No time this morning to read it, but it's arrived in my inbox and a cursory glance suggests some interesting nuggets in there;
http//
I had a look yesterday - it's obviously a fairly broad overview, so things which might be super interesting to forensicators are missing. For example; what's the upkeep like on deleted entries? Are they marked as "deleted", or is the whole tree over-written?
Having said that, some of what is revealed is very appealing - like the idea of ReFS keeping track of the size of various unallocated areas, as it seems like we may get more contiguous chunks of data.
In any case, given they are only rolling it out for Windows 8 Server File Servers, I suspect it will be a while before you start removing laptop HDDs formatted with it - maybe in Windows 9? )
I think it will be a slow adoption.
As you can't boot from it, it doesn't work for removal drives and isn't supplied with desktop Windows.
Plus they have dropped a whole bunch of NTFS features. These are all gone.
Named streams, object IDs, short names, compression, file level encryption (EFS), user data transactions, sparse, hard-links, extended attributes, and quotas.
Which is sure to create compatibly issues with some apps & companies. Which will also slow deployment.
Even the new things like making path and file names 32,000 characters long will break many apps, preventing them from loading & saving files on ReFS.