Windows Volume management

FT Disk and Logical Disk Manager

These days, the volumes that the user sees are rarely the same as the physical volumes that store the data. The 'user' volumes are called logical volumes, as opposed to the real 'physical' volumes. What is required is a way to map logical volumes onto physical volumes. This function is often contained in the storage subsystem controller, but Microsoft coded this into the operating system starting with Windows 2000.

The Windows operating systems from Windows 2000 onwards need to support two types of volumes, the old physical disks, which may be partitioned or extended, and the new logical or dynamic disks that can be RAID, striped, mirrored, concatenated or just simple volumes. Windows has two disk drivers to support these two functions.

The FT Disk driver supports the older disks as created by MS-DOS or Windows NT. The FT Disks are called basic disks. If the physical disk is partitioned, then each partition occupies a contiguous extent, and once created the partition size is fixed. Details about the disk configuration are held in the registry. It is possible to convert a basic disk to a dynamic disk, but any existing hard partitions are conserved.

The Logical Disk Manager (LDM) manages the newer dynamic disks. With LDM its possible to extend simple volumes dynamically, or convert a simple volume to or from a mirror set without requiring a system reboot. The Volume configuration data is moved from the registry to replicated transactional LDM databases, one on each dynamic disk. This allows LDM to recovery from mirror or parity stripe failures. The physical LDM disks all have one single hard partition, which is logically split up into soft partitions by LDM to create logical volumes.

Third party products are available to simplify and streamline disk partition management. For example, Acronis Disk Director Site Partition Expert will assist with partition creation and deletion, and will also let you resize, copy and move partitions, usually without affecting the data (some file systems are not supported).
Version 10 of the product will also allow you to split or merge partitions without affecting your data, and will even cope with different file systems.

It is possible to move a dynamic disk between two systems, as the dynamic disk contains all the data it needs to identify it. When a dynamic disk is imported into another system, the LDM databases merge, so all the information about the new disk is available to all the other dynamic disks in the system.

Windows 2003 also supports
Virtual Disk Service, intended to simplify disk management
Volume Shadow Copy Services, a facility to provide point-in-time copies of single or multiple volumes
Removable Storage subsystem, to provide consistent access to tapes, CD jukeboxes etc.

You may sometimes have problems using LDM to access remote systems from an XP SP2 system. Microsoft introduces a new registry key with XP SP2 that does not allow unauthenticated connections to your client, and there is a suspicion that this can cause LDM access problems. The relevant registry key is HKLM\SOFTWARE\Policies\Microsoft\Windows NT\RPC which has a RestrictRemoteClient parameter.
If you set that parameter to zero you will disable the restricted access security. This is NOT recommended, but it may be something you want to try temporarily to investigate an access problem. Remember, there is a risk involved in changing the Registry, if it goes wrong you may have to reload Windows.

Volume mount points

Windows systems prior to Windows 2000 were limited to 26 file system volumes, as each volume had to have a unique alphabetic drive letter. This restriction was removed from Windows 2000, with Volume Mount Points or NTFS junction points. The hosting directory must be NTFS, but the mounted volume can be FAT, FAT32, NTFS, CDFS, or UDFS. A Volume mount point is basically a directory that points to volume. It means that you can add storage space to a directory in a way that looks to the user like he is still accessing a single directory. The applications of this are: -

• It is possible to access data on different volumes without changing between drive letters.
• Volumes can be added to a server to cope with growth, without affecting the user interface
• It is possible for different 'directories' in a file space to have different classes of storage. For example one directory can map to a mirrored volume, while another could map to a performance-striped volume.

The mount points are disk specific, not drive letter specific, so a mount point can survive disk reconfiguration.

There are three ways to add or remove mount points, (clustered and non-clustered are the same):

1. By using the Logical Disk Manager (Diskmgmt.msc)
2. By running Mountvol.exe from the command prompt
   • MOUNTVOL [drive:]path VolumeName to add a mount point
   • MOUNTVOL [drive:]path /D to delete a mount point
   • MOUNTVOL [drive:]path /L to list mount points
3. By writing your own .exe file, using the APIs SetVolumeMountPoint, and DeleteVolumeMountPoint

Change Journal

The Change Journal tracks changes made to files on NTFS volumes. It is used by Microsoft and third party vendors to enhance applications, but there is nothing to stop any application from reading it. Basically, any application that needs to detect and process changed files can do this by using the Change Journal, there is no requirement to scan the whole disk every time. This can save a lot of processing and time for incremental backup, virus scanning or indexing applications.

The Change Journal is implemented as a system file, and it is hidden from normal access applications like Explorer.

The Change Journal records changes made to files on NTFS volumes by placing a record in the journal file. That record does not contain the changed data, so it cannot be used for rolling back updates. It contains the file name, the time the change was made, and the type of change. Records are identified by an Update Sequence Number (USN) and are appended to the end of the file. With NTFS 5.0, the last generated USN for each file is recorded in the MFT entry for that file.

The change journal has a defined size, and when it fills up the system deletes the oldest records from the start of the file. The journal is defined as a sparse file, which means that the records are not all shuffled back when the oldest data is deleted. If this happened, then once the change journal was full, every update would generate lots of IO.

Indexing Service

Indexing was introduced in Windows 2000, and can be installed on Windows NT 4.0. The 'Indexing Service' uses a document filter to extract the content and properties of files across volumes, computers, and the Web, and stores the information in an index. This allows users to search their windows file system or the web, using the windows search function or a web browser. When indexing NTFS volumes, the Indexing Service uses the Change Journal to provide efficient index updates - there is no need to scan an entire volume's directory information to learn if each file has changed.

On NTFS volumes,

• The Indexing Service generates thumbnails of image files, and stores the thumbnails in a NTFS stream on the file. If Remote Storage migrates the files to tape, then the thumbnails will not be migrated, and so the user is able to view these thumbnails without need for a recall.
• If a user has no access to read a file, Indexing Service will not return that file in the results list to the user.

The Indexing Service can use a lot of resource, both CPU and storage, to build the initial index. It is disabled by default, but if you set it to automatic, it can start to re-index your files while you are actually working, and will affect the system performance. You may want to switch it off, or run it in manual mode.
You change the Indexing service by going to the Start menu or the Control Panel, open Administrative Tools - Computer Management - Services, then scroll down to the Indexing Service. Double click to bring up the Properties window, and select the Start-up Type (from Manual, Automatic, Disabled) in the start-up window, then click the Stop or Start button as required.

back to top

By entering and using this site, you accept the conditions and limitations of use