Fork (filesystem)

In computer file systems, a fork is additional data associated with a file system object. A file system might support only one fork per file or might support multiple named forks. Unlike "extended attributes", which are typically limited in size, a fork can be of arbitrary size, possibly even larger than the file's data.

File system forks are traditionally associated with Apple's Hierarchical File System (HFS), [cite web | url=http://developer.apple.com/documentation/mac/Files/Files-14.html | title=File Forks | author=Apple | date=1996-07-02 | publisher=Apple | accessdate=2006-11-18] but are also available in other file systems. In Microsoft's NTFS they are known as Alternate Data Streams (ADS). [cite web | url=http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/fs/files_and_clusters.asp | title=Files and Clusters | author=Microsoft | publisher=Microsoft | accessdate=2006-11-18] Other filesystems such as Novell's Novell Storage Services (NSS) and NetWare File System (NWFS), Solaris's UFS (in Solaris 9 and later) [cite web | url=http://docs.sun.com/app/docs/doc/817-0493/6mg9pruau?a=view | title=What's New in the Solaris 9 8/03 Operating Environment: File System Enhancements | author=Sun | publisher=Sun | accessdate=2006-11-18] and ZFS, and Veritas Software's Veritas File System (VxFS) also support file system forks. In Solaris they are known as extended attributes, although they can be as large as a file and are accessed in the same way a file's data is and thus behave like a fork. UDF, being a universal file system for general data exchange, supports forks as well.

Apple's HFS, and the original Apple Macintosh file system MFS, were designed to allow a file to have a resource fork to store metadata that would be used by the system's graphical user interface (GUI), such as a file's icon to be used by the Finder or the menus and dialog boxes associated with an application. [cite web | url=http://folklore.org/StoryView.py?project=Macintosh&story=The_Grand_Unified_Model.txt | title=The Grand Unified Model (1) - Resources | author=Bruce Horn | publisher=Folklore.org | accessdate=2006-11-18] However the feature was not limited to GUI data, so additional uses were found, such as splitting a word processing document into content and presentation, then storing the presentation information in the resource fork. One particular non-obvious use is that prior to Mac OS X, PostScript Type 1 fonts have traditionally been stored entirely in the resource fork, the data fork being empty [cite web | url=http://www.adobe.com/support/techdocs/328509.html | title=PostScript Type 1 and Type 3 Fonts General Information | author=Adobe | date=2004-07-07 | publisher=Adobe | accessdate=2006-11-18] . In addition, old 680x0 applications had all of their code in the resource fork as 32K segments which were loaded on demand [cite web | url=http://folklore.org/StoryView.py?project=Macintosh&story=RMaker.txt | title=RMaker | author=Andy Hertzfeld | publisher=Folklore.org | accessdate=2006-11-18] .

Starting in 1985, NWFS and its successor NSS were designed from the ground up to use a variety of methods to store a file's metadata. Some metadata resides in Novell Directory Services (NDS), some is stored in the directory structure on the disk, and some is stored in, as Novell terms it, 'multiple data streams' with the file itself. Multiple data streams also allow Macintosh clients to attach to and use NetWare servers.

In 1993, Microsoft released the first version of the Windows NT operating system which introduced the NTFS filesystem. This filesystem includes support for multiple named forks as "alternate data streams" for compatibility with pre-existing operating systems that support forks. With Windows 2000, Microsoft started using alternate data streams in NTFS to store things such as "author" or "title" file attributes [cite web | url=http://msdn2.microsoft.com/en-us/library/ms810604.aspx | title=A Programmer's Perspective on NTFS 2000 Part 1: Stream and Hard Link | author=Dino Esposito | month=March | year=2000 | publisher=Microsoft | accessdate=2006-11-18] and image thumbnails. [cite web | url=http://support.microsoft.com/kb/319300 | title=Indexing service adds data streams to image files | author=Microsoft | date=2006-10-27 | publisher=Microsoft | accessdate=2006-11-18] With Service Pack 2 for Windows XP, Microsoft introduced the Attachment Execution Service that stores details on the origin of downloaded files in alternate data streams attached to files, in an effort to protect users from downloaded files that may present a risk. [cite web | url=http://community.bartdesmet.net/blogs/bart/archive/2005/08/19/3485.aspx | title=Demo of "Attachment Execution Service internals" in Windows XP SP2 and Windows Server 2003 SP1 | author=Bart De Smet | date=2005-08-19 | publisher=B# .NET Blog | accessdate=2006-11-18]

Possible security and data loss risks with forks

When a filesystem supports different forks, the applications should be aware of them, or security risks can arise.

If the different system utilities (disk explorer, antivirus software, archivers, and so on), are not aware of the different forks, the following problems can arise:
* The user will never know the presence of any alternate fork nor the total size of the file, just of the main data fork.
* Computer viruses can hide in alternate forks on Windows and never get detected if the antivirus software are not aware of forks.
* Data can be lost when sending files via fork-unaware channels, such as e-mail, filesystems without support for forks, or even when copying files between filesystems with forks support if the program that made the copy does not support forks or when compressing files with software that does not support forks.

Windows NT versions include the ability to use forks in the API, and some command line tools can be used to create and access forks, but they are ignored by most programs, including Windows Explorer and the DIR command. Windows Explorer copies forks and warns when the target file system doesn't support them, but only counts the main fork's size and it doesn't list a file or folder's streams. The DIR command has been updated in Vista to include an option that will list forks. [cite web | url=http://bartdesmet.net/blogs/bart/archive/2006/07/13/4129.aspx | title= Use Vista's DIR command to display alternate data streams | author=Bart De Smet | date=2006-07-13 | work=B# .NET Blog | accessdate=2007-07-07] Until Mac OS X v10.4, users using the Unix command line utilities (such as tar) included with Mac OS X would risk data loss, as the utilities were not updated to handle the resource forks of files until v10.4 [cite web | url=http://developer.apple.com/macosx/backuponmacosx.html | title=Command-line Backup Solutions on Mac OS X | date=2005-10-29 | publisher=Apple | accessdate=2006-11-18] .

ee also

* Extended file attributes

References

External links

* [http://www.heysoft.de/nt/ntfs-ads.htm FAQ: Alternate Data Streams in NTFS]
* [http://2kevin.net/datastreams.html Alternate Data Streams]