Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
This document specifies the structure of NT backup files as they are used in over-the-wire protocols. This file format is not a protocol; however, it is used to describe the format of data that is sent across the wire as payloads of other protocols, in particular, the File Replication Service Protocol (as specified in [MS-FRS1]) and the SD Microsoft Distributed File System Replication Protocol, as specified in [MS-FRS2]. As such, the format is specified in this document as a reference that other protocols can use to ensure consistency and accuracy. Contained in this specification are the following:
An overview about the structure of an NT backup file.
The definition of the WIN32_STREAM_ID (section 2.2) backup stream header.
The definition of a backup stream that can be found within an NT backup file.
While a simple model of a file is a stream of bytes, files have become more complicated over the years. They can contain large regions of zero data, more than one stream of bytes, and special attributes such as reparse points, as well as having access control lists (ACLs) attached to them. In some instances, such as making a backup copy of a file or transmitting a file over a network, it is helpful to serialize the file—that is, to efficiently express a file's full complexity as a simple stream of bytes. The NT Backup format is a particular format for this serialization.
As an example, consider sparse files. Many modern file systems, including NT File System, NTFS, (as specified in [MSFT-NTFS]) and many implementations based on Berkeley Fast File System support sparse files (for more information about Berkeley Fast File System, see [FFS]). In these file systems, unwritten portions of files have zero data, but they do not necessarily result in the allocation of disk space or the writing of zeros to the disk. When serializing these files, it is more efficient not to store the zero ranges in the serialize representation. Furthermore, in the case of NTFS, whether a range is allocated or unallocated is observable by the application via the FSCTL_QUERY_ALLOCATED_RANGES file system control (as specified in [MS-FSCC]), so replacing unallocated ranges with simple zeros alters the semantics of the file. The NT Backup format enables such a file to be transmitted over a network or a representation of it to be stored on a file system or backup medium that lacks the richness of the original file system.
As another example, consider named streams. NTFS supports a feature wherein a file can have a number of streams with associated names, in addition to the default (unnamed) main stream. For example, the main stream of a file named a.txt might contain the bytes unnamed stream, while named stream stream1, opened as a.txt:stream1, would contain "This is stream1." The NT Backup format enables serialization of any number of streams.
The content of an NT Backup serialize file is a set of backup streams. (The different uses of the word "stream" are specified in section 2.2.) Each backup stream represents one aspect of the original file, such as its ACL, a contiguous allocated section of a file stream, a reparse point, and so on.