NTFS change journal and disk failure

[Fari Fuladi]

I am looking for information on what happens in terms of
NTFS change journal when there is a disk failure.

We know NTFS change journal records changes to all files
on the NTFS volume such as file creation, deletion, and
modifications. However, if there is a disk failure, and we
replace the failed disk with a new one (same drive letter
as the faild one) that contains no data, how will NTFS
preceive it? Will it think all the files on the disk has
been deleted, thus keeping record of the changes in the
change journal?

Thanks,

Fari

 

[Matthew Mucker [MSFT]]

Fari,

If you replace one disk with a new disk with no data, the new disk has just
that: no data.

NTFS won't do anything with this new disk until you put a new filesystem on
the disk by formatting the disk (with the NTFS filesystem). At that time, a
brand new filesystem is laid out on the disk and the change journal for that
disk is empty.

The change journal is per-volume. So each NTFS volume has its own change
journal. The change journal on one drive will not have any effect on any
other drive. (In other words, the NTFS filesystem is self-contained.
Everything needed to manage the filesystem is kept within the filesystem
itself. Each partition/volume has a separate filesystem.)

Does that answer your questions?

-Matt

 

[Guest]

Matt,

Thanks. I got my answer. Just out of curiosity, where (the
folder, I mean) is NTFS journal stored? What tool do you
use to browse through the journal?

thanks again.

Fari