Cengage Chapter 5 - Working with Windows and CLI Systems Flashcards
Ways in which data can be appended to a file (intentionally or not) and potentially obscure evidentiary data. In NTFS, _______________________ become an additional file attribute.
alternate data streams
An 8-bit coding scheme that assigns numeric values to up to 256 characters, including letters, numerals, punctuation marks, control characters, and other symbols.
American Standard Code for Information Interchange (ASCII)
The number of bits per square inch of a disk platter.
areal density
In NTFS, an MFT record field containing metadata about the file or folder and the file’s data or links to the file’s data.
attribute ID
A file that specifies the Windows path installation and a variety of other startup options.
Boot.ini
If a machine has multiple booting OSs, NTLDR reads this hidden file to determine the address (boot sector location) of each OS. See also NT Loader (Ntldr).
BootSect.dos
Information stored in ROM that a computer accesses during startup; this information tells the computer how to access the OS and hard drive.
bootstrap process
Storage allocation units composed of groups of sectors. __________ are 512, 1024, 2048, or 4096 bytes each.
clusters
A column of tracks on two or more disk platters.
cylinder
Cluster addresses where files are stored on a drive’s partition outside the MFT record. __________ are used for nonresident MFT file records. A ___________ record field consists of three components; the first component defines the size in bytes needed to store the second and third components’ content.
data runs
Files containing instructions for the OS for hardware devices, such as the keyboard, mouse, and video card.
device drivers
Unused space in a cluster between the end of an active file and the end of the cluster. It can contain deleted files, deleted e-mail, or file fragments. Drive slack is made up of both file slack and RAM slack. See also file slack and RAM slack.
drive slack
A public/ private key encryption first used in Windows 2000 on NTFS-formatted disks. The file is encrypted with a symmetric key, and then a public/private key is used to encrypt the symmetric key.
Encrypting File System (EFS)
The original Microsoft file structure database. It’s written to the outermost track of a disk and contains information about each file stored on the drive. PCs use the FAT to organize files on a disk so that the OS can find the files it needs. The variations are FAT12, FAT16, FAT32, VFAT, and FATX.
File Allocation Table (FAT)
The unused space created when a file is saved. If the allocated space is larger than the file, the remaining space is slack space and can contain passwords, logon IDs, file fragments, and deleted e-mails.
file slack
The way files are stored on a disk; gives an OS a road map to data on a disk.
file system
A disk drive’s internal organization of platters, tracks, and sectors.
geometry
The Hardware Abstraction Layer dynamic link library allows the OS kernel to communicate with hardware.
Hal.dll
The device that reads and writes data to a disk drive.
head
A method manufacturers use to minimize lag time. The starting sectors of tracks are slightly offset from each other to move the read-write head.
head and cylinder skew
The file system IBM uses for its OS/2 operating system.
High Performance File System (HPFS)
In Windows NT through Vista, the control file for the Recycle Bin. It contains ASCII data, Unicode data, and date and time of deletion.
Info2 file