53. NTFS Transaction Example

• When a program is modifying a file, the following steps might occur:

  1. read MFT entry for directory entry file is in

  2. read directory entry file is in

  3. read MFT record for file

  4. write file

  5. update A time in file's MFT record

  6. update M time in file's MFT record

  7. update A time in directory entry for that file

  8. update M time in directory entry for that file

• The list gets considerably longer if the file is encrypted or compressed.

• If the program fails before all transaction steps are complete due to a crash, the system rolls back to the previous values in order to maintain consistency of the file system.

  • NOTE: This is not to be confused with running CHKDSK. NTFS itself is providing a reliable, crash-resilient environment.