Journaling File Systems: Crash Consistency and What the Journal Tells Investigators
Writing a file is not one operation. The data blocks are written, the allocation map is updated, the directory entry is created, and timestamps are changed — and a power loss between any two of those leaves the file system inconsistent. Journaling solves this by recording what is about to happen before doing it. The problem journaling solves An interrupted write can leave blocks marked as in use that belong to no file, a directory entry pointing at nothing, or a file whose length does not match its allocated blocks. None of these are detectable without checking, which is why non-journaling file systems require a full consistency scan after an unclean shutdown. That scan walks the entire file system, and its duration scales with size. On a multi-terabyte volume it takes hours — hours during which the system is unavailable, which is the operational argument for journaling quite apart from correctness. How it works Before modifying the file system, the intended changes a...