Structures
The byte-level on-disk layouts — every metadata structure decoded during the analysis, field by field.
The structures you touch in almost any analysis: the VBR (boot sector → version and cluster
size), the Checkpoint and Superblock that bootstrap the volume, the
Object Table (the “where is object N” map — ReFS’s closest thing to an $MFT),
Directory Entries (the per-file rows), and the generic
B+-tree Node every table is built from.
Boot & bootstrap
| Volume Boot Record (VBR) | Volume Boot Record (VBR)# The VBR is a 512-byte structure at sector 0 of the ReFS partition. It provides the format parameters – cluster size, version, checksum … |
| Superblock (SUPB) | Superblock (SUPB)# The Superblock is the fixed-location volume anchor that points to the two alternating checkpoints. It always resides at cluster 30 (LCN 0x1E), … |
| Checkpoint (CHKP) | Checkpoint (CHKP)# The Checkpoint is the atomic commit point of a ReFS volume. A volume keeps two alternating checkpoints; each is one metadata page — 4 consecutive … |
| System OIDs | System OIDs# ReFS reserves the OIDs below 0x700 for internal use; user files and directories start at 0x701. These low-numbered objects hold the volume’s … |
B+-tree rows & pages
| B+-Tree Node (MSB+ Page) | B+-Tree Node (MSB+ Page)# All ReFS metadata is stored in B+-trees with the signature "MSB+". Each node occupies one metadata page: 16 KiB (4 consecutive … |
| Common Metadata Page Header | Common Metadata Page Header# Every ReFS metadata page – SUPB, CHKP, and MSB+ (B+-tree) – begins with a common 80-byte header. This layout is identical across … |
| Page References | Page References# A page reference binds a child page’s address to a checksum of that child’s contents. Every B+-tree parent stores a page reference for each … |
| Directory Entries | Directory Entries# Directory entries (type 0x30) are B+-tree rows within a per-directory B+-tree. Each file or subdirectory appears as a type 0x30 row in its parent … |
| Extent Descriptors | Extent Descriptors# Extent descriptors (type 0x40) map a file’s logical cluster offsets (VCNs) to virtual LCNs (VLCNs). A VLCN is not a physical address: it must be … |
| Reverse Index (Type 0x20) | Reverse Index (Type 0x20)# Type 0x20 is the per-object FileId-resolution index: rows keyed by a FileId (object reference / child index) that let the driver, given a file … |
System tables (the 13 roots)
| Object Table | Object Table# The Object Table (roots #0 and #5, schema 0xe030) is the master OID-to-table mapping. Every persistent object – file, directory, or system table … |
| Schema Table | Schema Table# The Schema Table (roots #3/#9, schema 0xe060) is self-describing: it contains one entry per table type used by the volume. Each entry fixes the … |
| Parent-Child Table | Parent-Child Table# The Parent-Child Table (root #4, schema 0xe040) encodes the directory hierarchy. It records only directory-to-directory and … |
| Container Table | Container Table# The Container Table (roots #7/#8, schema 0xe0c0) maps virtual container IDs to physical disk locations. It is the second level of ReFS’s two-level … |
| Container Index | Container Index# The Container Index (root #10, table ID 0x0E, schema 0xe100) is an alternate index over the Container Table, keyed by allocation state and free space … |
| Allocator Tables | Allocator Tables# ReFS tracks free and allocated clusters with a three-tier allocator hierarchy. All three tiers share schema 0xe010 and an identical on-disk row format; … |
| Block Refcount Table | Block Refcount Table# The Block Refcount Table (root #6, table ID 0x05, schema 0xe0b0) tracks shared data clusters used by snapshots, deduplication, and clones. The … |
| Integrity State Table | Integrity State Table# The Integrity State Table (root #11, table ID 0x0F, schema 0xe080) tracks volume-level integrity-stream coverage. It is present on every volume … |
| Volume Information | Volume Information# The Volume Information table (OID 0x500 primary, OID 0x501 duplicate, schema 0x150) stores the volume label, creation and modify timestamps, version … |
| Security Descriptors | Security Descriptors# ReFS uses a centralized, content-addressed security model. A SecurityId stored with each file maps directly to OID 0x530, the Security Descriptors … |
| Reparse Points | Reparse Points# A reparse point is a per-file tag plus payload that redirects path resolution — a symlink, junction, mount point, app-execution alias, or WSL special … |
| Upcase Table | Upcase Table# The Upcase Table (OID 0x07 primary, OID 0x08 duplicate, schema 0xe090) stores the Unicode uppercase mapping that ReFS uses for case-insensitive filename … |
| Trash Table | Trash Table# The Trash Table (OID 0x0D, schema 0xe0d0) is an asynchronous deletion queue. When a non-resident file or directory is deleted, its OID is reparented into … |
Journals & logs
| USN Journal | USN Journal# The USN (Update Sequence Number) Journal records every change to files and directories on the volume. ReFS uses the USN_RECORD_V3 format with 128-bit file … |
| Metadata Log (MLog) | Metadata Log (MLog)# The MLog implements write-ahead logging for atomic metadata updates. It is redo-only: on crash recovery, committed transactions are replayed and … |