The table below identifies the changes which occur to the
metadata blocks in the file system. The eighth byte of each metadata block is
also identified in the table below. The blocks in use are different to the
other files tested (.doc and .txt) and also different to the ones used by a
folder. There are less in use than when testing the folder on the system, but
more than the .doc and .txt files. However in the files case, they had contents
at offset 0x07B0000 and when copied, at 0x07C0000. In the case of the .exe
file, there is no file contents, so there is nothing to store at these offsets.
Metadata
Block Offset |
Starting
Bytes |
helloworld.exe |
Permissions
Changed |
File
Deleted |
Shift
& Delete |
Rename |
Copy
File |
||||||
0x0750000 |
94
01 |
Identical |
0A |
Identical |
0A |
Deleted file reference |
|
Identical |
0A |
Identical |
0A |
Identical |
0A |
0x0754000 |
95
01 |
Identical |
0C |
Identical |
0C |
Identical |
0C |
Identical |
0C |
Identical |
0C |
Identical |
0C |
0x0758000 |
96
01 |
Identical |
0B |
Identical |
0B |
Identical |
0B |
Identical |
0B |
Identical |
0B |
Identical |
0B |
0x075C000 |
97
01 |
Identical |
0C |
Identical |
0C |
Identical |
0C |
Identical |
0C |
Identical |
0C |
Identical |
0C |
0x07B0000 |
AC
01 |
|
0C |
|
14 |
|
14 |
|
14 |
|
14 |
|
14 |
0x07B4000 |
AD
01 |
Identical |
0C |
|
14 |
Identical |
0C |
Identical |
0C |
|
14 |
|
14 |
0x07B8000 |
AE
01 |
Identical |
0D |
Identical |
0D |
Identical |
0D |
Identical |
0D |
Identical |
0D |
Identical |
0D |
Immediately there are obvious changes from when a .doc or
.txt file is saved. Below you can see the same block from both drives, the top
one being the one with a .txt file and the bottom one with an .exe file with
the same name. The .exe drive shown is the original one, before any actions
have been performed on the .exe file. After the Recycle Bin entry and the MACE
times, it would be expected for the .exe file's filename to follow underneath.
This is not the case however, as after the MACE times, nothing follows, as is
shown below.
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17
18 19 1A 1B 1C 1D 1E 1F
000750560 78 00 00 00 10 00 1C 00 00 00 30 00 48 00 00 00 30 00 02
00 24 00 52 00 45 00 43 00 59 00 43 00 x.........0.H...0...$.R.E.C.Y.C.
000750580 4C 00 45 00 2E 00 42 00 49 00 4E 00 00 00 00 00 01 07 00
00 00 00 00 00 00 00 00 00 00 00 00 00 L.E...B.I.N.....................
0007505A0 85 13 AD F9 7B 2B D0 01 35 8E B1 F9 7B 2B D0 01 35 8E B1
F9 7B 2B D0 01 35 8E B1 F9 7B 2B D0 01
..ù{+Ð.5±ù{+Ð.5±ù{+Ð.5±ù{+Ð.
0007505C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00
10 00 00 00 00 50 00 00 00 10 00 18 00 ........................P.......
0007505E0 04 00 28 00 28 00 00 00 20 00 00 80 00 00 00 00 00 06 00
00 00 00 00 00 01 00 00 00 00 00 00 00 ..(.(... ......................
000750600 00 00 00 00 00 00 00 00 0C 00 1C 00 68 00 65 00 6C 00 6C
00 6F 00 77 00 6F 00 72 00 6C 00 64 00 ............h.e.l.l.o.w.o.r.l.d.
000750560 78 00 00 00 10 00 1C 00 00 00 30 00 48 00 00 00 30 00 02
00 24 00 52 00 45 00 43 00 59 00 43 00 x.........0.H...0...$.R.E.C.Y.C.
000750580 4C 00 45 00 2E 00 42 00 49 00 4E 00 00 00 00 00 01 07 00
00 00 00 00 00 00 00 00 00 00 00 00 00 L.E...B.I.N.....................
0007505A0 46 D6 33 FA 7F 2B D0 01 46 D6 33 FA 7F 2B D0 01 41 37 36
FA 7F 2B D0 01 46 D6 33 FA 7F 2B D0 01 Fö3ú.+Ð.Fö3ú.+Ð.A76ú.+Ð.Fö3ú.+Ð.
0007505C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00
10 00 00 00 00 00 00 00 00 00 00 00 00 ................................
When the file has been deleted, this offset used is far away
from the offset used when the .doc and .txt files were deleted. Offsets 0x0754000,
0x075C000 and 0x07B8000 are metadata blocks with a familiar layout; it is in
the same form as the .doc and .txt files. The file name is included in each of
these blocks and each block is structured like the blocks used with .doc and
.txt files. Across each drive they are all the same as each other too, as the
table above shows. The metadata block at offset 0x07B8000 is also the same
across all drives.
With four of the metadata blocks being identical to one
another, with two different sets of MACE times between the four of them, this
is an example of why ReFS has data redundancy benefits over other file systems.