2 Data Hierarchy Computer Hard Disk Drive Partition File Cluster Sector Physical FileLogical FileClusterSectorWordByteBit
3 File Collection of Information written to a disk Generally created in an application-specific formatOccupies a fixed number of clustersEach file’s cluster has a pointer to the next cluster in the fileThe final cluster contains the End of File (EOF) marker
4 Files Logical File Size Physical File Size File Slack Exact size of contents of file in bytesPhysical File SizeAmount of space a file occupies on disc in bytesFile SlackUnused space between logical end of file and physical end of a clusterTwo types: RAM slack and Disk SlackPhysical File Size<- Logical File Size -><- File Slack ->
5 File Slack What does File Slack Contain? Who knows??!! Old data that was deleted but not overwritten yetMay contain remnants of older files, or other evidence includingPasswordsOld directory structuresMiscellaneous information
6 File Slack Example Hello World! Has 12 Characters in the file But occupies 4096 bytes on the disk!
9 File Slack Example RAM Slack Disk Slack The file has only 12 characters, but must write a minimum 512-byte block to the disk – the other 500 characters are whatever happen to be in RAM at the timeDisk SlackThe file system must always write in multiples of clusters (4096 bytes in this case.) The other 3584 bytes (7 sectors) are filled with whatever used to be in the clusters before they were marked for deletion.
10 RAM Slack Unused space at the end of a sector Contains information adjacent to the stored information from Main Memory (RAM)
13 Master Boot Record (MBR) Executable CodeMachine Language CodeProcessor SpecificDecodes Partition Table446 bytes longPartition Table4 EntriesFirst Entry Starts at offset 0x01BEMBR “Signature”0x55AA
14 Partition Table A partition is a logical drive or volume Describes every logical volume on diskMaster Partition TableContains descriptions of partitions on diskRoom to describe 4 primary partitionsOne partition is marked as active and is used for bootingPartition GapUnused space between partitions
15 Partition Boot Sector 0x00-0x02 Jump Instruction (3 bytes) 0x03-0x0A OEM ID (8 Bytes)0x0B-0x53 BIOS Parameter Block (BPB)(includes all below plus additional fields)0x0B Bytes Per Sector 2 Bytes0x0D Sectors Per Cluster 1 Byte0x15 Media Descriptor 1 Byte0x18 Sectors Per Track 2 Bytes0x1A Number of Heads 2 Bytes0x1C Hidden Sectors 4 Bytes0x20 Total Sectors 4 Bytes0x3E-0x1FF Bootstrap Code (448 Bytes)Ends with 55 AANOTE: Offsets are from start of Partition, not start of Drive!
16 Partition Boot Record (PBR) BIOS Parameter BlockExecutable CodeMachine Language CodeProcessor SpecificDecodes BPBSearches for OSPBR “Signature”0x55AA
17 Partition Boot Sector AKA File System Boot Sector The first physical sector in a logical volumeC 0, H 1, S 1 for first partitionContainsCodeFile System Specification Information
20 Computer Boot Process Power-on Signal CPU Reset ROM BIOS/bootstrap POST (Power On Self Test)Memory testSupport circuitryMajor Peripherals (ROM)BootDrive A:CDROMHard DriveMaster Boot Record(Volume) Boot Record
21 Computer Boot Details Power Switch Activated Power Supply performs self-test (PowerGood signal to Motherboard)Microprocessor executes BIOS code starting at 0xFFFF0000 – tests hardwarePower On Self Test (POST) executed – checks CPU, ROM, RAM, support circuitry, peripheralsBIOS searches for MBR at C 0, H 0, S1 on default boot driveMBR loaded into memory and tested/executedMBR code locates first bootable partitionPartition Boot Record is loaded into memory and tested/executedOperating System is loaded based upon command in PBRNTLDRIOSYSOn NTFS volumes NTLDR loads the $MFT; The NT volume is mountedNTDETECT.COM detects computerID, bus adapter, video adapter, …NTLDR loads NTOSKRNL.EXE (kernel) and HAL.DLL (hardware abstraction layer)The kernel initiates the OS