Recovering Deleted/Lost/Missing Data From Novell Servers

Fig: Structure of a NetWare Partition and its Hot Fix Redirection Area

The Data Area consists of a Volume Table (which contains detailed information of the volumes such as name, size, block size, segmentation, and other details) and one or more logical Volumes. The first volume in any NetWare partition is the SYS Volume. Shown below is the Volume distribution in a typical server disk:

Fig: Distribution of Volumes on a server disk

The methods and data structures used to organize files on a Volume are known as its File System. NetWare file systems have evolved over time with NetWare 2.x using NWFS 286, NetWare 3.x and 4.x using NWFS 386, while NetWare 5.x and later uses the NSS (Novell Storage Services) file system.

NWFS

NWFS can be thought of as a modified FAT (MS-DOS/Windows) file system. It used to come in both 16-bit (NWFS 286) and 32-bit (NWFS 386) versions, and has now been superseded by the 64-bit NSS (Novell Storage Services) file system.

NetWare 4.x and earlier had volumes formatted to the NWFS file system which is similar to Microsoft's FAT 32 file system. Distributed across a NetWare Volume are certain blocks which contain 2 important data structures that manage files and directories – these are DET (Directory Entry Table) and FAT (File Allocation Table). This is similar to the Directory Table and File Allocation Table used in Microsoft's FAT file system.

The DET contains a list of all files and directories in the volume including details such as name, size, attributes, and so on. The FAT is a table that contains information about where on the Volume various files are stored, which blocks they occupy, and so on – all files can be located using the FAT. 2 copies each of the DET and FAT are maintained (for the sake of redundancy). The DET and FAT blocks are distributed throughout the Volume.

Fig: Structure of a NetWare Volume

In NWFS, the Directory entries are recorded in a Table, and the File Allocation entries are maintained using Linked Lists.

NSS

Unlike NWFS (which manages data using the DET and FAT), NSS is a Journaling file system. This means that any change made to a file, instead of being directly updated to the DET and FAT as in NWFS, is first logged in a journal before the actual change is made. Only the files metadata (data about the file such as name, size, location, and so on) is logged and not the actual file data. Therefore, if the disk crashes while some write processes are running, the OS knows which processes to redo on rebooting.

All structured data on a Volume formatted to NSS is organized using the B-Tree (Balanced Tree) algorithm. The B-Tree is a tree data structure and is very efficient for use in file systems and databases. Two of the B-Trees found in NSS are the Name Tree B-Tree which manages a Volume's directory structure (analogous to the DET in NWFS) and the Beast B-Tree which manages all file's metadata (analogous to the FAT in NWFS).

A B-Tree is very efficient with insertions and deletions which is why it is used in file systems and data bases