Brief Introduction
The highest level of organization in the file system is the volume. A file system resides on a volume. A volume contains at least one partition, which is a logical division of a physical disk. A volume that contains data that exists on one partition is called a simple volume, and a volume that contains data that exists on more than one partition is called a multipartition volume.
Volumes are implemented by a device driver called a volume manager. Examples include the FtDisk Manager, the Logical Disk Manager (LDM), and the VERITAS Logical Volume Manager (LVM). Volume managers provide a layer of physical abstraction, data protection (using some form of RAID), and performance.
File System Recognition
The goal of file system recognition is to allow the Windows operating system to have an additional option for a valid but unrecognized file system other than RAW. To achieve this, beginning with Windows 7 and Windows Server 2008 R2, the system defines a fixed data structure type that can be written to the media on which an enabled technology that alters the file system format is active. This data structure, if present on logical disk sector zero, would then be recognized by the operating system and notify the user that the media contains a valid but unrecognized file system and is not a RAW volume if the drivers for the file system are not installed.
File System Recognition Components and Use
Several recent storage technologies have altered the on-disk file system format such that the media on which these technologies are enabled become unrecognizable to earlier versions of Windows due to the file system drivers not existing when a particular earlier version of Windows was released. The previous default behavior in this scenario was as follows. When storage media is not a known file system, it is identified as RAW, and then propagated to the Windows Shell, where Autoplay prompts with the format user interface (UI). File system recognition can solve this if the authors of the new file system correctly write the proper data structure to the disk.
File system recognition uses the following components and layers within the operating system to achieve its goals:
1. Storage media, where a fixed data structure resides as a sequence of bytes arranged internally in a predefined structure called the FILE_SYSTEM_RECOGNITION_STRUCTURE data structure. It is the responsibility of the file system developer to create this on-disk structure properly.
2. File system recognition at the application level, achieved via the use of the FSCTL_QUERY_FILE_SYSTEM_RECOGNITION device I/O control code.
3. The Windows Shell UI uses the previously listed components to provide more flexible and robust Autoplay and related support for unrecognized file systems, but it can work only if the FILE_SYSTEM_RECOGNITION_STRUCTURE data structure exists in logical disk sector zero. Developers implementing new file systems should utilize this system to ensure that their file system is not mistakenly assumed to be of type RAW.
Computing a File System Recognition Checksum Code Snippet
The FILE_SYSTEM_RECOGNITION_STRUCTURE structure, defined internally by Windows and used by file system recognition (FRS), contains a checksum value that must be properly computed for FRS to work properly with a specified unrecognized file system. The following code snippet accomplishes this computation (this code intended for vendors).
#include <windows.h>
#include <winioctl.h>
#include <stdio.h>
typedef struct _FILE_SYSTEM_RECOGNITION_STRUCTURE {
UCHAR Jmp[3];
UCHAR FsName[8];
UCHAR MustBeZero[5];
ULONG Identifier;
USHORT Length;
USHORT Checksum;
} FILE_SYSTEM_RECOGNITION_STRUCTURE, *PFILE_SYSTEM_RECOGNITION_STRUCTURE;
/*
Routine Description: This routine computes the file record checksum.
Arguments: Fsrs - Pointer to the record.
Return Value: The checksum result.
*/
USHORT ComputeFileSystemInformationChecksum(PFILE_SYSTEM_RECOGNITION_STRUCTURE Fsrs)
{
USHORT Checksum = 0;
USHORT i;
PUCHAR Buffer = (PUCHAR)Fsrs;
USHORT StartOffset;
// Skip the jump instruction
StartOffset = FIELD_OFFSET(FILE_SYSTEM_RECOGNITION_STRUCTURE, FsName);
wprintf(LIn ComputeFileSystemInformationChecksum()\n);
for (i = StartOffset; i < Fsrs->Length; i++)
{
// Skip the checksum field itself, which is a USHORT.
if ((i == FIELD_OFFSET(FILE_SYSTEM_RECOGNITION_STRUCTURE, Checksum)) ||
(i == FIELD_OFFSET(FILE_SYSTEM_RECOGNITION_STRUCTURE, Checksum)+1))
{
continue;
}
Checksum = ((Checksum & 1) ? 0x8000 : 0) + (Checksum >> 1) + Buffer[i];
}
return Checksum;
}
int wmain()
{
PFILE_SYSTEM_RECOGNITION_STRUCTURE Fsrs = {0};
ComputeFileSystemInformationChecksum(Fsrs);
return 0;
}