Copy-on-Write File Systems

Every file system faces a fundamental challenge: how do you safely modify data on disk?

Consider what happens when you save a document. The file system must update the file's data blocks, modify the inode's timestamp and size, potentially update directory entries, and adjust free space tracking metadata. If power fails mid-operation—or the system crashes—you risk leaving the disk in an inconsistent state: partial writes, orphaned blocks, corrupted metadata, or worse.

Traditional file systems address this through various strategies:

• fsck (file system check) repairs damage after crashes—often slowly and imperfectly
• Journaling records intentions before modifications—but still modifies data in-place
• Soft updates carefully orders writes—but adds significant complexity

Each approach attempts to solve the same underlying problem: in-place updates are inherently dangerous. When you overwrite existing data, there's always a window where both the old and new states are incomplete.

To truly appreciate Copy-on-Write, we must first understand why in-place updates are problematic. Traditional file systems—ext4, NTFS, HFS+—follow a fundamental pattern: when data changes, they modify the existing disk blocks directly.

The anatomy of an in-place update:

Imagine modifying a 4KB block in a file. The traditional approach:

1. Read the block from disk into memory
2. Modify the in-memory copy
3. Write the modified block back to the same disk location
4. Update metadata (timestamps, sizes, etc.)

This seems straightforward—but consider what happens if the system fails at step 3. The disk block might contain:

• Only the first portion of new data (partial write)
• A mix of old and new data (torn write)
• Corrupted data if the write was interrupted

The original data is gone, and the new data is incomplete. There's no way to recover.

The corruption cascade:

The problem extends beyond individual blocks. File systems maintain complex relationships:

• Inodes point to data blocks
• Directories point to inodes
• Free space bitmaps track available blocks
• Superblocks describe the overall structure

When any of these structures is partially updated, the ripple effects can be catastrophic:

• A partially updated inode might point to freed blocks (now containing other files' data)
• A corrupted directory entry might reference a non-existent inode
• An inconsistent free space bitmap might cause the same block to be allocated twice

This is why fsck exists—and why it can take hours to run on large file systems. It must examine every structure, detect inconsistencies, and attempt repairs that often result in data loss.

Copy-on-Write (COW) takes a radically different approach: never overwrite existing data. Instead of modifying blocks in-place, COW file systems always write to new, unused locations.

The COW write operation:

1. Read the existing block(s) into memory
2. Make modifications in memory
3. Write the modified data to a new disk location
4. Update parent pointers to reference the new location
5. Only then, mark the old location as free

The crucial difference: until step 4 completes atomically, the old data remains intact. If the system crashes at any point before the final atomic pointer update:

• Before step 3 completes: Old data is still valid, new data hasn't been committed
• During step 4: Either the old pointer or new pointer is valid—never a partial state
• After step 4: New data is committed, old data can be freed

There is no window of vulnerability. At every instant, the file system is in a consistent state.

The atomic pointer update:

The magic of COW lies in how it commits changes. Instead of updating multiple structures individually, COW file systems use a single atomic operation to switch between states.

In most COW file systems, this is accomplished through a root pointer (often called the überblock in ZFS or superblock in btrfs):

1. Build the entire new state in unused disk space
2. Update the root pointer atomically (a single sector write)
3. The entire file system transitions from old state to new state

This atomic transition is typically achieved by:

• Writing the new root pointer
• Using checksums to verify which root is valid
• Maintaining multiple copies of the root for redundancy

The disk hardware guarantees that a single sector write either completes fully or not at all—there's no partial sector write. By reducing all changes to a single pointer update, COW eliminates partial states entirely.

COW file systems typically organize data using tree structures, often resembling Merkle trees (hash trees). This design is not coincidental—it's essential for efficient COW operations.

Why trees work for COW:

Consider a file system organized as a tree:

• Root node: Points to top-level structures
• Internal nodes: Directories, indirect blocks, metadata
• Leaf nodes: Actual file data blocks

When you modify a leaf node in a COW tree:

1. Write the new leaf data to a new location
2. The parent node's pointer must change → write a new parent
3. The grandparent's pointer must change → write a new grandparent
4. Continue up to the root
5. Atomically update the root pointer

This is called path copying—you copy the path from the modified leaf to the root. Importantly, unchanged subtrees are shared between the old and new states.

Block sharing and efficiency:

In the diagram above, modifying File 1 requires:

• Writing a new File 1 data block
• Writing a new Dir A pointer block
• Writing a new Root pointer block

But Dir B and File 2 are unchanged and shared. The new state simply points to the same disk blocks. This sharing is fundamental to COW efficiency:

The logarithmic write amplification is the price of consistency. For typical file systems where tree depth is 3-5 levels, this means 3-5 blocks written per modification—a very reasonable overhead.

One of COW's most powerful properties is transaction atomicity. Because all changes are staged in new locations before committing via a root pointer update, COW naturally supports transactions spanning multiple files and metadata operations.

Transaction groups:

Modern COW file systems batch multiple operations into transaction groups (TXG in ZFS terminology):

1. Open phase: Accumulate modifications in memory
2. Quiesce phase: Stop accepting new modifications to this group
3. Sync phase: Write all modified data to new disk locations
4. Commit phase: Atomically update the root pointer

Until the commit phase completes, none of the modifications in the transaction group are visible. Either all modifications commit together, or none do. This provides all-or-nothing semantics that are incredibly valuable:

• Moving a file between directories: Either both the removal from source and addition to destination complete, or neither does
• Updating multiple related files: All files reflect the new state, or all reflect the old state
• Metadata and data consistency: Impossible to have data without metadata or vice versa

The copy-on-write contract:

COW file systems provide a fundamental guarantee that can be stated simply:

At any instant, the on-disk state represents a valid, complete point-in-time view of the file system.

There are no intermediate states. The transition from one valid state to the next is atomic. This guarantee holds regardless of:

• System crashes
• Power failures
• Kernel panics
• Hardware issues (to the extent checksums can detect them)

This is a dramatically stronger guarantee than journaling provides. Journaling ensures you can recover to a consistent state; COW ensures you never leave a consistent state.

Copy-on-Write's "never overwrite" philosophy creates a unique challenge: dead data accumulates. When you modify a block, the old version isn't immediately freed—it remains on disk until the system confirms it's no longer needed.

Why immediate freeing is dangerous:

In a COW system, consider this sequence:

1. Block A is modified → New block A' is written
2. System starts to update root pointer to reference A'
3. Crash occurs before root update completes
4. After reboot, system uses old root → Block A is the valid version

If we had freed block A immediately after writing A', the file system would be corrupted after the crash. We'd have a root pointing to freed space.

The solution: Reference counting and garbage collection

COW file systems track references to each block:

• A block with zero references is dead (garbage)
• A block with one reference is live (active)
• A block with multiple references is shared (clones/snapshots)

Garbage collection runs periodically or continuously, identifying and reclaiming dead blocks.

Space amplification considerations:

COW file systems experience write amplification (more data written than changed) and potentially space amplification (more space used than traditional file systems for the same data). Understanding these effects is crucial:

Most COW file systems recommend keeping 10-20% free space for efficient operation. As the file system fills, garbage collection becomes more expensive and performance degrades.

The Copy-on-Write concept didn't emerge in isolation. It evolved from decades of research in databases, virtual memory systems, and version control. Understanding this history illuminates why COW works so well.

Origins in virtual memory:

The term "copy-on-write" first appeared in virtual memory systems during the 1970s. When a Unix process calls fork(), the child process traditionally needed a complete copy of the parent's address space. Early systems duplicated every page—expensive for large processes.

COW optimization changed this:

1. Mark all parent pages as read-only
2. Child shares the same physical pages
3. Only copy a page when either process writes to it

This same principle—defer copying until modification—forms the foundation of COW file systems.

Database influence:

Database systems pioneered many techniques later adopted by COW file systems:

• Write-ahead logging (WAL): Databases log changes before applying them
• MVCC (Multi-Version Concurrency Control): Keep old versions for concurrent readers
• Shadow paging: Write changes to new locations, atomically swap page tables

COW file systems essentially bring database-grade transactional semantics to general-purpose storage.

The ZFS watershed moment:

ZFS, developed at Sun Microsystems and released in 2005, represented a paradigm shift. It wasn't just a file system—it was a complete storage stack:

1. Pooled storage: Multiple devices presented as a single pool
2. Integrated volume management: No separate LVM needed
3. End-to-end checksums: Data integrity from application to disk
4. Native snapshots and clones: Zero-cost point-in-time copies
5. Built-in compression and deduplication: Storage efficiency
6. Self-healing: Automatic repair using redundancy

ZFS proved that COW could power enterprise storage at scale, handling petabytes of data while maintaining integrity guarantees that traditional file systems couldn't match.

The modern landscape:

Today, COW file systems are standard in many environments:

• Enterprise storage: ZFS, btrfs, WAFL power critical infrastructure
• Consumer devices: APFS on every Apple device since 2017
• Cloud infrastructure: Copy-on-write principles underpin object storage
• Containers: Copy-on-write enables efficient container layering

The question is no longer "should we use COW?" but "which COW file system best fits our needs?"

To cement our understanding, let's directly compare COW file systems with the alternatives, examining specific technical characteristics:

Consistency mechanisms compared:

Write path comparison:

Let's trace what happens when writing 4KB to the middle of a file in each system:

We've explored the Copy-on-Write concept from first principles. Let's consolidate the essential understanding:

The transformative insight:

Copy-on-Write transforms file system consistency from a problem to be solved into a property guaranteed by construction. Instead of asking "how do we recover from inconsistent states?", COW asks "how do we ensure we never enter an inconsistent state?"

The answer—never overwrite, always copy, commit atomically—is elegant in principle and powerful in practice.

Looking ahead:

With the fundamental COW concept established, we're ready to explore its most revolutionary capability: snapshots. In the next page, we'll see how COW enables instant, space-efficient point-in-time copies that would be impossible with in-place update systems.