 Hello everybody! In today's video, we will discuss RFS, a file system by Microsoft, exploratory structure and features, and also analyze data recovery from an RFS drive in terms of peculiarities and possible issues. Finally, we will compare performance and efficiency of different products in recovering data from RFS volumes. In our channel and blog, you will find solutions to any problem, from installing an operating system or configuring it to fixing possible bugs and errors or optimizing mobile gadgets. Our specialists will answer any questions you ask in your comments under the videos or articles. RFS, a Microsoft proprietary file system, was introduced with Windows Server 2012. Recently, it has been included in Windows 10, where it could be used as a part of storage spaces feature for a pool of disks. This file system was improved in Windows Server 2016, and until 2018, it was one of the components inside Windows 10 Pro. Today, this file system is mostly used in versions of Windows designed with service in mind. RFS, or Resilient Files System, is a new file system based on NTFS code. Actually, RFS is not a replacement for NTFS, as it has its own advantages and disadvantages. But RFS is meant to address the major issues that NTFS suffers from. It is more resilient to data damage, can handle heavy workloads better, and is easily scalable for very big file systems. The peculiarity of this file system is that it uses checksums for metadata, and it can also use checksums for file data. When reading or writing a file, the system examines the checksum to make sure it is correct. This way, data distortion can be monitored in real-time mode. If the file system detects damage data which has no alternative copy for recovery, RFS will remove such data from the disk immediately. In such case, you don't need to restart the computer or disconnect the media, which is required if you are using NTFS. You no longer need to use the check disk utility either, as the file system is corrected automatically the moment an error appears. The new system is also resilient to other scenarios when data becomes corrupt. Also, it features improved reliability for data storage. RFS uses B-plus trees for all on-disk structures, including metadata and file data. The file size, number of files in a folder, total volume size, and number of folders in a volume are limited by 64-bit numbers. FreeDisk space is counted by a hierarchical allocator, which includes three separate tables for large, medium, and small chunks. File name and path name length is limited to 32 kb of unicode characters. The new file system is also more resilient to damage that can be caused to your data in any other way. For example, when you update file metadata, for example, a file name, NTFS will edit the file metadata directly. If your computer breaks down, crashes, or there is a power card in the middle of the process, data could get corrupt. On the contrary, when you update file metadata in RFS, it will create a new copy of metadata and the updated metadata will be assigned to the file only after all new information is written. This way, there is no danger for the file metadata to become corrupt. This approach is known as copy-on-write. RFS is newer and supports larger volumes and longer file names than NTFS. In the long-term prospect, these are very important developments. NTFS file paths are limited to 255 characters, while RFS supports over 30,000 characters or to be exact, 32,768. NTFS has a theoretical maximum capacity of 16 exabytes, while RFS boasts the unbelievable 260,144 exabytes. Most of the time, it does matter much, but it's a good reserve for the future. RFS doesn't support some of NTFS functions such as data compression, encrypting file system, hard links, extended attributes, data deduplication, and disk waters. Nevertheless, RFS is compatible with various features. For example, if you can't encrypt certain data at the file system level, RFS still supports bitlocker encryption. Windows 10 won't let you format any partition into RFS, and at the moment, this file system can be used only for storage spaces where its features help protect your data from any damage. In Windows Server 2016, you can format volumes with RFS instead of NTFS. However, you can't use RFS for a boot volume, as Windows can only boot from an NTFS disk. These days, RFS is only used on server versions of Windows and on Windows Enterprise, also known as LDSC. In spite of RFS and NTFS often mentioned as being similar, the actual thing they share is compatibility of some metadata structures. The way how RFS disk structure is implemented differs completely from other Microsoft file systems. The main structural elements of the new file system are B plus trees. All elements of the file system structure are either a single level, leaves, or multi-level B plus trees, which allows maximum scalability for almost any element of the file system. Together with real 64-bit addressing for all system elements, it excludes possible bottlenecks if the file system is to be scaled any further. In addition to the root record of the B plus tree, all other records have the same size as the entire block of metadata, in our case 16 kilobytes. Meanwhile, intermediate nodes or address nodes have a very small size about 60 bytes. That is why we usually need a small number of three levels to describe even very large structures, which certainly improves overall system performance. The main structural element of the file system is the directory presented in the form of a B plus tree with the key as a number of the folder object. Contrary to other similar file systems, a filing RFS is not a separate key element of the directory, but it only exists as a record in the folder which contains it. Perhaps because of this architectural feature, RFS doesn't support the so-called hard links. Leaf directories are typified records. For a folder object, there are three main types of records, a directory descriptor, an index record, and a nested object descriptor. All such records are packaged as a separate B plus tree with a folder identifier. The root of this tree is a leaf of the directory B plus tree. It allows you to pack almost any number of records into a folder. Looking at the lower level in the leaves of the B plus tree, you can find a directory descriptor record containing basic information about the folder, such as name, standard information, file name attribute, etc. Further in the directory, you can find the so-called index entries, short structures with the data on the elements contained in the folder. And with NTFS, these records are considerably shorter, which means the volume has to store less metadata. The last elements are directory items records. For folders, these elements contain the name of the folder as well as the folder identifier in the directory and the structure of the standard information. For files, the identifier is missing, but instead, the structure contains all the basic data about the file including the root of the B plus tree and file fragments, so a file can consist of almost any number of chunks. Files on disk are located in 64 kilobyte blocks, though they are addressed in exactly the same way as metadata blocks in 16 kilobyte clusters. The residency of file data on RFS is not supported, so a file 1 byte on the disk will take up a whole block of 64 kilobytes, which leads to significant redundancy of storage when dealing with small files. On the other hand, it simplifies the management of free space and the process of space allocation for the Air Force in your file is much faster. Although RFS is characterized by improved security and efficient data storage features, it can't protect important information entirely from accidental deletion, virus attacks or other things that may cause a data loss. One has to consider the probability of such issues in the future and get ready with a reliable utility that would be able to fix problems with deleted files. The best solution for such cases should be a specialized data recovery tool. Hetman Partition Recovery allows analyzing the disk storage managed by RFS file system with a signature analysis algorithm. Analyzing the storage device sector by sector, the program finds certain byte sequences and represents these to the user. Recovering data from an RFS storage space is no different from doing it in an anti-FS file system. In fast scan, the program looks for the volume header which is located in sector 0, while its copy is located in the last sector. The header contains the information which the program needs for further analysis, the number of bytes in a sector and the number of sectors in a cluster. Then this data is collected, the program finds superblock which is stored in block 30. The superblock has two copies, one in the second block from the end of the disk and one in the third block. On the superblock, the program detects links to checkpoints. There are two checkpoints and they can be found at the addresses specified in the superblock. Following the two addresses, the program finds virtual allocated clock and uses this data to determine which of the two checkpoints is relevant at the moment. As we know, Windows initially modifies the first checkpoint and only if the operation is successful it proceeds to copy the data to the other checkpoint. The checkpoint contains general tables. From there, our program reads page header and the block containing data. This block gives us pointers, that is, links to all general tables. To transform virtual addresses to physical addresses, it needs to find container tables. Then the virtual address is used to find object ID table to obtain all tables. After that, the program searches for information page by page trying to identify the level. If it's a level 0 leaf, the data we are looking for is read. If it's not, the program will look for the path to another level until it finally reaches level 0 node where the required data is located. Even if one of the elements in this file system structure is damaged or corrupt, the algorithm used for full analysis lets our program exclude those broken links and reach the required information which should be recovered. In a minute, I'll show you how it works in practice and compare how most popular data recovery tools work with this file system. For our benchmarking assessment, we have selected several popular data recovery tools. Hetman Partition Recovery, RStudio, EaseUS and UFS Explorer. Initially, we were supposed to test more products, but it appeared that only a few of them support RFS and tools like Recover, one of the most popular choices, Drill, Stellar and IBSoft turned out to be unfit to handle RFS volumes. Alright, let's begin. There's a computer with Windows Server installed on it and we have created a test disk with RFS file system. Let's copy some data there. For example, photos, videos, documents. Remove some of the files and shut down the computer. We will perform the test on another computer running Windows 10. By the way, Windows 10 is able to recognize RFS without any extra software or drivers. Let's connect the RFS drive and start the testing with Hetman Partition Recovery. Here we go. You can see that the program can recognize the disk, detect its file system and display its name properly. Open it. In case of a simple installation, a false scan will suffice. Let's check the results. Eight folders and 21 files are found. There are all the detected files and folders. The ones that have been removed are marked with the right cross. All the files are displayed in the preview window and available for recovery. The disk structure is retained and all files and folders can be located easily. The program has completed this test successfully and met the challenge just as it should. Let's try another candidate – RStudio. You can see that the program can recognize the test disk, detect its file system and display its name properly. Open the disk. The program was also able to find the deleted files and folders and mark them with the right cross. Deleted photos, videos and documents are not shown in the preview window. With QuickScan, contents of the deleted files cannot be displayed. Let's run a full scan then. It may take a bit longer, but we can wait. Let's open the disk. The full scan gives us a completely different picture, with all files available for preview. This program has also passed the test, though it required a bit more time than expected. Let's move down the list. To test is US Data Recovery Wizard. The program displays the disk but without showing its name or file system type. You can only see it's our test disk by its size. Let's scan the disk. This program has no option for QuickScan, so all you can do is to run an advanced scan at once. Look what it found – 17 files. The disk structure is lost. The program seems to be checking the disk with in-depth analysis, so it's going to take a long time if you're working with high-capacity drives. Let's see what it can do. The program fails to display file names, and the files are only sorted to folders by file type. However, it managed to detect all documents, photos and videos. Unfortunately, deleted files have no markings to distinguish them from the files which are still on the disk. The only way to tell if all files are present is by counting them. As you can guess, finding the file you need is going to be quite a challenge when there are many of them on the disk, and it will take a long time to view every file. This program has also passed the test, though it took much longer. Now let's see what UFS Explorer can do. Start the program. It can recognize the disk, and it is marked as invalid. The program failed to detect the file system type and disk name. Let's scan the disk. After all, it says there is a quick scan option to start with. Well, the quick scan is not so fast as we expected. It takes longer than full analysis in our studio and advanced scan in EaseUS. Let's check the results. The program couldn't find disk contents. Alright, let's try full scan then. Full scan also gave us no result, though the company's website promises full support for REFS. Well, here is the first utility to file the test today. Disk contents not found. From now on, our test involves only three tools – Hetman Partition Recovery, EaseUS and RStudio. And we are going to erase main elements of the file system structure one after another. One header and its copy, all super blocks. And for the final test, we will remove all checkpoints. Even if all links of the file system structure are erased, our product will find the data because its algorithm only looks for B3 leaves, which contains the information. Hetman Partition Recovery allows us to analyze the disk space managed by RFS file system with the signature analysis algorithm. Analyzing the storage device sector by sector, the program finds certain byte sequences, keeps lost elements of the chain and represents the data to the user. If the entire file system structure is erased but Level 0 folders are still there, data recovery is still possible and our program will do its best to display and recover it. Alright, let's check how it works in practice. Erase volume head or main. Run Hetman Partition Recovery. It recognizes the disk and detects its file system as NTFS, but doesn't display the disk name. Open the disk. Fast scan can't find anything under the diagram's circumstances, so it's time for full analysis. Here you are, one disk, eight folders, 21 files. Here is our disk. The program detected the file system type and name of the disk, so let's open it. To find all data present and available for preview. This program has completed the task successfully. Now let's try RStudio. This program also recognizes the disk but without its name and file system. As the quick scan was unimpressive at the earlier stage of today's testing, we go for full scan at once. The program managed to recognize the disk name and file system. The structure is retained, all data is present, so we can say it's a post. The next one on the list is US. When we start it, it can recognize the disk as well, but without its name and file system as before. When we scan it, we can see similar results as before. Files are sorted to folders by type, the disk structure is missing, file names are lost, all documents seem to be present, one document and one video are not available for preview, and most likely they can't be recovered. By test results, US ranks third in our benchmark. Now let's erase volume header copy. Run Hetman partition recovery, and the result is the same as in the previous test. The program can recognize the disk with the NTFS file system. Alright, set it to full analysis – RFS. Here are one disk, eight folders, 21 files. The program managed to recognize the disk name and file system type. The disk structure has been retained, all files are in their directories and available for preview. The last step to take is to save them. Now let's see what our studio can do. Everything is just like it was in the previous test. No file system, no disk name. Let's scan it. RFS? Great! The program can detect the file system type and disk name. All data is present, so we can say again – it's a boss. Finally, US. Initially, it shows this disk without any name or file system type. Okay, let's scan it. The result is the same as we saw in the previous test. One document and one video are not available. Now let's erase all superblocks. And start with Hetman Protection Recovery. The result is the same as in the previous test. Full analysis, one disk, eight folders, 21 files. The program can detect the file system type and disk name. All data is present, the disk structure has been retained and files can be recovered. Our studio. The disk is displayed just as in the previous test. Scan it. RFS. The name and file system type are detected. All data is available. US shows the disk itself and in size just as it did before. Let's scan it. You can see the result on the screen – the same picture that we had in the previous test. And in the final test, we will also erase all checkpoints. Hetman Protection Recovery. The program can recognize the disk but without its name and file system type. Full analysis. RFS. Just as before, one disk, eight folders, 21 files. The name and file system type are detected. The disk structure and file names are retained. All data is available for further recovery. Our studio. Let's scan it. RFS. And the program recognizes the file system type and disk name. Let's open the disk. Surprised? The program failed to find disk contents. The disk is shown as absolutely empty with some log files only. Unfortunately, this program failed the last test. Now let's see if US can do better. Start the program and scan the disk. The same result – no disk structure. File names are missing. One document and one video file are unavailable. However, the program managed to find the other data that the disk used to store. Luckily, it is using in-depth analysis when scanning the disk, because by default the files are sorted into folders by file type. Such type of analysis requires a lot of time and fails to retain the file names and folder structure, which makes searching for specific data more difficult. Finding the file you need is going to be quite a challenge when there are many of them on the disk. Now let's draw the bottom line. We've got two products that have passed all the tests and one more that failed at the last stage. Our studio did well, and it opens our top 3 rating. While EaseUS ranks second because it was much better, though it never had a chance to display the contents of one document and one video file. And that is why Hedgeman Partition Recovery deserves the top position in this benchmark as it coped with all tests successfully and was able to display all the files and folders. Still, choosing the tool to use is entirely up to you. And there is only one thing I'd like to add. The algorithm used in our product allows to retain the folder structure and file names which makes it easier to search for certain data and saves your time. In addition, our program lets you create a disk image and then recover data from there, which is the interesting standard for dealing with faulty drives. Another favorite is US, has very good results but doesn't offer this specific option. As I have already said, at the beginning of this video, the algorithm used in our product lets you recover data even if the entire structure of the file system is erased. And if the disk has at least some level zero nodes, Hedgeman Partition Recovery can restore them and display them to you thanks to using signature analysis. And that is all for now. Hopefully this video was useful. Remember to click the Like button and subscribe to our channel. Push the bell button to receive notifications and never miss new videos. Leave comments to ask questions. Thank you for watching. And good luck.