Computer Security: Comparing NTFS and EXT4 File System Technologies

This report provides a comparative analysis of NTFS and EXT4 file systems, widely used technologies in computer engineering for data storage and security. It explores common features such as disk quotas, file operations, defragmentation, and encryption. The report details NTFS, including its system files like $MFT and boot sector, compatibility with Windows and MAC OS, and efficiency in single workstations. It also examines EXT4, highlighting its improved performance, scalability with unlimited subdirectories, efficient block allocation methods (multiblock and delayed allocation), and compatibility with various operating systems. The report discusses the suitability of each file system for single workstations and enterprise networks, noting EXT4's enhancements in storage capacity, performance, and data allocation strategies. The document is contributed by a student and available on Desklib, a platform offering study tools and resources for students.

Running head: COMPUTER SECURITY ENGINEERING
COMPUTER SECURITY ENGINEERING
Name of the student:
Name of the university:
Author note:

1COMPUTER SECURITY ENGINEERING
Introduction:
A file system refers to the different methods as well as the structures of data that are used
by the operating system in order to monitor the files and keep a track of the data on a disk
partition. It defines the way in which the data and the files a restored on a disk partition[1]. A file
system can also be defined as the partition or a disk that is required to store the files of a
particular file system. In every organizations, the system administrators make use of a proper file
system in order to store the important organizational data and files[2], which are properly
categorized and stored in folders within the servers and the workstations. Using a proper file
system just not stores the file sin a systematic manner but also ensures data security within the
organizations. New files can also be as as well as deleted from the databases based on the
requirements.
There are different kinds of file systems that exist in computer engineering. The two most
widely used technologies are NTFS and EXT 4, which are mainly used in the organizations. The
following report will highlight the different features of these two technologies and will compare
and contrast between the two. The different aspects such as the advantages, disadvantages,
compatibility as well as the efficiency will be discussed in the following paragraphs. The
different network protocols will also be discussed which are compatible with these two
technologies. By the end of the report, the reader will have a clear understanding of the features
of these two technologies and will clearly able to define technologies in details.
Common features of NTFS and EXT4:
There are many common features of both the technologies. Some of the common features
are explained below in the below mentioned points:

2COMPUTER SECURITY ENGINEERING
- Disk Quota: This feature is supported by both the technologies.
- Both the technologies perform complex file tasks such as file operations such as read
and write, file search as well as recovery if the files have been accidentally deleted
from the system.
- File defragmentation as well as encryption is also performed in both the file systems
to ensure optimum data security within the organizations[3].
- Both the systems have comparable performance since features like multiblock
allocation are supported by both wherein multiple blocks of data can be assigned on a
single call in the folders.
Comparison between the two technologies:
This section will provide a comparative study of the two technologies and explain the
features supported by them. The advantages as well as the disadvantages can be understood and a
recommendation will be provided regarding the preference of one technology over the other for
any given scenario[4].
NTFS:
In the NTFS or new technology file system, standard tasks related to file operation such
as file read and write, as well as advanced search operation using sorting techniques that run in
the background, file recovery once they have been accidentally deleted form hard drives etc. are
performed. NTFS partitioning can help in the creation of different kinds of system files that are
extremely important for the proper storage and file related tasks to be performed properly. Some
of the system files that are generated are listed below:
- $MFT
- Master File Table

3COMPUTER SECURITY ENGINEERING
- The $Bitmap
- The $LogFile file
Performance:
The Boot Sector Partition which is the $Boot metadata file is the primary information that
is stored on the NTFS volume in the disk drive that starts at the sector 0. It can have a length of
16 sectors. The File System in the encrypted format or the EFS provideed technology for
encryption of the core file that the NTFS volumes use to store the different files. Disk quotas are
supported by Windows 2000 for the NTFS volumes[5].
Compatibility:
NTFS uses a framework known as the Distributed Link Tracking that helps in provides a
service for link tracking that helps in maintaining the file shortcuts integrity including the OLE
links within documents of different types. The NTFS file system is compatible with all the
versions of windows as well as the modern MAC operating system versions. However, for Linux
platforms it may need additional software’s in order to work properly[7].
Efficiency:
New objects of file system within the NTFS partition can be applied to NTFS files as
well as folders, which are known as reparse points. According to the reparse points, the volume
mount point (VMP) allows the concerned authorities to allow access to a local file volume root
onto the structure of the folder in another volume, making it quite efficient. Sparse Files can help
in creating files of large size but only the required disk space is consumed. [6].
- For single workstations, NTFS is a good choice of file system since it is capable of
doing the advanced file operations such as reading of new data much quickly and
efficiently to the databases. However, in networked architectures, which involve more

4COMPUTER SECURITY ENGINEERING
number of computers that are shared in the network, sometimes it can be a problem
since it can cause the data to be transmitted slowly. It can also cause lagging issues
within the network. This is because NTFS is an old type of data files wherein the
system files that are created such as $MFT and Master File Table are not compatible
with the newer network technologies[8].
EXT4 file technology:
The most widely used Linux file system which is EXT3 has been further developed and
EXT4 is its improved version. It has much better and reliable features and more efficieny in the
important task operations that can be done[9].
Performance:
The EXT4 file system uses addressing in 48-bit block, so it will be able to achieve the
maximum size of file system of 16 TB which is remarkable. 1 EB is equal to 1,048,576 TB. The
EXT4 is not compatible with 64-bit operating systems and it has some limitations in this regards
that has to be fixed before fully incorporating this file system. 64-bit operating systems will also
be supported in the future and this file system has that provision. Sub directory limits of
scalability has also been extended in a file system wherein unlimited number of directories can
be added in order to ensure a better performance[11].
Efficiency:
Ext4 allows an infinite number of divided directories to be added in the future thereby
expanding its scalability to a very large extent[10]. Extents are also used in the file operations,
which are, bunches of physical blocks that are contiguous in nature. For instance, a file that has
around 100 MB size can be assigned to an extent instead of having to create an indirect mapping
to 25600 separate blocks (1 block is equal to 4 KB).

5COMPUTER SECURITY ENGINEERING
Huge files are split in several extents are used in order to split files of large sizes.
Performance improvements are achieved by extents, which in turn helps to reduce the
fragmentation, since it allows continuous layouts on the disk. This file system is considered very
efficient since it has an advantage of having different ways of allocation of the blocks. They are
explained below:
- Multiblock allocation: A "multiblock allocator" or mballoc is used which helps in
allocating multiple blocks in one single call. It eliminates the need to allocate one
block per call individually thereby helping to avoid the excessive overload. It ensures
improved efficiency instead of allowing a single block per individual call [12].
- Delayed allocation: Unlike the traditional file systems [13] it does block allocation as
soon as possible. For instance the meaning of write()s in a process means immediate
block allocation for data placement even if presently no data is being written on the
disk. It stores that data temporarily on the cache memory for some time before
deleing to completely.
- Fast fsck: Again, this is a slow of the EXT4 operation in which all inodes of the file
system are properly checked and at each group’s end the inode table stores the names
of the unused inodes which is for the check some or the safety of the data in the
table[14]. However, fsck will not be checking the unused inodes in the table. The
resulting fsck time improves around 20 times than its original value depending on the
number of inodes that were actually used in the system.
Compatibility:
Journal checksumming is a process, which makes use of the journal which is the most
used parameter in this process, thereby causing the blocks to be more prone to different kinds of

6COMPUTER SECURITY ENGINEERING
hardware failures. Recovering corrupted journals can cause massive corruption of data making
the blocks that form part of it more prone to hardware failure. EXT4 can help to determine if the
files are failing or they are being corrupted[15]. Tis is turn causes it to be compatible with the
different operating systems such as Windows as well as the modern MAC operating systems
which supports the different system files that are generated in the process. Online
defragmentation is again another important function of this file process in which there are
different advantages such as delayed allocation, allocation of extents as well as multiblocks that
helps in reducing fragmentation. A tool called the e4defrag tool is used for online
defragmentation for individual files or even the whole system can be defragmented. This again
helps in a better compatibility of the files in the file system.
Inode-related features: Larger sized inodes that are timestamps in the frame of nanosecond, faster
and extended parameters, inodes reservation. The default size of EXT$ is 256 bytes[16]. In this
some extra fields need to be accommodated, while the remaining inode space stores extended
attributes to fit in the remaining space. Inode reservation consists in reserving several inodes
when a directory is created, expecting that they will be used in the future [17].
Persistent pre allocation In the latest versions of kernel, emulated by the for file systems that do
not support it, allows disk space pre allocation: Spaces are pre allocated by the different
applications in which necessary blocks are pre allocated but no data is available for use until an
application really needs it [18].
Barriers on by default: The file system integrity is improved by the application of different kinds
of performance costs as it can be disabled from mount -o to barrier = 0, and it is recommended to
improve the overall efficiency as well as the performance of the system. This will improve an
overall improvement of the systems.

7COMPUTER SECURITY ENGINEERING
Suitability of the local file supporting system:
Single workstation:
The local file supporting system of ETX4 primarily improves the storage capacity, the overall
performance and capacity. In ETX4, data allocation is changed to extents from the fixed blocks.
An extent is described as a long file that is contagious in a single in code pointer entry; this will
help in reducing of the number of pointers that is used to describe the location of the data in
larger files. The allocation methods as well as strategies have been implemented to reduce any
further fragmentation in the system. It reduces the scattering of the files that are recently created.
The file algorithms of the file allocation try to spread the files among the cylinder groups to
reduce latency of the files as much as possible. The file that has been used in the ext4 are kernel
version 2.6.28. The ext4 as a stopgap technology, which help in the organization of the files. It
uses 48 bit internal addressing that could allocate the 16-tb file system.
Enterprise network:
The network has unlimited subdirectories to store information. The ext4 uses Tree indices to
mitigate performance loss. The enterprise network of ext4 had a reluctant superblocks and check
sum of the data that figure out for the whether superblock of the file system is corrupt and do
they have an alternative. The enterprise file system figure out whether a file system using an
alternate system. The enterprise network have large allocation and it increase the slack space of
the networks. Etx4 is a stable file system that always provide an alternative for the kernel
modules, grub config and Dkms from a chroot, the file systems provide enough data bits
extending the better time stamps to nanoseconds. The etx4 uses e4defrag an online kernel mode,
file system aware and extent level defragmentation utility[19].
Network Protocols for network file access:

8COMPUTER SECURITY ENGINEERING
 SMB Protocol: The SMB protocol or the Server Message Block is a protocol of the
Microsoft Windows which is used for the folder sharing, serial ports and printer sharing
purpose. The present version of the Server Message Block is the SMBv2. This version of
the Server Message Block was introduced with the Windows Vista. After launching with
the Windows Vista it has gone through lots of changes and under the operating system of
Windows 7.
The Server Message Block is a type network file sharing protocol. Though this is now under the
Microsoft Windows but it was originally developed by the IBM. Microsoft helped to improve
this protocol in the year of 1990. After that it becomes a Windows based network protocol which
is now used for modifying and deleting shared file and folders over the network. The SMB
works in the application layer protocol[20]. On the successful deployment of the SMB it works
on the via the TCP port. In the TCP port the SMB uses the port no 445 to communicate with the
other devices. The SMB gathered much popularity in the field of the file sharing over the
network because it was providing much more flexibility when it was compared with the file
transfer protocol or the FTP. In the case of the Linux environment system the Server Message
Block uses a program named Samba which allows this Linux system to communicate via the
Server Message Block[22].
 CIFS Protocol: The CIFS Protocol is also known as the Common Internet File System
which is also a type of file sharing protocol. This Common Internet File System protocol
is able to provide a cross and open platform mechanism which is used for the requesting
services and files over the network environment. The CIFS or the Common Internet File
System is an improved version of the Server Message Block of the Microsoft which is
also used for intranet and internet file sharing purposes[23].

9COMPUTER SECURITY ENGINEERING
The Common Internet File System protocol is much more advanced from its previous
predecessor because it is able to provide broad range of features, which includes the internet
authoring and the file sharing methods. As this is an advanced file sharing method this method is
used in the server OS and in the heavy operating system. The CIFS has also an embedded
application system into it which assists the CIFS in the network file sharing. The popular storage
products like the NAS and SAN are based on the CIFS. The CIFS protocol also features the file
access, file change modification, protocol version negotiation, batched requests, file and record
locking and some extended attributes. In the extended attributes it supports various types
addition of the non-file system attributes which includes the content and the description of the
file. By providing the file and record locking this CIFS protocol can lock the files from the
unauthorised access. The file change notification can help to notify the administrator when
changes in the file occurs in the server.
File Saving Procedure in the NTFS file System form the EXT4 file system:
The new technology file system (NTFS) uses various types mechanisms to store the files
in hard drive using the Common Internet File System protocol. This NTFS file system has major
improvements when considering with the FAT and HPFS for data security and in the file saving
process[24]. While saving data from an EXT4 file system this NTFS file system uses the b-tree
dictionary. This b-tree dictionary helps in the case of file saving by keeping the track of the file
clusters. When the file is saved from an EXT4 extension to the NTFS extension this information
about all of the data is stored in the file’s cluster and the other types of data are stored on the
each of the clusters. Therefore an ACL or the access control list is developed. This ACL or the
access control list is used in the case of the administrator control over some specific files which
are required while saving the file. While saving the data from an EXT4 file system, the

10COMPUTER SECURITY ENGINEERING
optimization of the files is very much required. For optimizing the files, integrated file
compression method is used while saving the files. The cluster of the NTFS file system has a big
role while saving the file from an EXT4 storage, which is kind of a remote file system [25]. The
cluster size is the trade-off, which is required to efficiently use the disk space while using the file
system for data saving purpose. It is very much important to keep record each of every file when
a file is saved in any type of file system. For this reason while the data is saved from a remote
machine, which uses the EXT4 storage a special file, is created. This file is known as the Master
File Table. This is a type of record file which is used for the tacking the record used to locate the
files which are possibly in the scattered clusters. The NTFS file system find contagious storage
space for the file saving purpose, which can hold the entire file.
The integration of the CIFS is required for saving the files remotely from an EXT4 file
system to a NTFS file system. This is the primary protocol used for remote file sharing. For
saving the file in a NTFS file system remotely, the CIFS or the Common Internet File Service
uses the TCP and the UDP ports to communicate. In the case of the TCP ports, this uses the port
no of 139 and the port no 445[26]. The UDP ports uses the port no of 137 and the 138 for
remotely communicating and saving the file to a NTFS file system from a EXT4 file system
remotely. The NTFS file system receives and sends data using these mentioned ports to save the
files. The NTFS file system also makes some outbound connections, which are for the Kerberos
and DNS to save the files successfully.

11COMPUTER SECURITY ENGINEERING
References
[1] Chajed, Tej, et al. "Certifying a file system using crash hoare logic: correctness in the
presence of crashes." Communications of the ACM 60.4 (2017): 75-84.
[2]Bornholt, James, et al. "Specifying and checking file system crash-consistency models." ACM
SIGARCH Computer Architecture News. Vol. 44. No. 2. ACM, 2016.
[3]Lu, Lanyue, et al. "A study of Linux file system evolution." ACM Transactions on Storage
(TOS) 10.1 (2014): 3.
[4]Amani, Sidney, and Toby Murray. "Specifying a realistic file system." arXiv preprint
arXiv:1511.04169 (2015).
[5]Kao, Da-Yu, and Yuan-Pei Chan. "Identifying Temporal Patterns Using ADS in NTFS for
Digital Forensics." International Conference on Security with Intelligent Computing and Big-
data Services. Springer, Cham, 2017.
][6]Cho, Gyu-Sang. "NTFS Directory Index Analysis for Computer Forensics." Innovative
Mobile and Internet Services in Ubiquitous Computing (IMIS), 2015 9th International
Conference on. IEEE, 2015.
[7] Cho, Gyu-Sang. "NTFS Directory Index Analysis for Computer Forensics." Innovative
Mobile and Internet Services in Ubiquitous Computing (IMIS), 2015 9th International
Conference on. IEEE, 2015.
[8] Kantert, Jan, et al. "Combining trust and ETX to provide robust wireless sensor
networks." ARCS 2016; 29th International Conference on Architecture of Computing Systems;
Proceedings of. VDE, 2016.