bits, bytes, files, hard drives. bits, bytes, letters and words ● bit – single piece of...
TRANSCRIPT
Bits, Bytes, Letters and Words
● Bit – single piece of information● Either a 0 or a 1
● Byte – 8 bits of information● 1 ASCII Character● Letters
● Word is a collection of letters/characters● Is just string of bits.
Tracks, Heads, Sectors
● Heads, Tracks and Sectors– Head is one side of a platter
● Drives usually have 1 or 2 platters, hence 1 – 4 heads
– Track is an narrow ring around a platter● There upwards of 20,000 tracks per inch of
platter.● 3.5” hard drive has 1.2” of platter = 24,000 tracks
– Sector is a pie shaped piece of the platter.● 1” of track can hold about 200,000 bits of
information
● 10 – 40 Gigabits per platter
Sectors
● Each sector has a unique address on the hard drive.
● Each sector is exactly 512 bytes.● Minimum amount that can be read or
written.
Time and Technology
● HDD Addressing– Olden days: head/sector/track
● Worked for small drives
– Today: LBA – Logical Block Address● Capable of addressing Tera bytes of dat
Read – Write
● The computer can access only one sector at a time.
● Must read or write exactly 1 sector (512 bytes).
● To change 1 character in a document:● Read 1 sector● Change the character● Write 1 sector
Logical Structure of a HDD
● The hard drive can be subdivided into partitions or volumes.
● Partition structure is important for the integrity of the drive.
● It can be analyzed by WinHex.● But not for this course
Windows – Drives
● In Windows drives are specified by a letter followed by a colon.
● C:, D:, etc.
● Each drive is either a partition or an actual hard drive.
● Often referred to as logical drives.
Files
● A File is data that is related, as such it is a logical grouping of data.
● Files are allocated storage space on a drive when it is created.
● As a file is used it is allocated more space as needed.
● File names usually have a first name that is descriptive of its contents.
● And a second name, the file extension, that indicates the type of file, such as .txt, .pdf, .exe, etc.
Clusters
● Space is allocated to a file one cluster at a time– A cluster is a fixed number of sectors
● Must be a power of 2 (1,2,4,8, ... 64)– Unused sectors retain the data that
was on them prior to allocation– A cluster is the minimum file allocation
unit
Disk Storage Review
● Data is stored on disks one entire sector at a time– A sector is usually 512 bytes– If you use only one byte, the system
still provides the other 511 bytes for you
– A sector is the minimum size read from, or written to, a disk
– A sector is the minimum I/O unit
Clusters
Sector 1
Sector 2
Sector 3
Sector 4
Cluster 1
Sector 1
Sector 2
Sector 3
Sector 4
Cluster 2
File Data
Sector 1
Sector 2
Sector 3
Sector 4
Cluster 1
Sector 1
Sector 2
Sector 3
Sector 4
Cluster 2
Slack● Slack is the space allocated to a file,
but unused – Space at the end of a sector that remains unused by the
file– Sectors allocated to the file that the file hasn’t yet used
● Slack space often contains useful evidence
– Unused bytes in an allocated sector are less useful– Unused sectors in an allocated cluster retain their original
contents and are very useful
● Current operating systems write 0’s in the slack space per sector, often leaving the residual data in the unused sectors in the allocated cluster.
File Data
Sector 1
Sector 2
Sector 3
Sector 4
Cluster 1
Sector 1
Sector 2
Sector 3
Sector 4
Cluster 2
Slack Space
Slack Space
Unallocated Clusters● Many clusters on a modern hard drive
are unallocated● Some have never contain data● Unallocated clusters may have been
allocated earlier though and since been deleted– These clusters retain their data until they are
reallocated to a new file– Deleted files are still recoverable!
File Systems● High-level formatting creates file system
data structures– Root directory – Data that tracks which clusters are unused,
allowing the OS to find available clusters quickly• File Allocation Table (FAT) on older Windows
systems• $Bitmap in the Master File Table (MFT) on
newer Windows– Exact details depend on operating system
FAT
● FAT – File Allocation Table● Keeps a table of clusters and connects
the ones used for a file and which are unallocated.
● Also keeps a directory in the data area of the partition.
● MAC times● File name● First cluster
– FAT tells the rest of the clusters
File Allocation Table Concepts
Partition 1 Partition 2
FAT File System
ReservedArea FAT Area Data Area
FAT Boot SectorPrimary and Backup FATs
Clusters
FAT
Entry
000 …
002 000
003 004
… …
072 FFF
… …
next cluster
Cluster
001 …
not allocated
004 072 next cluster
end of file
FAT Directories
Partition 1 Partition 2
FAT File System
ReservedArea
FAT Area Data Area
FAT Boot Sector
Primary and Backup FATs
Clusters
Directory Files
Directory Entry
Long File Name
8.3 Filename
File attributes (read only, hidden, system, archive, etc.)
Created time/day
Accessed day
Modified time/day
First cluster address
Size of file (0 for directory)
Deleting a FAT FileDeleting C:taxes.txt
• Find the FAT, and Data areas• Locate taxes.txt in the Directory for C:;
determine its starting cluster• Go to the FAT• Set FAT entries for taxes.txt cluster to 0
• Therefore not allocated
• Follow the links
• Change filename to axes.txt in C: directory– First character becomes 0xE5
WinHex to the Rescue
● Presents the file system● Lets you look at the individual files● Shows files that have been deleted● Attempts to recover deleted files● Gathers slack space
Unallocated Space
● After deleting a file the previously allocated clusters become unallocated.
● They ready to be allocated to some other file.
● They have not been touched.● They still contain the data from the
original file.● You can recover the data so long it hasn’t
been written over by a new file.