Storing Data on a Computer

Question 1

HDD

Answer 1

Hard Disk Drive - a storage device that consists of stacked rotating platters on a spindle. The platters are covered by small amounts of magnetic metal used to represent a 1 or 0. A head passes over the platter that can detect changes in magnetic charge in order to read and write. Hard disks can rotate at 7200 revolutions per minute, though outer areas move faster. When data is removed, it stays on the disk until it is overwritten. HDDs are fragile and slower than SSDs due to moving parts.

Question 2

File System

Answer 2

A program run by the OS which dictates how to read and write from a disk, and stores the location of the files stored on the disk.

Question 3

Formatting (Storing Data)

Answer 3

The process of preparing any type of disk drive so that data can be written to it. One partition of a disk will be loaded with the correct file system, and some formatting procedures can check for errors or viruses.

Question 4

Partition (Storing Data)

Answer 4

A section of a disk. Some disks may only have one.

Question 5

Track (Storing Data)

Answer 5

A part of a disk partition which contains data, sometimes called a ring.

Question 6

Sector (Storing Data)

Answer 6

A part of a disk track, numbered and all of equal size.

Question 7

Cluster (Storing Data)

Answer 7

A collection of one or more sectors of a track. During writing, the needed number of clusters are allocated.

Question 8

FAT

Answer 8

File Allocation Table - an area on a hard disk that is used as an index for every cluster on the disk and whether it is in use.

Question 9

NTFS

Answer 9

New Technology File System - a modern file system that uses a MFT to store the indexes of every cluster on a disk and if they are in use, similar to FAT. It is used by windows computers.

Question 10

MFT

Answer 10

Master File Table - a table of cluster indexes and whether they are in use, used by NTFS.

Question 11

Unallocated Space (Storing Data)

Answer 11

The space on a disk available for data to be stored in.

Question 12

Logical Size

Answer 12

The measure of the number of bytes a file can actually contain.

Question 13

Physical Size

Answer 13

The measure of the maximum number of bytes a file can contain, though this can practically almost never be met.

Question 14

Slack Space

Answer 14

The difference in physical and logical size.

Question 15

Latent Data

Answer 15

A term for data on a hard disk which has previously been ‘removed’ from the disk before being partially overwritten, sometimes known as ambient data.

Question 16

Overwriting (Storing Data)

Answer 16

The process of filling every part of a disk with zeros or a random mix of binary to remove traces of previous data. It is also known as wiping or shredding.

Question 17

Degaussing

Answer 17

The use of a powerful magnetic field to erase all data on a hard disk. It is expensive, but disks can be re-used once wiped.

Question 18

Fragmentation

Answer 18

A process which involves writing clusters elsewhere on a disk when there is insufficient space, thus slowing performance.

Question 19

Defragmentation

Answer 19

A process where clusters located in different tracks not adjacent to each other are rearranged to make disk reading faster.

Question 20

SSD

Answer 20

Solid State Drive - a form of memory which contains an integrated circuit to store data. The type of memory it uses is known as flash memory. It is often used in USB sticks or as an alternative to HDD. Data is split into clusters and logical sectors similarly to HDD, though SSD is less fragile, faster, has a longer battery life, and keeps consistent performance after fragmentation - for a higher price.

Question 21

Flash Memory

Answer 21

A solid-state chip that maintains stored data without requiring an external power source, used in SSDs. They consist of numerous electrically insulated boxes which act as memory cells. When a charge is applied, electrons give it a slight negative charge, and are stored even when powered off. Over time, insulation degrades, making it unusable.

Question 22

Wear Levelling

Answer 22

A function performed by software that controls where files are saved. It ensures that each time a file is changed, it is written to a differing location selected at random to minimise wear on insulation.

Question 23

TRIM

Answer 23

An SSD control software that uses time to locate and initialise unreferenced file fragments and empty space for overwriting.

Question 24

ATA Secure Erase

Answer 24

An SSD control software that resets memory by applying a strike of voltage.

Question 25

Write Blocker

Answer 25

A piece of software that makes a disk read-only as not to damage or change the contents.

Question 26

Hash Code (Storing Data)

Answer 26

A value calculated from the 0s and 1s on a disk. The hash code from an original disk and disk image should match to ensure the copy is completely true and forensically sound. One method of finding a hash code essentially sums the ASCII representations of values on a disk multiplied by a weight, sometimes finding the modulus to shorten this number.

Question 27

Disk Image

Answer 27

A copy of the contents of a disk.

Question 28

Dead System Imaging

Answer 28

The process of copying the contents of a disk to a disk image, essentially removing a hard disk from a switched off computer.

Question 29

Hash Code Collision (Storing Data)

Answer 29

The occurrence of two or more generated hash codes, originating from different files, being identical. Hash code algorithms are often designed to minimise these.

Question 30

Image Mounter

Answer 30

A software that allows the OS to read (and write, if needed) to a disk image.

Question 31

Metadata

Answer 31

Data that gives information about a file, such as name, size, path, timestamps, and file type. Timestamps give information on when a file was created, modified, or deleted.

Question 32

System Log

Answer 32

A log file of events on a device, such as logins, system changes, and more.

Question 33

Soft Delete

Answer 33

A method of deleting an object by moving it to the ‘recycle bin’, so that it is not fully removed. This creates a $I file, which contains metadata, and $R file. The $I file can be used to locate data using offsets.

Question 34

Hard Delete

Answer 34

A method of deleting an object by emptying the recycle bin, removing the $I file and all references to the $R file.

Question 35

Magic Number (Storing Data)

Answer 35

A set of bits in the header of a file that indicate the type of file.

Question 36

Hex Editor

Answer 36

A software that can read and manipulate binary data in a file.

Question 37

File Carving Software

Answer 37

A form of software that finds a file format from a database of magic numbers (and, additionally, checks the contents of the file to ensure they match with the expected type) before locating the footer and using this to recover the file as intended. It is sometimes known as data carving software.

Question 38

RAM Dump

Answer 38

A file containing all information stored on a system before a major process.

Question 39

Munge

Answer 39

An alphabetic character replaced by a special character (such as ‘a’ for ‘@’).

Question 40

Registry Hive

Answer 40

A space within the registry area (used to store lowest-level OS settings) created each time a user logs on to a computer that stores information about their profile, settings, desktop, and more.

Question 41

Enhanced Metafile

Answer 41

A file representing an image to be printed. A file carver software can extract data from it.

Question 42

Steganography

Answer 42

A method of hiding data within other data so that it cannot be easily detected. One method of steganography involves changing the last two bits of every byte to encode a message.