NTFS Documentation: Update Sequence Technique

Interest

• FILE records
• INDX buffers
• RCRD
• RSTR

How it works

1. In memory, increment by one the update sequence (a value stored in the header part of the structure). The value 00 00 must be skipped.
2. In memory, patch the update sequence at the end of each sector of the structure, and save the original value in the update sequence array (an array located in the header part of the structure)
3. Copy the structure from memory to the storage unit

Reading a structure from the storage unit involves the following operations:

1. Copy the structure from the storage unit to memory
2. In memory, check if its magic number is correct
3. In memory, check if the end of each sector of the structure is the update sequence
   • If this is not the case, it means that the last write operation of this structure has not been completed (e.g. a power failure happened in the middle of the operation)
   • If this is the case, restore in memory the original values at the end of each sector of the structure from the update sequence array

Note:

• Because we don't know in which order the storage unit actually writes physical sectors, we must patch the end of each sector of the structure, instead of just the end of the last sector of the structure.
• Here we rely on the hardware to check data integrity with checksum techniques.