Metadata Block ChangesPermissions ChangeDeleting .exe FileRenaming .exe FileCopying .exe File

.exe File Metadata Block Changes

The table below identifies the changes which occur to the metadata blocks in the file system. The eighth byte of each metadata block is also identified in the table below. The blocks in use are different to the other files tested (.doc and .txt) and also different to the ones used by a folder. There are less in use than when testing the folder on the system, but more than the .doc and .txt files. However in the files case, they had contents at offset 0x07B0000 and when copied, at 0x07C0000. In the case of the .exe file, there is no file contents, so there is nothing to store at these offsets.

Metadata Block Offset

Starting Bytes

helloworld.exe

Permissions Changed

File Deleted

Shift & Delete

Rename

Copy File

0x0750000

94 01

Identical

0A

Identical

0A

Deleted file

reference

 

Identical

0A

Identical

0A

Identical

0A

0x0754000

95 01

Identical

0C

Identical

0C

Identical

0C

Identical

0C

Identical

0C

Identical

0C

0x0758000

96 01

Identical

0B

Identical

0B

Identical

0B

Identical

0B

Identical

0B

Identical

0B

0x075C000

97 01

Identical

0C

Identical

0C

Identical

0C

Identical

0C

Identical

0C

Identical

0C

0x07B0000

AC 01

 

0C

 

14

 

14

 

14

 

14

 

14

0x07B4000

AD 01

Identical

0C

 

14

Identical

0C

Identical

0C

 

14

 

14

0x07B8000

AE 01

Identical

0D

Identical

0D

Identical

0D

Identical

0D

Identical

0D

Identical

0D

 

Immediately there are obvious changes from when a .doc or .txt file is saved. Below you can see the same block from both drives, the top one being the one with a .txt file and the bottom one with an .exe file with the same name. The .exe drive shown is the original one, before any actions have been performed on the .exe file. After the Recycle Bin entry and the MACE times, it would be expected for the .exe file's filename to follow underneath. This is not the case however, as after the MACE times, nothing follows, as is shown below.

Offset(h)  00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17 18 19 1A 1B 1C 1D 1E 1F

000750560  78 00 00 00 10 00 1C 00 00 00 30 00 48 00 00 00 30 00 02 00 24 00 52 00 45 00 43 00 59 00 43 00  x.........0.H...0...$.R.E.C.Y.C.

000750580  4C 00 45 00 2E 00 42 00 49 00 4E 00 00 00 00 00 01 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00  L.E...B.I.N.....................

0007505A0  85 13 AD F9 7B 2B D0 01 35 8E B1 F9 7B 2B D0 01 35 8E B1 F9 7B 2B D0 01 35 8E B1 F9 7B 2B D0 01  …..ù{+Ð.5Ž±ù{+Ð.5Ž±ù{+Ð.5Ž±ù{+Ð.

0007505C0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 10 00 00 00 00 50 00 00 00 10 00 18 00  ........................P.......

0007505E0  04 00 28 00 28 00 00 00 20 00 00 80 00 00 00 00 00 06 00 00 00 00 00 00 01 00 00 00 00 00 00 00  ..(.(... ..€....................

000750600  00 00 00 00 00 00 00 00 0C 00 1C 00 68 00 65 00 6C 00 6C 00 6F 00 77 00 6F 00 72 00 6C 00 64 00  ............h.e.l.l.o.w.o.r.l.d.

 

000750560  78 00 00 00 10 00 1C 00 00 00 30 00 48 00 00 00 30 00 02 00 24 00 52 00 45 00 43 00 59 00 43 00  x.........0.H...0...$.R.E.C.Y.C.

000750580  4C 00 45 00 2E 00 42 00 49 00 4E 00 00 00 00 00 01 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00  L.E...B.I.N.....................

0007505A0  46 D6 33 FA 7F 2B D0 01 46 D6 33 FA 7F 2B D0 01 41 37 36 FA 7F 2B D0 01 46 D6 33 FA 7F 2B D0 01  Fö3ú.+Ð.Fö3ú.+Ð.A76ú.+Ð.Fö3ú.+Ð.

0007505C0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00  ................................


When the file has been deleted, this offset used is far away from the offset used when the .doc and .txt files were deleted. Offsets 0x0754000, 0x075C000 and 0x07B8000 are metadata blocks with a familiar layout; it is in the same form as the .doc and .txt files. The file name is included in each of these blocks and each block is structured like the blocks used with .doc and .txt files. Across each drive they are all the same as each other too, as the table above shows. The metadata block at offset 0x07B8000 is also the same across all drives.

With four of the metadata blocks being identical to one another, with two different sets of MACE times between the four of them, this is an example of why ReFS has data redundancy benefits over other file systems.