In a computer file system, a fork is a set of data associated with a file-system object. File systems without forks only allow a single set of data for the contents, while file systems with forks allow multiple such contents. Every non-empty file must have at least one fork, often of default type, and depending on the file system, a file may have one or more other associated forks, which in turn may contain primary data integral to the file, or just metadata.
Unlike extended attributes, a similar file system feature which is typically of fixed size, forks can be of variable size, possibly even larger than the file's primary data fork. The size of a file is the sum of the sizes of each fork.
Popular file systems that can use forks include Apple's HFS+ and Microsoft's NTFS.
On file systems without forks, one may instead use multiple separate files that are associated with each other, particularly sidecar files for metadata. However, the connection between these files is not automatically preserved by the file system, and must instead be handled by each program that works on files. Another alternative is a container file, which stores additional data within a given file format, or an archive file, which allows storing several files and metadata within a file (within a single fork). This requires that programs process the container file or archive file, rather than the file system handling forks. These alternatives require additional work by programs using the data, but benefit from portability to file systems that do not support forks.
See also: Resource fork. File system forks are associated with Apple's Hierarchical File System (HFS).[1] HFS, and the original Apple Macintosh file system MFS, allowed a file system object to have two kinds of forks: a data fork and a resource fork.
The resource fork was designed to store non-compiled data that would be used by the system's graphical user interface (GUI), such as localizable text strings, a file's icon to be used by the Finder or the menus and dialog boxes associated with an application.[2] However the feature was very flexible, so additional uses were found, such as splitting a word processing document into content and presentation, then storing each part in separate resources. As compiled software code was also stored in a resource, often applications would consist of just a resource fork and no data fork.
One of HFS+'s most obscure features is that a file may have an arbitrary number of custom "named forks" in addition to the traditional data and resource forks. This feature has gone largely unused, as Apple never added support for it under Mac OS 8.1-10.3.9. Beginning with 10.4, a partial implementation was made to support Apple's extended inline attributes.[3]
In Mac OS X until Mac OS X v10.4, users running Unix command line utilities such as tar would risk data loss, as the utilities had not been updated to handle the resource forks of files.[4]
Starting in 1985, Novell NetWare File System (NWFS), and its successor Novell Storage Services (NSS), were designed from the ground up to use a variety of methods to store a file's metadata. Some metadata resides in Novell Directory Services (NDS), some is stored in the directory structure on the disk, and some is stored in, as Novell terms it, 'multiple data streams' with the file itself. Multiple data streams also allow Macintosh clients to attach to and use NetWare servers.
NTFS, the file system introduced with Windows NT 3.1, supports file system forks known as alternate data streams (ADS).[5] ReFS, a new file system introduced with Windows Server 2012, originally did not support ADS,[6] [7] [8] but in Windows 8.1 64-bit and Server 2012 R2, support for ADS, with lengths of up to 128K, was added to ReFS.[9]
ADS was originally intended to add compatibility with existing operating systems that support forks. A computer program may be directed to open an ADS by specifying the name of ADS after a colon sign (:) after the file path.[10] In spite of the support, most programs, including Windows Explorer and the dir command (before Windows Vista) ignore ADS. Windows Explorer copies ADS and warns when the target file system does not support them, but only calculates the main stream's size and does not list a file or folder's streams. Since Windows Vista, the dir command supports showing ADS.[11] Windows PowerShell v3.0 and later supports manipulating ADS.[12]
Windows 2000 uses ADS to store thumbnails in image files, and to store summary information (such as title and author) in any file, without changing the main stream.[13] [14] With Windows XP, Microsoft realized that ADS is susceptible to loss when the files containing them are moved off NTFS volumes; thus Windows XP stores them in the main stream whenever the file format supports it. Windows Vista discontinued support for adding summary information altogether, as Microsoft decided that they are too sensitive for ADS to handle.[15] But the use of ADS for other purposes did not stop. Service Pack 2 for Windows XP introduced the Attachment Execution Service that stores details on the origin of downloaded files in an ADS called zone identifier, in an effort to protect users from downloaded files that may present a risk.[16] Internet Explorer and Windows 8 extended this function through SmartScreen.[17] Internet Explorer also uses ADS to store favicons in Internet shortcut files.
Solaris version 9 and later allows files to have forks. Forks are called extended attributes in Solaris, although they are not within the usual meaning of "extended attribute". The maximum size of a Solaris-type extended attribute is the same as the maximum size of a file, and they are read and written in the same fashion as files. Internally, they are actually stored and accessed like normal files, so their ownership and permissions can differ from those of the parent file. Sub-directories are administratively disabled, so their names cannot contain "/" characters.
Extended attributes in Network File System Version 4 are similar to Solaris-style extended attributes.
When a file system supports different forks, the applications should be aware of them, or security risks can arise. Allowing legacy software to access data without appropriate shims in place is the primary culprit for such problems.
If the different system utilities (disk explorer, antivirus software, archivers, and so on), are not aware of the different forks, the following problems can arise: