Inside Microsoft Windows 2000, Third Edition (Microsoft Programming Series)

Windows 2000 introduces the concept of basic and dynamic disks. Windows 2000 calls disks that rely on the MS-DOS-style partitioning scheme basic disks. In a sense, basic disks are Windows 2000 legacy disks. Dynamic disks are new to Windows 2000 and implement a more flexible partitioning scheme than that of basic disks. The fundamental difference between basic and dynamic disks is that dynamic disks support multipartition volumes. Recall from the list of terms in the preceding section that multipartition volumes provide performance, sizing, and reliability features not supported by simple volumes. Multipartition-volume configuration information for basic disks is stored in the registry; storage of multipartition-volume configuration information for dynamic disks is on-disk. Storing multipartition-volume configuration information on-disk rather than in the registry ties the dynamic disk to the storage it describes, so losing configuration data is less likely and moving disks between systems is easier.

Windows 2000 manages all disks as basic disks unless you manually create dynamic disks or convert existing basic disks (with enough free space) to dynamic disks. To encourage administrators to use dynamic disks, Microsoft has imposed some usage limitations on basic disks. For example, you can create new multipartition volumes only on dynamic disks. (If you upgrade a Windows NT 4 system, Windows 2000 will support existing multipartition volumes.) Another limitation is that Windows 2000 lets you dynamically grow NTFS volumes only on dynamic disks. A disadvantage to dynamic disks is that the partitioning format they use is proprietary and incompatible with other operating systems, including all other versions of Windows. Thus, you can't access dynamic disks in a dual-boot environment.

NOTE

Basic Partitioning

When you install Windows 2000 on a computer, one of the first things it requires you to do is to create a partition on the system's primary physical disk. Windows 2000 defines the system volume on this partition to store the files that it invokes early in the boot process. In addition, Windows 2000 Setup requires you to create a partition that serves as the home for the boot volume, onto which the setup program installs the Windows 2000 system files and creates the system directory (\Winnt). The system and boot volumes can be the same volume, in which case you don't have to create a new partition for the boot volume. The nomenclature that Microsoft defines for system and boot volumes is somewhat confusing. The system volume is where Windows 2000 places boot files, including the boot loader (Ntldr) and Ntdetect, and the boot volume is where Windows 2000 stores operating system files such as Ntoskrnl.exe, the core kernel file.

The standard BIOS implementations that x86 hardware uses dictate one requirement of the partitioning format in Windows 2000—that the first sector of the primary disk contains the master boot record (MBR). When an x86 processor boots, the computer's BIOS reads the MBR and treats part of the MBR's contents as executable code. The BIOS invokes the MBR code to initiate an operating system boot process after the BIOS performs preliminary configuration of the computer's hardware. In Microsoft operating systems, including Windows 2000, the MBR also contains a partition table. A partition table consists of four entries that define the locations of as many as four primary partitions on a disk. The partition table also records a partition's type. Numerous predefined partition types exist, and a partition's type specifies which file system the partition includes. For example, partition types exist for FAT32 and NTFS. A special partition type, an extended partition, contains another MBR with its own partition table. By using extended partitions, Microsoft's operating systems overcome the apparent limit of four partitions per disk. In general, the recursion that extended partitions permit can continue indefinitely, which means that no upper limit exists to the number of possible partitions on a disk. Figure 4-1 shows an example disk-partitioning scenario. The boot process is the first instance in which Windows 2000 makes evident the distinction between primary and extended partitions. The system must mark one primary partition of the primary disk as active. The Windows 2000 code in the MBR loads the code stored in the first sector of the active partition (the system volume) into memory and then transfers control to that code. Because of the role in the boot process played by this first sector in the primary partition, Windows 2000 designates the first sector of any partition as the boot sector. Recall from Chapter 4 that every partition formatted with a file system has a boot sector that stores information about the structure of the file system on that partition.

Dynamic Partitioning

As we've stated, dynamic disks are the favored disk format in Windows 2000 and are necessary for creating new multipartition volumes. The Logical Disk Manager (LDM) subsystem in Windows 2000, which consists of user-mode and device driver components, oversees dynamic disks. Microsoft licenses LDM from VERITAS Software, which originally developed LDM technology for UNIX systems. Working closely with Microsoft, VERITAS ported its LDM to Windows 2000 to provide the operating system with more robust partitioning and multipartition volume capabilities. A major difference between LDM's partitioning and MS-DOS-style partitioning is that LDM maintains one unified database that stores partitioning information for all the dynamic disks on a system—including multipartition-volume configuration. LDM's UNIX version incorporates disk groups, in which all the dynamic disks that the system assigns to a disk group share a common database. VERITAS's commercial volume-management software for Windows 2000 also includes disk groups, but the Windows 2000 LDM implementation includes only one disk group.

The LDM database resides in a 1-MB reserved space at the end of each dynamic disk. The need for this space is the reason Windows 2000 requires free space at the end of a basic disk before you can convert it to a dynamic disk. Although the partitioning data of a dynamic disk resides in the LDM database, LDM implements an MS-DOS-style partition table so that legacy disk-management utilities, including those that run under Windows 2000 and under other operating systems in dual-boot environments, don't mistakenly believe a dynamic disk is unpartitioned. Because LDM partitions aren't described in the MS-DOS-style partition table of a disk, they are called soft partitions; MS-DOS-style partitions are called hard partitions.

Another reason LDM creates an MS-DOS-style partition table is so that the Windows 2000 boot code can find the system and boot volumes, even if the volumes are on dynamic disks. (Ntldr, for example, knows nothing about LDM partitioning.) If a disk contains the system or boot volumes, hard partitions in the MS-DOS partition table describe the location of those volumes. Otherwise, one hard partition begins at the first cylinder of the disk (typically 63 sectors into the disk) and extends to the beginning of the LDM database. LDM marks this partition as type "LDM," an MS-DOS-style partition type new to Windows 2000. The region encompassed by this place-holding MS-DOS-style partition is where LDM creates soft partitions that the LDM database organizes. Figure 10-1 illustrates this dynamic disk layout.

Figure 10-1 Internal dynamic disk organization

The LDM database consists of four regions, which Figure 10-2 shows: a header sector that LDM calls the Private Header, a table of contents area, a database records area, and a transactional log area. (The fifth region shown in Figure 10-2 is simply a copy of the Private Header.) The Private Header sector resides 1 MB before the end of a dynamic disk and anchors the database. As you spend time with Windows 2000, you'll quickly notice that it uses GUIDs to identify just about everything, and disks are no exception. A GUID (globally unique identifier) is a 128-bit value that various components in Windows 2000 use to uniquely identify objects. LDM assigns each dynamic disk a GUID, and the Private Header sector notes the GUID of the dynamic disk on which it resides—hence the Private Header's designation as information that is private to the disk. The Private Header also stores the name of the disk group, which is the name of the computer concatenated with Dg0 (for example, SusanDg0 if the computer's name is Susan), and a pointer to the beginning of the database table of contents. (As mentioned earlier, the Windows 2000 implementation of LDM includes only one disk group, so the disk group name will always end with Dg0.) For reliability, LDM keeps a copy of the Private Header in the disk's last sector.

Figure 10-2 LDM database layout

The database table of contents is 16 sectors in size and contains information regarding the database's layout. LDM begins the database record area immediately following the table of contents with a sector that serves as the database record header. This sector stores information about the database record area, including the number of records it contains, the name and GUID of the disk group the database relates to, and a sequence number identifier that LDM uses for the next entry it creates in the database. Sectors following the database record header contain 128-byte fixed-size records that store entries that describe the disk group's partitions and volumes.

A database entry can be one of four types: partition, disk, component, and volume. LDM uses the database entry types to identify three levels that describe volumes. LDM connects entries with internal object identifiers. At the lowest level, partition entries describe soft partitions, which are contiguous regions on a disk; identifiers stored in a partition entry link the entry to a component and disk entry. A disk entry represents a dynamic disk that is part of the disk group and includes the disk's GUID. A component entry serves as a connector between one or more partition entries and the volume entry each partition is associated with. A volume entry stores the GUID of the volume, the volume's total size and state, and a drive-letter hint. Disk entries that are larger than a database record span multiple records; partition, component, and volume entries rarely span multiple records.

LDM requires three entries to describe a simple volume: a partition, component, and volume entry. The following listing shows the contents of a simple LDM database that defines one 200-MB volume that consists of one partition.

The partition entry describes the area on a disk that the system assigned to the volume, the component entry connects the partition entry with the volume entry, and the volume entry contains the GUID that Windows 2000 uses internally to identify the volume. Multipartition volumes require more than three entries. For example, a striped volume (striped volumes are described later in the chapter) consists of at least two partition entries, a component entry, and a volume entry. The only volume type that has more than one component entry is a mirror; mirrors have two component entries, each of which represents one-half of the mirror. LDM uses two component entries for mirrors so that when you break a mirror, LDM can split it at the component level, creating two volumes with one component entry each. Because a simple volume requires three entries and the 1-MB database contains space for approximately 8000 entries, the effective upper limit on the number of volumes you can create on a Windows 2000 system is approximately 2500.

The final area of the LDM database is the transactional log area, which consists of a few sectors for storing backup database information as the information is modified. This setup safeguards the database in case of a crash or power failure because LDM can use the log to return the database to a consistent state.

EXPERIMENT

The Windows 2000 resource kits include a tool named DmDiag that you can use to view detailed information about a system's physical disks, the contents of the LDM database, and the partitioning layout of MS-DOS-style partition tables. In addition to this disk-related data, DmDiag also dumps the mount points defined for a system (mount points are described later in this chapter) and the device objects and symbolic links present in the object manager namespace.

DmDiag takes no command-line options, and its output is usually more than a few screens in size, so you should pipe its output to a file for viewing in a text editor, for example, like this: dmdiag > disk.txt. The following figure shows excerpts of DmDiag output. A description of the types of disks present on the system is followed by the listing of the LDM database records that describe a 1-GB simple volume. The volume's database entry is listed as Volume1.

GUID Partition Table Partitioning

As part of an initiative to provide a standardized and extensible firmware platform for operating systems to use during their boot process, Intel has designed the Extensible Firmware Interface (EFI) specification. EFI includes a mini-operating system environment implemented in firmware (typically ROM) that operating systems use early in the system boot process to load system diagnostics and their boot code. One of the first targets of EFI is IA-64, so the 64-bit version of Windows 2000 will use EFI. You can find a complete description of EFI at developer.intel.com/technology/efi.

EFI defines a new partitioning scheme, called the GUID Partition Table (GPT), that addresses some of the shortcomings of MS-DOS-style partitioning. For example, the sector addresses that the GPT partition structures use are 64 bits wide instead of 32 bits. A 32-bit sector address is sufficient to access only 2 terabytes (TB) of storage. You don't see storage devices with that capacity today, but the GPT standard is designed with the future in mind. Other advantages of the GPT scheme include the fact that it uses cyclic redundancy checksums (CRC) to ensure the integrity of the partition table, and it maintains a backup copy of the partition table. GPT takes its name from the fact that in addition to storing a 36-byte Unicode partition name for each partition, it assigns each partition a GUID.

The following figure shows an example GPT partition layout. Like basic and dynamic disks in Windows 2000, the first sector of a GPT disk is an MBR. However, the second and last sectors of the disk store the GPT partition tables. With its extensible list of partitions, GPT partitioning doesn't require nested partitions, as MS-DOS-style partitions do.

Although the GPT partitioning scheme is an improvement over MS-DOS-style partitions, it isn't a replacement for Windows 2000 LDM partitioning. Just as Windows 2000 integrates MS-DOS-style partitions with LDM partitioning areas on dynamic boot and system disks so that the operating system loader can locate Windows 2000 boot and system files, LDM will integrate with the GPT partitioning scheme in 64-bit Windows 2000.