We describe the DEcorum file system, a distributed file system designed for high performance, low network load, easy operation and administration, and interoperability with other file systems. The DEcorum file system has three components: the DEcorum protocol exporter (or file server); the Episode physical file system; and the DEcorum client (or cache manager). Episode is a module that implements the Vnode/VFS interface, using transaction logging to allow fast recovery from crashes. To be exact, it implements a VFS+ interface: extensions to the standard Vnode and VFS interfaces, and two new modules, aggregates and volumes, which give flexibility beyond what is provided by Unix partitions to support administration and operation of networks of thousands of workstations. The DEcorum protocol exporter provides remote access to the Episode physical file system via remote procedure calls (RPC’s). It can export access to other physical file systems, such as the Berkeley fast file system, using extensions of the physical file systems to support the VFS+ interface. The DEcorum client exports a Vnode interface, but obtains its data by making RPC’s to a DEcorum protocol exporter. It caches data from the file server. To synchronize accesses to files, preserving single-system UNIX semantics, it relies on typed tokens obtained with the data: guarantees provided by the server that various operations can be performed remotely. Tokens can be revoked by the file server using separate RPC’s. A locking hierarchy is used to avoid deadlock between clients accessing files and servers revoking tokens on the same files; we explain the hierarchy and informally sketch a proof of its correctness. History and Motivation The DEcorum file system is a component of a larger system, the DEcorum Distributed Computing Environment (DCE). The DEcorum architecture was jointly developed by Hewlett-Packard, IBM, Locus Computing, and Transarc. The DEcorum file system component is a follow-on of AFS (formerly the Andrew file system).1 The DCE is built as a layered architecture from modular components. The file system utilizes a collection of modular components, including Hewlett-Packard’s NCS 2.02 remote procedure call facility, Hewlett-Packard’s PasswdEtc 1 Alfred Z. Spector and Michael L. Kazar, ‘‘Uniting File Systems,’’ Unix Review, March 1989. 2 NCS 2.0 adds support for pipes (streaming), long-haul operation, authentication, and connection-oriented transport to NCS 1.5