Check out the new USENIX Web site.

Strong fault boundaries

It is difficult for corruption in one chunk to cause corruption in another chunk, since no allocation bitmaps are shared and continuation inodes require agreement about forward and back pointers from the associated inode in the separate chunk. If pointers do disagree and can't be repaired, the consequences for the continuation inode in the uncorrupted chunk are at worst orphaning and a move to the lost and found directory.

Valerie Henson 2006-10-18