Is ReFS really covered by Windows OS? ReFS 101 for Forensics

How to make sure ReFS data is available on all major Windows OS: Tips from Paragon Software Group

About ReFS: Key features

ReFS — Resilient File System — is a Microsoft proprietary file system (FS) introduced with Windows Server 2012. The new FS was built on the solid NTFS foundation and promoted as the “next generation” file system succeeding NTFS. ReFS is compatible with the key features from the old file system but it also introduces new storage technologies.

The new file system benefits enterprise and creative users that work with massive amounts of data: large enterprises running or serviced by data centers, on the one hand, — and video editors, photographers — on the other hand.

Microsoft mentions that the ReFS architecture is developed to provide scalability and high performance for today’s growing data set volumes and dynamic workloads.

The key features of ReFS are:

  • Integrity: ReFS keeps the data safe from many common errors that can cause data loss.
  • Availability: If corruption occurs, ReFS will stay online.
  • Scalability: ReFS is expandable and future-proof catering to the the data volumes of today and tomorrow.
  • App Compatibility: ReFS supports a subset of NTFS features as well as Win32 APIs.
  • Proactive Error Identification: ReFS includes a data integrity scanner (a “scrubber”) that runs periodical volume checks, attempts to identify silent data corruption, and helps preemptively remediate corruption incidents.

What are the issues with ReFS, and what’s the solution?

These are valid points in favor of using ReFS. However, when working with ReFS, you can face a number of limitations:

  • Compatibility issues on various Windows OS
  • No file-level compression and encryption, disk quotas or hard links
  • No support for object IDs, named streams, extended attributes, short names, user data transactions, and more NTFS features
  • No Windows boot option from a ReFS volume.

Now, where does Paragon Software step in? Drivers for cross-system interoperability are among the most celebrated Paragon products. They’re consolidated as File System Link Suite — a set of cross-platform file system drivers. Drivers eliminate incompatibility issues and unlock data access under different file systems. A real asset for heterogeneous businesses environments and forensic experts that have to read and retrieve data formatted in various file systems.

Paragon ReFS for Windows is our new interoperability driver for accessing ReFS files from all major Windows versions, including those that don’t support particular ReFS editions.

ATTN Forensic experts!
Just a couple posts back we told you about a forensic product Image Mounterby Paragon Software — your assistant in disk image mounting. It makes a great team with File System Link Suite. In a bundle, they allow an investigator to access and mount images formatted in literally any file system across any popular operating system.

ReFS for Windows is a valuable driver for forensic experts. It overcomes the ReFS limitations and enables users to access physical ReFS-formatted drives from various Windows OS without native ReFS 3.x support.

 

How does the magic happen?

Windows 10 offers native support for ReFS 3.4. If the user connects a ReFS 3.1 volume, the native driver automatically upgrades the file system to ReFS 3.4. As a result, the user can’t access the data from the system it was created in. But if the user mounts the volumes with ReFS for Windows by Paragon Software, the file system upgrade doesn’t happen. Thus ReFS for Windows keeps the data intact. Paired with Image Mounter, the solution also allows for mounting disk images in ReFS.

Request a free ReFS for Windows by Paragon Software trial, and share your feedback!

Share: