Fork (filesystem)
Encyclopedia
In a computer file system
, a fork is byte stream associated with a file system object. Every non-empty file must have at least one fork, and depending on the file system, a file may have one or more other associated forks, which in turn may contain primary data integral to the file, or just metadata
. Unlike extended attributes
, a similar file system feature which is typically limited in size, forks can be of arbitrary size, possibly even larger than the file's primary data fork. The size of a file is the sum of the sizes of each fork.
Hierarchical File System
(HFS). Apple's HFS
, and the original Apple Macintosh file system MFS
, allowed a file system object to have several kinds of forks: a data fork, a resource fork
, and multiple named forks.
The resource fork was designed to store non-compiled data that would be used by the system's graphical user interface
(GUI), such as localisable text strings, a file's icon to be used by the Finder or the menus and dialog boxes associated with an application. However the feature was very flexible, so additional uses were found, such as splitting a word processing document into content and presentation, then storing each part in separate resources. As compiled software code was also stored in a resource, often applications would consist of just a resource fork and no data fork.
One of HFS+
's most obscure features is that a file may have an arbitrary number of custom “named forks” in addition to the traditional data and resource forks. This feature has gone largely unused, as Apple never added support for it under Mac OS 8.1-10.3.9
. Beginning with 10.4
, a partial implementation was made to support Apple's extended inline attributes
.
Until Mac OS X v10.4
, users running the legacy Unix
command line utilities (such as tar
) included with Mac OS X
would risk data loss, as the utilities were not updated to handle the resource forks of files until v10.4.
(NWFS), and its successor Novell Storage Services
(NSS), were designed from the ground up to use a variety of methods to store a file's metadata. Some metadata resides in Novell Directory Services (NDS), some is stored in the directory structure on the disk, and some is stored in, as Novell terms it, 'multiple data streams' with the file itself. Multiple data streams also allow Macintosh clients to attach to and use NetWare servers.
file system, in all its 12, 16, and 32-bit versions, is limited to one fork per file. Work-arounds exist for compatibility with operating systems that natively use a different file system.
's NTFS
file system forks are known as Alternate Data Streams (ADS). In 1993, Microsoft released the first version of the Windows NT
operating system which introduced the NTFS
file system. This file system includes support for multiple named forks as alternate data streams for compatibility with pre-existing operating systems that support forks. With Windows 2000
, Microsoft started using alternate data streams in NTFS to store things such as author or title file attributes and image thumbnail
s. With Service Pack 2 for Windows XP
, Microsoft introduced the Attachment Execution Service that stores details on the origin of downloaded files in alternate data streams attached to files, in an effort to protect users from downloaded files that may present a risk.
Windows NT versions include the ability to use forks in the API, and some command line tools can be used to create and access forks, but they are ignored by most programs, including Windows Explorer
and the DIR command. Windows Explorer copies forks and warns when the target file system does not support them, but only counts the main fork's size and does not list a file or folder's streams. The DIR command has been updated in Vista to include an option that will list forks.
to access data without appropriate shims in place is the primary culprit for such problems.
If the different system utilities (disk explorer, antivirus software, archivers, and so on), are not aware of the different forks, the following problems can arise:
This video illustrate how a file is being forked in ADS and one of the methods to remove ADS files.
File system
A file system is a means to organize data expected to be retained after a program terminates by providing procedures to store, retrieve and update data, as well as manage the available space on the device which contain it. A file system organizes data in an efficient manner and is tuned to the...
, a fork is byte stream associated with a file system object. Every non-empty file must have at least one fork, and depending on the file system, a file may have one or more other associated forks, which in turn may contain primary data integral to the file, or just metadata
Metadata
The term metadata is an ambiguous term which is used for two fundamentally different concepts . Although the expression "data about data" is often used, it does not apply to both in the same way. Structural metadata, the design and specification of data structures, cannot be about data, because at...
. Unlike extended attributes
Extended file attributes
Extended file attributes is a file system feature that enables users to associate computer files with metadata not interpreted by the filesystem, whereas regular attributes have a purpose strictly defined by the filesystem...
, a similar file system feature which is typically limited in size, forks can be of arbitrary size, possibly even larger than the file's primary data fork. The size of a file is the sum of the sizes of each fork.
Apple
File system forks are associated with Apple'sApple Computer
Apple Inc. is an American multinational corporation that designs and markets consumer electronics, computer software, and personal computers. The company's best-known hardware products include the Macintosh line of computers, the iPod, the iPhone and the iPad...
Hierarchical File System
Hierarchical File System
Hierarchical File System is a file system developed by Apple Inc. for use in computer systems running Mac OS. Originally designed for use on floppy and hard disks, it can also be found on read-only media such as CD-ROMs...
(HFS). Apple's HFS
Hierarchical File System
Hierarchical File System is a file system developed by Apple Inc. for use in computer systems running Mac OS. Originally designed for use on floppy and hard disks, it can also be found on read-only media such as CD-ROMs...
, and the original Apple Macintosh file system MFS
Macintosh File System
Macintosh File System is a volume format created by Apple Computer for storing files on 400K floppy disks. MFS was introduced with the Macintosh 128K in January 1984....
, allowed a file system object to have several kinds of forks: a data fork, a resource fork
Resource fork
The resource fork is a construct of the Mac OS operating system used to store structured data in a file, alongside unstructured data stored within the data fork. A resource fork stores information in a specific form, such as icons, the shapes of windows, definitions of menus and their contents, and...
, and multiple named forks.
The resource fork was designed to store non-compiled data that would be used by the system's graphical user interface
Graphical user interface
In computing, a graphical user interface is a type of user interface that allows users to interact with electronic devices with images rather than text commands. GUIs can be used in computers, hand-held devices such as MP3 players, portable media players or gaming devices, household appliances and...
(GUI), such as localisable text strings, a file's icon to be used by the Finder or the menus and dialog boxes associated with an application. However the feature was very flexible, so additional uses were found, such as splitting a word processing document into content and presentation, then storing each part in separate resources. As compiled software code was also stored in a resource, often applications would consist of just a resource fork and no data fork.
One of HFS+
HFS Plus
HFS Plus or HFS+ is a file system developed by Apple Inc. to replace their Hierarchical File System as the primary file system used in Macintosh computers . It is also one of the formats used by the iPod digital music player...
's most obscure features is that a file may have an arbitrary number of custom “named forks” in addition to the traditional data and resource forks. This feature has gone largely unused, as Apple never added support for it under Mac OS 8.1-10.3.9
Mac OS X v10.3
Mac OS X Panther is the fourth major release of Mac OS X, Apple’s desktop and server operating system. It followed Mac OS X v10.2 "Jaguar" and preceded Mac OS X Tiger...
. Beginning with 10.4
Mac OS X v10.4
Mac OS X v10.4 Tiger is the fifth major release of Mac OS X, Apple's desktop and server operating system for Macintosh computers. Tiger was released to the public on 29 April 2005 for US$129.95 as the successor to Mac OS X Panther , which had been released 18 months earlier...
, a partial implementation was made to support Apple's extended inline attributes
Extended file attributes
Extended file attributes is a file system feature that enables users to associate computer files with metadata not interpreted by the filesystem, whereas regular attributes have a purpose strictly defined by the filesystem...
.
Until Mac OS X v10.4
Mac OS X v10.4
Mac OS X v10.4 Tiger is the fifth major release of Mac OS X, Apple's desktop and server operating system for Macintosh computers. Tiger was released to the public on 29 April 2005 for US$129.95 as the successor to Mac OS X Panther , which had been released 18 months earlier...
, users running the legacy Unix
Unix
Unix is a multitasking, multi-user computer operating system originally developed in 1969 by a group of AT&T employees at Bell Labs, including Ken Thompson, Dennis Ritchie, Brian Kernighan, Douglas McIlroy, and Joe Ossanna...
command line utilities (such as tar
Tar (file format)
In computing, tar is both a file format and the name of a program used to handle such files...
) included with Mac OS X
Mac OS X
Mac OS X is a series of Unix-based operating systems and graphical user interfaces developed, marketed, and sold by Apple Inc. Since 2002, has been included with all new Macintosh computer systems...
would risk data loss, as the utilities were not updated to handle the resource forks of files until v10.4.
Novell
Starting in 1985, Novell NetWare File SystemNetWare File System
In computing, a NetWare File System is a file system based on a heavily-modified version of FAT. It was used in the Novell NetWare operating system. It is the default and only file system for all volumes in versions 2.x through 4.x, and the default and only file system for the SYS volume...
(NWFS), and its successor Novell Storage Services
Novell Storage Services
Novell Storage Services is a file system used by the Novell NetWare operating system. Recently support of NSS was introduced to SUSE Linux via low-level network NCPFS protocol...
(NSS), were designed from the ground up to use a variety of methods to store a file's metadata. Some metadata resides in Novell Directory Services (NDS), some is stored in the directory structure on the disk, and some is stored in, as Novell terms it, 'multiple data streams' with the file itself. Multiple data streams also allow Macintosh clients to attach to and use NetWare servers.
FAT
The File Allocation TableFile Allocation Table
File Allocation Table is a computer file system architecture now widely used on many computer systems and most memory cards, such as those used with digital cameras. FAT file systems are commonly found on floppy disks, flash memory cards, digital cameras, and many other portable devices because of...
file system, in all its 12, 16, and 32-bit versions, is limited to one fork per file. Work-arounds exist for compatibility with operating systems that natively use a different file system.
NTFS
In MicrosoftMicrosoft
Microsoft Corporation is an American public multinational corporation headquartered in Redmond, Washington, USA that develops, manufactures, licenses, and supports a wide range of products and services predominantly related to computing through its various product divisions...
's NTFS
NTFS
NTFS is the standard file system of Windows NT, including its later versions Windows 2000, Windows XP, Windows Server 2003, Windows Server 2008, Windows Vista, and Windows 7....
file system forks are known as Alternate Data Streams (ADS). In 1993, Microsoft released the first version of the Windows NT
Windows NT
Windows NT is a family of operating systems produced by Microsoft, the first version of which was released in July 1993. It was a powerful high-level-language-based, processor-independent, multiprocessing, multiuser operating system with features comparable to Unix. It was intended to complement...
operating system which introduced the NTFS
NTFS
NTFS is the standard file system of Windows NT, including its later versions Windows 2000, Windows XP, Windows Server 2003, Windows Server 2008, Windows Vista, and Windows 7....
file system. This file system includes support for multiple named forks as alternate data streams for compatibility with pre-existing operating systems that support forks. With Windows 2000
Windows 2000
Windows 2000 is a line of operating systems produced by Microsoft for use on personal computers, business desktops, laptops, and servers. Windows 2000 was released to manufacturing on 15 December 1999 and launched to retail on 17 February 2000. It is the successor to Windows NT 4.0, and is the...
, Microsoft started using alternate data streams in NTFS to store things such as author or title file attributes and image thumbnail
Thumbnail
Thumbnails are reduced-size versions of pictures, used to help in recognizing and organizing them, serving the same role for images as a normal text index does for words...
s. With Service Pack 2 for Windows XP
Windows XP
Windows XP is an operating system produced by Microsoft for use on personal computers, including home and business desktops, laptops and media centers. First released to computer manufacturers on August 24, 2001, it is the second most popular version of Windows, based on installed user base...
, Microsoft introduced the Attachment Execution Service that stores details on the origin of downloaded files in alternate data streams attached to files, in an effort to protect users from downloaded files that may present a risk.
Windows NT versions include the ability to use forks in the API, and some command line tools can be used to create and access forks, but they are ignored by most programs, including Windows Explorer
Windows Explorer
This article is about the Windows file system browser. For the similarly named web browser, see Internet ExplorerWindows Explorer is a file manager application that is included with releases of the Microsoft Windows operating system from Windows 95 onwards. It provides a graphical user interface...
and the DIR command. Windows Explorer copies forks and warns when the target file system does not support them, but only counts the main fork's size and does not list a file or folder's streams. The DIR command has been updated in Vista to include an option that will list forks.
Possible security and data loss risks
When a file system supports different forks, the applications should be aware of them, or security risks can arise. Allowing legacy softwareLegacy system
A legacy system is an old method, technology, computer system, or application program that continues to be used, typically because it still functions for the users' needs, even though newer technology or more efficient methods of performing a task are now available...
to access data without appropriate shims in place is the primary culprit for such problems.
If the different system utilities (disk explorer, antivirus software, archivers, and so on), are not aware of the different forks, the following problems can arise:
- The user will never know the presence of any alternate fork nor the total size of the file, just of the main data fork.
- Computer virusComputer virusA computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...
es can hide in alternate forks on Windows and never get detected if the antivirus software is not aware of forks. - Data can be lost when sending files via fork-unaware channels, such as e-mailE-mailElectronic mail, commonly known as email or e-mail, is a method of exchanging digital messages from an author to one or more recipients. Modern email operates across the Internet or other computer networks. Some early email systems required that the author and the recipient both be online at the...
, file systems without support for forks, or even when copying files between file systems with forks support if the program that made the copy does not support forks or when compressing files with software that does not support forks.
This video illustrate how a file is being forked in ADS and one of the methods to remove ADS files.