  Note: This operation is not performed by the Windows NT® chkdsk utility, but by the system: this normal and reliable operation is a feature of NTFS.

• If your hardware is reliable, you are sure that you always have access to all the files of your volume, because it is consistent. But you can't restore eventual data losses.