The present invention relates to computer file-systems, and particularly relates to a method and system of resolving at least one file-path for a change-record of a computer file-system object in a computer file-system in a computer system including an operating system, where the change-record includes a file-name of the file-system object, the file-id of the file-system object, and the file-id of the file-system container object containing the file-system object.
A computer system typically includes a computer file-system. A computer system typically includes an operating system. The computer file-system may include at least one change-record of a computer file-system object in the computer file-system in the computer system. In other words, the computer file-system may include a listing of change-records.
For example, a listing of change-records in Microsoft Corporation's Windows operating system is the NTFS Change Journal. Specifically, the NTFS Change Journal is a change tracking mechanism present in NTFS version 5.0 and above. The NTFS Change Journal retains consistency across system restarts and crashes, by keeping a persistent log of changes that occur in a particular NTFS volume.
One of the drawbacks of the NTFS Change Journal is that an individual change-record for a file-system object contains only the following information: the File-Name portion of a file-system object, the file-id of the file-system object and the file-id of the file-system container object containing the file-system object. However, the potential clients of the NTGS Change Journal (e.g., Backup applications, Anti-Virus products, Desktop Search applications that perform indexing of file data) need to know the full path to the file-system object in order to process the file-system object.
Prior Art
As shown in prior art
Therefore, a method and system of resolving at least one file-path for a change-record of a computer file-system object in a computer file-system in a computer system including a cache and an operating system, where the change-record includes a file-name of the file-system object, the file-id of the file-system object, and the file-id of the file-system container object containing the file-system object, is needed.
The present invention provides a method and system of resolving at least one file-path for a change-record of a computer file-system object in a computer file-system in a computer system including a cache and an operating system, where the change-record includes a file-name of the file-system object, the file-id of the file-system object, and the file-id of the file-system container object containing the file-system object. In an exemplary embodiment, the method and system include, (1) if the file-id to file-name mapping for the file-system object is in the cache, using the cached mapping to perform the resolving, (2) if the file-id to file-name mapping for the file-system object is not in the cache and if the file-id to file-name mapping for the file-system container object containing the file-system object is in the cache, using the cached file-id to file-name mapping for the file-system container object containing the file-system object and the file-name in the change record to perform the resolving, (3) if the file-system object is not a deleted file-system object and if the file-id to file-name mapping for the file-system object is not in the cache, mapping the file-id of the file-system object to the file-path of the file-system object, (4) if the file-system object is a deleted file-system object and if the file-id the file-name mapping for the file-system object is not in the cache, mapping the file-id of the file-system container object containing the file-system object to the file-system container object path of the file-system object recursively, and (5) maintaining the mapping in the cache.
In an exemplary embodiment, the mapping includes, if the file-system object is not a deleted file-system object and if the file-id to file-name mapping for the file-system object is not in the cache, using an application programming interface (API) of the operating system to perform the resolving. In an exemplary embodiment, the mapping includes, if the file-system object is a deleted file-system object and if the file-id to file-name mapping is not in the cache and if the file-system container object containing the file-system object is a deleted file-system container object, searching for a deletion record for the file-system container object containing the file-system container object containing the file-system object. In an exemplary embodiment, the searching includes using the deletion record for the file-system container object containing the file-system container object containing the file-system object.
In an exemplary embodiment, the maintaining includes maintaining the mapping in an in-memory cache. In an exemplary embodiment, the maintaining includes maintaining the mapping in a persistent cache. In an exemplary embodiment, the maintaining includes (a) monitoring changes to the file-system object and (b) populating the cache speculatively.
The present invention also provides a method and system of resolving at least one file-path for a change-record of a computer file-system object in a computer file-system in a computer system including an operating system, where the change-record includes a file-name of the file-system object, the file-id of the file-system object, and the file-id of the file-system container object containing the file-system object. In an exemplary embodiment, the method land system include, (1) if the file-system object is not a deleted file-system object, mapping the file-id of the file-system object to the file-path of the file-system object, and (2) if the file-system object is a deleted file-system object, mapping the file-id of the file-system container object containing the file-system object to the file-system container object path of the file-system object recursively.
In an exemplary embodiment, the mapping includes, if the file-system object is not a deleted file-system object, using an application programming interface (API) of the operating system to perform the resolving. In an exemplary embodiment, the mapping includes, if the file-system object is a deleted file-system object and if the file-system container object containing the file-system object is a deleted file-system container object, searching for a deletion record for the file-system container object containing the file-system container object containing the file-system object. In an exemplary embodiment, the searching includes using the deletion record for the file-system container object containing the file-system container object containing the file-system object.
The present invention also provides a computer program product usable with a programmable computer having readable program code embodied therein of resolving at least one file-path for a change-record of a computer file-system object in a computer file-system system in a computer system comprising a cache and an operating system, wherein the change-record comprises a file-name of the file-system object, the file-id of the file-system object, and the file-id of the file-system container object containing the file-system object In an exemplary embodiment, the computer program product includes (1) computer readable code for using, if the file-id to file-name mapping for the file-system object is in the cache, the cached mapping to perform the resolving, (2) computer readable code for using, if the file-id to file-name mapping for the file-system object is not in the cache and if the file-id to file-name mapping for the file-system container object containing the file-system object is in the cache, the cached file-id to file-name mapping for the file-system container object containing the file-system object and the file-name in the change record to perform the resolving, (3) computer readable code for mapping, if the file-system object is not a deleted file-system object and if the file-id to file-name mapping for the file-system object is not in the cache, the file-id of the file-system object to the file-path of the file-system object, (4) computer readable code for mapping, if the file-system object is a deleted file-system object and if the file-id to file-name mapping for the file-system object is not in the cache, the file-id of the file-system container object containing the file-system object to the file-system container object path of the file-system object recursively, and (5) computer readable code for maintaining the mapping in the cache.
The present invention provides a method and system of resolving at least one file-path for a change-record of a computer file-system object in a computer file-system in a computer system including a cache and an operating system, where the change-record includes a file-name of the file-system object, the file-id of the file-system object, and the file-id of the file-system container object containing the file-system object. In an exemplary embodiment, the method and system include, (1) if the file-id to file-name mapping for the file-system object is in the cache, using the cached mapping to perform the resolving, (2) if the file-id to file-name mapping for the file-system object is not in the cache and if the file-id to file-name mapping for the file-system container object containing the file-system object is in the cache, using the cached file-id to file-name mapping for the file-system container object containing the file-system object and the file-name in the change record to perform the resolving, (3) if the file-system object is not a deleted file-system object and if the file-id to file-name mapping for the file-system object is not in the cache, mapping the file-id of the file-system object to the file-path of the file-system object, (4) if the file-system object is a deleted file-system object and if the file-id the file-name mapping for the file-system object is not in the cache, mapping the file-id of the file-system container object containing the file-system object to the file-system container object path of the file-system object recursively, and (5) maintaining the mapping the cache.
In an exemplary embodiment, the file-system object comprises a computer file. In an exemplary embodiment, the file-system object comprises a computer directory. In an exemplary embodiment, the file-system container object comprises a computer directory. In an exemplary embodiment, the change-record is included in a NTFS Change Journal.
Referring to
In an exemplary embodiment, using step 213 includes pre-pending the file-id-to-file-name mapping for the file-system container object containing the file-system object to the file-name of the file-system object.
Mapping
Referring to
In an exemplary embodiment the kernel-mode driver opens the volume for which the passed in file-id will be resolved against and opens the file-system object using the file-id relative to the volume, such that these open operations are done with 0 sharing, and 0 access. This avoids conflict with any other existing or future open operations that could be performed on this file-system object by user-mode applications. The kernel drive then calls the ObQuery NameString kernel-mode API on the retrieved file-system object. This API then retrieves a full-path that leads to the file-system object which was opened by the file-id. This full-path is finally returned to the user-mode application. If the file-system object no longer exists, then an error is returned to the user-mode application.
Referring to
In an exemplary embodiment, searching step 322 includes finding the deletion record of the file-system container object containing the file-system object (i.e., the Parent-File-Id) in the NTFS Change Journal and using the file-system container object containing the file-system container object containing the file-system object (i.e., the file-id of the Grandparent-File-Id is not found in the Journal, then this is considered an un-recoverable error, and the Journal tracing state is considered invalid. At this point, the NTFS Change Journal is re-initialized, and tracking is started anew.
If it turns out that all the parent-files (directories) in the path leading up to the original File-Id present in the initial change-record have been deleted (i.e. the invention found a deletion record for each one of them in the Journal), then the root must always exist (i.e. a deletion record will be found), where the “Parent-File-Id—File-Id of the volume root”.
Referring to
Maintaining
Referring to
Referring to
Referring to
The present invention provides a method and system of resolving at least one file-path for a change-record of a computer file-system object in a computer file-system in a computer system including an operating system, where the change-record includes a file-name of the file-system object the file-id of the file-system object, and the file-id of the file-system container object containing the file-system object. In an exemplary embodiment, the method and system include, (1) if the file-system object is not a deleted file-system object, mapping the file-id of the file-system object to the file-path of the file-system object, and (2) if the file-system object is a deleted file-system object, mapping the file-id of the file system container object containing the file-system object to the file-system container object path of the file-system object recursively.
In an exemplary embodiment, the file-system object comprises a computer file. In an exemplary embodiment, the file-system object comprises a computer directory. In an exemplary embodiment, the file-system container object comprises a computer directory. In an exemplary embodiment, the change-record is included in a NTFS Change Journal.
Referring to
Mapping
Referring to
In an exemplary embodiment, the kernel-mode driver opens the volume or which the passed in file-id will be resolved against and opens the file-system object using the file-id, relative to that volume, such that these open operations are done with 0 sharing, and 0 access. This avoids conflict with any other existing or future open operations that could be performed on this file-system object by user-mode applications. The kernel drive then calls the ObQuery NameString kernel-mode API on the retrieved file-system object. This API then retrieves a full-path that leads to the file-system object which was opened by the file-id. This full-path is finally returned to the user-mode application. If the file-system object no longer exists, then an error is returned to the user-mode application.
Referring to
In an exemplary embodiment, searching step 622 includes finding the deletion record of the file-system container object containing the file-system object (i.e., the Parent-File-Id) in the NTFS Change Journal and using the file-system container object containing the file-system container object containing the file-system object (i.e., the file-id of the Grandparent-File-Id), which is in the Parent-File-Id's deletion record. If a deletion record for the Parent-File-Id is not found in the Journal, then this is considered an un-recoverable error, and the Journal tracing sate is considered invalid. At this point, the NTFS Change Journal is re-initialize, and tracking is started anew.
It is turns out that all the parent-files (directories) in the path leading up to the original File-Id present in the initial change-record have been deleted (i.e. the invention found a deletion record for each one of them in the Journal), then the root must always exist (i.e. a deletion record will be found), where the “Parent-File-Id—File-Id of the volume root”.
Referring to
The present invention can take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment containing both hardware and software elements. In an exemplary embodiment, the present invention is implemented in software, which includes but it not limited to firmware, resident software, and microcode.
Furthermore, the present invention can take the form of a computer program product accessible from a computer-usable or computer-readable medium providing program code for use by or in connection with a computer system or any instruction execution system. The computer program product includes the instructions that implement the method of the present invention. A computer-usable or computer readable medium can be any apparatus that can contain, store communication, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The medium can be electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. Examples of a computer-readable medium include semiconductor or solid-state memory, magnetic tape, a removable computer diskette, a random access memory (RAM), a read-only memory (ROM), a rigid magnetic disk, and an optical disk. Current examples of optical disks include compact disk—read only memory (CD-ROM), compact disk—rad/write (CD-R/W), and DVD.
A computer system suitable for storing and/or executing program code includes at least one processor coupled directly or indirectly to memory elements through a system bus. The memory elements include local memory employed during actual execution of the program code, bulk storage, and cache memories that provide temporary storage of at least some program code to reduce the number of times code is retrieved from the bulk storage during execution. Input/output (I/O) devices (including but not limited to keyboards, displays, pointing devices, etc.) can be coupled to the computer system either directly or through intervening I/O controllers. Network adapters may also be coupled to the computer system in order to enable the computer system to become coupled to other computer systems or remote printers or storage devices through intervening private or public networks. Modems, cable modems, and Ethernet cards are just as few of the currently available types of network adapters.
Having fully described a preferred embodiment of the invention and various alternatives, those skilled in the art will recognize given the teachings herein, that numerous alternatives and equivalents exist which do not depart from the invention. It is therefore intended that the invention not be limited by the foregoing description, but only by the appended claims.