Comparing NTFS File System with ETX4 File System

Valbona Dhjaku Nevila Xoxa Albion Bame Igli Tafa

Natural Science Faculty Natural Science Faculty Faculty of Information Polytechnic University
Informatics Department Informatics Department Technology of Tirana
valbona.dhjaku@banka [email protected] [email protected] [email protected]
credins.com

Abstract  Disk Layout

This paper presents a study and analysis of ETX4

file system and data structures comparing them with 2. Related Works
the NTFS File System of Windows Operating
System. It includes descriptions of ETX4 File With NTFS and ETX4 file system is been done various
System Features, ETX4 Disk Layout and ETX4 work and some of them inspired me write this article.
extent tree. All the components that we mentioned The information I had about this two file systems after
above will be in comparison with the adequate working for almost four years with Windows and Ubuntu
features of Windows Operating System that operating system helped me the most. I saw the need to
expand my knowledge about this operating systems and
corresponds to the Features of ETX4 File System. the file system that both of them use seemed a good
Here we will talk about the volum size that support starting point for me to do this. For getting more
each of the file system and the speed of each file knwoledges for this file systems i had to read a lot off
system including their performance. articles and some of them are listed in references and
others not. I have read o lot of information on different
Keywords: NTFS, ETX4, performance, cluster, forums to and i do not regret it because it was very helpful
iNode, hard drive sector, filesystem, features, to me.
volume size, kernel, defragment, timestamps, The focus of this article is not the application of this two
blocks. file systems but more the theoretical part of them to
understand more how they work and about their
1. Introduction performance.

3. Experimental Theory
The purpose of this document is to attempt, in a
straightforward technical manner, to describe the process 3.1 File System Volum Size
of comparing NTFS file system with ETX4 file system
with their advantages and disatvantages. Some of the ETX4 file system is the latest file system that Linux
concepts discussed in this document are rather difficult Operating System is now using and this file system
to understand without a proper background in supports the volume size up to 1 EB and file size up to 16
programming. Since linux kernel 2.6.28, ETX4 has been TB because is a 64-bit FS. This file system extends
included in the mainstream and has become the default EXT2 and EXT3 file system and can map up to 128 MB
filesystem with most distributions. In a very short span of contionus space and a block with size up to 4 KB.
of time, it has grown in popularity as well as stability. ETX4 file system uses iNode with size of 256 Bytes. In
This article aims to describe better this two file systems ETX4 file system, are not allowed volumes larger than
with their advantages and distavantages. This two file 16 TB. [MCB07]
systems are widely use and we will give some point that
we will use to compare this two file systems are as below:
 File System Volum Size
 Timestamps

1
Figure 1: 64 bit i-node layout
(Cluster size)/2 * (number of files) [EXT418] [Ngu17]
NTFS, in theory reaches the maximum volume size
264−1. However, in practice, the maximum NTFS volume
size is 232−1 clusters partly for the limitations of table
partition. By using the cluster with the default size of 4
KB, NTFS file system can reach the volume size of (16
TB – 4 KB) because the Master Boot Record (MBR)
supports file size up to 2 TB. The maximum file size in
NTFS file system is 16 EB minus 1 KB. Since NTFS
bases on clusters, we are giving the maximum file size of Figure 4: Cluster Layout
a cluster that is 64 KB.
3.3 Timestamps
Maximum size of files in Windows Server 2012 that
runs NTFS file system si (16 TB - 64 KB). [KKPLSh02] In ETX4, are four timestamps recorded in the lower
128 bytes of the inode structure. These four fields are 32-
bit signed integers that represent seconds. For inodes that
are not linked from any directory but are still open
(orphan inodes), the dtime field is overloaded for use
with the orphan list. Within this "extra" 32-bit field, the
lower two bits used to extend the 32-bit seconds field to
Figure 2: Formatted NTFS Volume Layout be 34 bit wide; the upper 30 bits used to provide
nanosecond timestamp accuracy. ETX4 add the support
3.2 Disk Layout for timestamps created by date as well as higher precision
ETX4 allocates the space of a storage in units called timestamps (64-bit values instead of 32-bit). [Ngu17]
"blocks". A block is a group of sectors in drive between NTFS keeps the track of many time stamps. Each file
1 KB and 64 KB, and the number of sectors must be has its own time stamp to 'Create', 'Access', and 'Modify'
power of 2. Blocks are in turn, grouped into larger units the attributes, the lattest references to the time when the
called block groups. The size of the block is 4 KB and entry of MFT itself was modified. The values above
specified at mkfs time. By default, an ETX4 file system abbreviated commonly as the 'MACE' values. We do not
can contain up to 232 blocks. If the 64 bit feature of ETX4 exclude the possibility that other attributes in each MFT
file system is enabled it can have up to 264 blocks. record can also contain their own timestamps that are of
[EXT418] forensic value. For NTFS a file time is a 64-bit long in
value and represents the number of intervals by 100-
nanosecond each that have elapsed using the UTC time.
NTFS file system stores the values of time in the UTC
format, so that the changes in daylight saving time or
time zone does not affected in them. There are
timestamps updated in different time and for different
reasons. A file timestamp has the guarantee that the time
of a file is correctly reflected only when the handle who
makes the changes for a specific file is closed. Not all the
Figure 3: Inode Layout file systems can record the creation and last access time
of a file, and if they do not all of them record it in the
Windows operating system with all the file systems that same manner. The NTFS file system updates the last
uses organize the hard drive with so called cluster size or access time for a file by 1 hour after the last access.
as they are called sometime allocation unit size. The size Timestamps for Files and directorys are one of the
of the cluster that is used represents that little amount of resources forensic analysis that are used in Windows for
space in disk that holds a specific file. When file sizes are determining if something has happened, or in what
not the result of multiple cluster size additional, the disk particular order the sequence of this events took place.
space will be in use of holding those files. On a normal [CHLKL07]
hard drive partition, the average space of the space that is
lost in the disk calculated by the equation below: 3.4 Features

2
Below we are giving some of ETX4 features: 3.4.7 Reparse Points

3.4.1 Large file system There are reparse points used for associating a reparse
tag for the user space attribute of a folder or file. When
ETX4 filesystem can support volume sizes maximum the manager of the object parses a name lookup for a file
up to 1 exbibyte (EiB) and files with sizes up to system and he encounters a attribute that is reparse, it will
16 tebibytes (TiB).Volumes larger than 16 tebibytes reparse the lookup for that name by passing the
(TiB) are not recommended. controlled data reparse by users to all driver filters of file
system that are loaded into Windows.
3.4.2 Extents
Extent is a range of physical blocks that is contiguous. 3.4.8 Distributed Link Tracking
Its main duty is improving the performance of large files Distributed link tracking allows the applications to
and reducing their fragmentation. A single extent can track all the files like OLE links or shell shortcuts, This
map up to 128 MiB of contiguous space in ETX4 happens even if the files are renamed or migrated to
filesystem with a 4 KiB block size. another volume in the drive in the same machine. The
tracking of the links implemented works as a service in
3.4.3 Delayed Alocation system that uses the index identifier object that is stored
ETX4 filesystem use a technique for the performance in a metafile.
called “allocate on flush” also known as delayed
allocation. That makes ETX4 to delay blocks allocation 3.4.9 File Level Encryption (Encrypting File System)
until it writes data to disk. ETX4 filesystem use the
delayed allocation that allows it to buffer the data and EFS provides user transparent and strong encryption of
allocate the groups of filesystem blocks. Multiblock all files or folders on an NTFS file system volume. File
allocator consequently can make a better choice in Level Encryption works by encrypting the file with a
allocating files contiguously on disk. symmetric key that used because it takes a small amount
of time for large amount of data encrypted and decrypted
3.4.4 Persistent pre-allocation than an asymmetric key is used. The symmetric key used
for encrypting the file, is encrypted itself using a public
ETX4 filesyste can previosly allocate on disk the space key before encrypting the file. Then this key linked with
for a file. To do this ETX4 on most file systems adds the user who made the file encryption. The data that is
zeros to the file on the creation of it. This way that the encrypted is then stored in a stream of data in the file that
allocated space would be guaranteed and contiguous. has been encrypted. [DT16] [Fuj10]
[DT16] Here we are listing some of NTFS features:

3.4.5 Sparse File Support

3.5 Speed
The speed of ETX4 file system is showing that it is
There are sparse files distributed with segments that
excelling over other filesystems like NTFS by a
are empty for which and there will be no extra space on
considerable amount. Many manufactured flash drives,
disk to use. The applications see this file like an ordinary
come with Microsoft FAT32 file system by default,
one but with empty segments seen as regions filled with
which is fine because of its compatibility.
zero values. It uses a disk addresses of 64-bit and if can
Most operating systems read and write FAT32 file
support up to 264 bytes disk partitions. File names that are
system. FAT32 has a limit of 2GB for file sizes. Even if
individual in NTFS are limited to 255 characters. The
FAT32 is more compatible in different operating
names are case sensitive.
systems, the benefits of ETX4 make it less usable. As
flash drives have been increasing in size, the 2GB file
3.4.6 Disk Usage Quotas size limit of FAT32 is now a problem. Unfortunately,
This allow the computer administrator to run different NTFS support is still popular, because is kept closed by
versions of Windows who support the NTFS file system Microsoft.
for setting a verge of disk space to be used by users. It Even though, the tests made are showing minor
also allows the administrators to find out the quantity of differences in speed between different filesystems exist
the space in disk that each user is using. some advantages of the filesystem that is more efficient,
like ETX4 besides speed alone. I think getting rid of

3
filesystems like FAT32 or NTFS, which are a mess and
need defragmenting, and olso known for file corruption
it will be better. The ETX4 filesystem is a complete
journalling filesystem it does not need defragmenting
utilities to run on it like FAT32 and NTFS.
With Linux distribution that is reaching a record boot
speed with every new release, I have to believe that
ETX4 file system need to take some of the credit. In
addition, if someone is worried about ETX4 beeing
compatible with Windows systems, there are drivers for
ETX4 filesystem available for Windows. [RH13] [Ts18] Figure 6: Record Size: 64 KB – File Size: 4 KB – Disk
Test: Read Performance

4. Experimental Phase The performance in reading in the two file systems with
IOzone was very close.
4.1 ETX4 Performance Against NTFS
While ETX4 has regressed a fair amount since it stable
I have tested Windows 7 x64 vs. Ubuntu 10.04 in the main Linux kernel, it seems like it is still able to be
benchmark to see if Microsoft operating system is better in advance against Windows 7 and NTFS at least with the
than the Linux system distribution. Here I am giving tests synthetic disk benchmark. It will be interesting to see
on two disk looking at the performance of file system on how Apache, SQLite and PostgreSQL performance will
Windows 7 x64 with NTFS against Ubuntu 10.04 with be between the two operating systems. Especially if that
ETX4 file system. The test happened with the following is where ETX4 had a challenging experience with recent
hardware: releases of kernel that try to improve the safety of data at
Processor: Intel Core i3 CPU 530 @ 3.32GHz, the cost of speed. [VW09] [XLLR17]
Motherboard: ECS H55H-M v1.0, Memory: 2024MB,
Graphics: Intel Core 256MB, Disk: 320GB Seagate. 4.2 NTFS vs ETX4 on external 3.0 USB Hard Drive
For this brief disk testing, i ran IOzone through Testing this two file systems in a external Hard Drive
the Phoronix Test Suite on clean installation of Ubuntu will help us to better deside which of them is more
10.04 linux system and Windows 7 Home Premium x64 efficient and with better performance. Therefore, to do
system. The first test I made looks at the performance of this i have tested the speed of data transfer on Windows
IOzone on a 4GB write that has different record sizes. 7 running the NTFS file system and Ubuntu 10.04
running the ETX4 file system by transferring data to a
1Tb Toshiba 3.0 external Hard Drive. By making this
test, i received the following results:

Table 1: Results

Format NTFS ETX4 Units

Read Speed 27.8 28 Mb/s
Write Speed 21.7 21.3 Mb/s
Access Time 17.52 17.35 ms

Figure 5: Write Record Size Analysis As we see, the differences of this test are small and if I
make the test, again the differences would change a little.
On Ubuntu 10.04 with Linux kernel and ETX4 filesystem To decide which of this file system we want to use in an
the test was 26.5% faster than Windows 7 with its NTFS external hard drive we have to take in count that from
filesystem. what system we want to use this hard drive. If we want
to use it in a Windows operating system with NTFS file
system, it is best to use the NTFS file system for the
external hard drive. If we do not want to use it in a
Windows operating system then we should consider
using the ETX4 file system for the hard drive because it

4
is stable in these days. To give a summary of what we LibreOffice uses. An ODT file type is 500% larger than
should take in count for which file system we should use the equivalent in DOCX file type.
let us consider the following reasons:
6. Future Works
 If you don’t need access from a Windows operating
One of the main reason why I started this work was
system then you should use ETX4 file system,
because of my interest in file systems. Their spreading in
because it is a native filesystem and is the only one
nowadays applications and their prespective of growth is
that supports the linux structure properly
very clear. I wanted to study them in a more specific way,
 If you do not have access to a Widows machine, you expecialy this two that i havementioned in this document.
should use ETX4 becouse some filesystem errors In my future work, i would like to expand my knowledge
that can occur can be fixed from a Windows in file systems to know them more and how they perform
operating system using the chdsk command to make an operating system work.
 ETX4 will give an improved performance over
NTFS, particularly when trying to write multiple References
files in the same time or when creating a large file.
[MCB07] A. Mathur, M. Cao, S. Bhattacharya. The
 NTFS filesystem needs to be defragmented from new ETX4 filesystem: status and future plans, June
time to time and ETX4 filesystem does not need 2007
defragmenting.
[KKPLSh02] G. B. Kim, D. J. Kang, C. S. Park, Y.
 NTFS filesystem has permission issues on files and J. Lee, B. J. Shin. - A Dynamic Bitmap for Huge File
directories. From the other end, ETX4 does not System in SANs, January 2002
have these issues.
[EXT418] ETX4 Forum - ETX4 Disk Layout.
5. Conclusion
[Ngu17] N. Nguyen. - The Structure of NTFS –
Theoretically a drive with ETX4 file system performs Windows NT File System. 2017
better than a drive with NTFS file system.ETX4 file
system allows in file names characters that NTFS file [CHLKL07] K. P. Chow, Frank Y.W. Law, Michael
system doesn’t allow. Y.K. Kwan, K.Y. Lai - The Rules of Time on NTFS
ETX4 support individual files with size up to 16TB, and File System, May 2007
volume sizes up to 1EB. One of the reasons why ETX4
contributes to a best performance is that ETX4 can [DT16] B. Djordjevic, V. Timcenko - Features and
handle large extents. An extent is range of physical Performance Analysis. 2016
blocks with data in a drive that are contiguous. This
feature allows ETX4 to work better with files that are [RF06] R. Russon, Y. Fledel - NTFS
large and reduce the need of fragmenting the drive. Documentation. December 2006
Other factors include the technique called allocate-on-
[RH13] RED HAT Enterprise Linux. - Comparing
flush used by ETX4. By delaying, the allocation of
file system I/O performance. April 2013
blocks of data until they are ready for saving to disk.
ETX4 improve the performance and reduces drastically [VW09] M. Vanninen, J. Z. Wang. - On
the need for fragmentation compared to file systems that Benchmarking Popular File Systems. Clemson
allocate the blocks of data earlier. University Study, 2009
Using checksum for drive journaling improves the
reliability and performance by avoiding the wait during [XLLR17] Ch. Xie, X. Li, Z. Li, B. Rath -
the process of journaling in disk. When it comes to check Linux File System - ETX4. 2017
the files, ETX4 is much faster then NTFS because of the
ogranisation of the data in blocks that are unallocated and [Ts18] Th. Ts’o - Speeding up file system checks in
are marked as such. These data are skipped during the ETX4. 2018
operations of disk check
ETX4 has some performance advantages over NTFS file [Fuj10] A. Fujita - Outline of ETX4 File System &
system, but you must be careful for the file type ODT that ETX4 Online Defragmentation Foresight,
September 2010