Question

I’m developing a document based desktop app which writes a fairly large and complex file to disk when the user saves his document. What is the best practice to do here to prevent data corruption? There are a number of things that can happen:

The save process may fail half way, which is of course a serious application error, but in this case one would rather have the old file left than the corrupted half-written file. The same problem will occur if the application is terminated for some other reason half way through the file writing.

The most robust approach I can think of is using a temporary file while saving and only replace the original file once the new file has been successfully created. But I find there are several operations (creating tempfile, saving to tempfile, deleting original, moving tempfile to original) that may or may not fail, and I end up with quite a complicated mess of try/catch statements to handle them correctly.

Is there a best practice/standard for this scenario? For example is it better to copy the original to a temp file and then overwrite the original than to save to a temp file?

Also, how does one reason with the state of a file in a document based application (in windows)? Is it better to leave the file open for writing by the application until the user closes the document, or to just quickly get in an read the file on open and quickly close it again? Pros and cons?

Answer 1

Typically the file shuffling dance goes something like this, aiming to end up with file.txt containing the new data:

• Write to file.txt.new
• Move file.txt to file.txt.old
• Move file.txt.new to file.txt
• Delete file.txt.old

At any point you always have at least one valid file:

• If only file.txt exists, you failed to start writing file.txt.new
• If file.txt and file.txt.new exist, you probably failed during the write – file.txt should be the valid old copy. (If you can validate files, you could try loading the new file – it could be the move that failed)
• If file.txt.old and file.txt.new exist, the second move operation failed. You can use either file, depending on whether you want new or old
• If file.txt.old and file.txt exist, the delete operation failed. Again, you can use either file.

This is assuming you’re on a file system with an atomic move operation. If that’s not the case, I believe the procedure is the same but you’d need to be more careful about the recovery procedure.