文件系统存储文件元数据的位置 [英] Where filesystems store their file metadata

问题描述

所以我知道一个文件是由数据和元数据组成的，这些数据是关于它的信息（通常是文件名，文件类型，创建和修改日期等等）。

我的问题是存储信息的确切位置。我知道它可以包含在文件，目录或数据库中，但对于Windows，Linux和MAC-OS文件系统，我似乎无法找到这个信息...
<在Windows和Mac的情况下，大部分信息是专有的。

对于 Windows ，我可以肯定地说已经为Linux编写了足够接近的NTFS文件系统驱动程序版本。你可以看看，也有一些文件，大部分是由Richard'Flatcap'Russon写的（ http：// www .flatcap.org / ntfs / ）。

有关FAT文件系统的文档已经在很久以前公开，意图是提供足够的信息对于从事闪存驱动器等开发人员和工程师。 （ http://msdn.microsoft.com/en-us/ library / windows / hardware / gg463080.aspx ）

Linux 发行版使用的Ext文件系统的文档可以在网络容易。 （Ext2： http://www.nongnu.org/ext2-doc/ext2.html

我不知道 Mac 使用了什么，但我敢打赌它是某种专有的可憎的衍生于现有的格式（可能是分机）。这只是我的看法，不要把它当作是事实。

所有这些格式都有一些可以包含元数据的结构。该文件只是物理驱动器上的某个字节流。大多数文件系统应具有至少存储文件位置（通常是文件每个片段的起始簇）和文件大小的结构。元数据的其余部分由每个文件系统来实现。例如， FAT文件系统有每个目录的表，每个目录存储关于它包含的文件的元数据。但它也有一个FAT表，它包含文件系统中每个文件的片段位置。

$ b

NTFS文件系统有一个大表主文件表（Master File Table），它保存文件系统包含的每个文件的元数据记录，包括表本身。每个记录包含每个片段的物理驱动器上的所有元数据，包括文件位置。
但是，目录结构作为数据保存在目录文件记录中。然而，NTFS有更多的结构来保存关于文件的信息，例如USN Journal或Volume Bitmap。
$ b

要访问元数据

包含在文件系统中，您必须解析原始卷或使用操作系统的API公开的函数。 API通常不会提供有关元数据的所有信息。例如，Windows API将为您提供遍历USN日记的功能，以查找有关特定文件的信息，但无法直接获取文件的MFT属性。

<再一次，我必须强调，即使在这些专有文件系统上的大部分文档中，您都是在黑暗中进行拍摄，因为这是他们的知识产权。如果不是我们现在大部分的文档都来自逆向工程

So I know that a file is composed by it's data and also metadata, which is information about it (usually the name, the type of the file, dates of creation and modification, etc.).

My question is where exactly is that information stored. I know it can be included inside the file, the directory or in a database, but for the Windows, Linux and MAC-OS file systems I can't seem to find this information...

解决方案

Most of this information in the case of Windows and Mac is proprietary.

For Windows I can say for certain that a close enough version of the NTFS file system driver has been written for Linux. You can look into that, there's also some documentation most of it written by Richard 'Flatcap' Russon (http://www.flatcap.org/ntfs/).

Documentation on the FAT Filesystem has been made public a long time ago with the intent that it would provide ample information for developers and engineers working on flash drives and things like that. (http://msdn.microsoft.com/en-us/library/windows/hardware/gg463080.aspx)

Documentation on the Ext Filesystem used by Linux distributions can be found on the web easily. (Ext2 : http://www.nongnu.org/ext2-doc/ext2.html)

I have no clue what Mac uses but I bet it's some kind of proprietary abomination derived from an existing format (probably ext). This is just my opinion, do not take this as fact.

All these formats have some sort of structure that holds meta-data. The file is just a stream of bytes somewhere on the physical drive. Most filesystems should have a structure that stores at least the file's location (usually a starting cluster for each fragment of the file) and the file's size. The rest of meta-data is up to each file system to implement.

For example, the FAT Filesystem there are tables for each directory and each directory stores metadata about the files it contains. But it also has a FAT table that holds the fragment locations for each file contained in the filesystem.

The NTFS Filesystem has a big table called the Master File Table that holds a record of metadata for each file contained by the filesystem including the table itself. Each record holds all the metadata including the file location on the physical drive for each fragment. However, the directory structure is held as data in directory file records. However, the NTFS has even more structures that hold information about the files such as the USN Journal or the Volume Bitmap.

To access the meta-data contained by the file system you either have to parse the raw volume or to use functions exposed by the operating system's API. The API doesn't generally give you all the information you want about the metadata. For example, Windows API will give you functions to iterate through the USN Journal to find information about a particular file, but you can't get the MFT attributes of a file directly.

Again, I have to stress out that even with most of the documentation on these proprietary file systems, you're taking shots in the dark since it's their intellectual property. Some if not most of the documentation that we have now comes from reverse engineering.

这篇关于文件系统存储文件元数据的位置的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！