Module 03 - Logical Structure of a Disk

What is the file system and software utilized to control access to the storage on the disk?

The logical structure of a hard disk

True or False: The logical structure of the hard disk directly influences the consistency, performance, compatibility, and expandability of the storage subsystems of the hard disk?

True

What are the smallest accessible storage units on a hard disk?

Clusters

What are formed by combining sectors to ease the process of handling files?

Clusters

Also called allocation units, ___________ are sets of tracks and sectors ranging from cluster number 2 to 32 or higher, depending on the formatting scheme.

Clusters

The process by which files are allocated to clusters is called______; therefore, _________ are also known as allocation units

Allocation and Clusters

Every ________ is a continuous chunk of space on the hard disk.

Cluster

In a _________, when the file system stores a file smaller than the cluster size, the extra space gets wasted and is called slack space.

Cluster

What has a significant impact on the performance of an OS and disk utilization?

Cluster sizing

What determines the size of a cluster, and larger volumes use larger cluster sizes? The system can change the cluster size of an existing partition to enhance performance

Disk partitioning

A large cluster size (greater than one sector) has which of the follwing effects?

Minimizes the fragmentation problem

A large cluster size (greater than one sector) has which of the follwing effects?

Increases the probability of unused space in the cluster

A large cluster size (greater than one sector) has which of the follwing effects?

Reduces the disk storage area in which information can be saved

A large cluster size (greater than one sector) has which of the follwing effects?

Reduces the unused area on the disk

What is a File Allocation Table (FAT) error that occurs when the OS marks clusters as used but does not allocate any file to them?

Lost cluster

What is mainly the result of a logical structure error and not a physical disk error?

Lost cluster

What occurs when the user does not close files properly or shuts down a computer without closing an application? These errors also occur owing to disk corruptions such as bad drivers and resource conflicts.

Lost clusters

True or False: Disk-checking programs can examine a complete disk volume for lost clusters. To detect lost clusters, one can use a program that can save them as a file or clear them.

True

What is a system tool in Windows that authenticates the file system reliability of a volume and repairs logical file system errors?

CHDSK

Which of the following Disk-checking programs can scan the computer system for lost clusters from a certain procedure?

A duplicate copy is generated in the memory of FAT while noting all of the clusters marked as “in use.”

Which of the following Disk-checking programs can scan the computer system for lost clusters from a certain procedure?

Beginning from the root directory, the clusters utilized by a file are traced and marked as “accounted for” to connect them to the file. This procedure is repeated for all the subdirectories.

Which of the following Disk-checking programs can scan the computer system for lost clusters from a certain procedure?

Lost clusters or “orphan” clusters are marked in the FAT as being used but have no link to any file.

What is a built-in Windows utility that helps detect errors in the file system and disk media?

Chkdsk.exe or Check Disk

What should be used in the case of issues such as blue screens and difficulty to open or save files or folders? This utility also checks for bad sectors and lost clusters.

Check Disk utility

List the steps to use the command-line version of the Check Disk utility.

Open Command Prompt by typing cmd in the Run utility, Enter chkdsk in Command Prompt to run the Check Disk utility in the, read-only mode, After completing a scan, the Check Disk utility will display the status of the current drive

What is the wasted area of a disk cluster lying between the end of a file and the end of the cluster; it is created when the file system allocates a full cluster to a file smaller than the cluster size?

Slack space

Which of the following slack types is the data storage space that starts from the end of a file to the end of the last sector of the file?

RAM slack

Which of the following slack types is the data storage space that starts from the end of the last sector of a file to the end of the last cluster of the file?

Drive slack

Often, _______ can contain relevant suspect information required by a prosecutor to present as evidence in court.

Slack space

What refers to a hard disk’s first sector or sector zero, which specifies the location of an OS for the system to load into the main storage?

Master Boot Record (MBR)

What is also called the partition sector or master partition table as it contains a table that locates partitioned disk data. A program in the record loads the rest of the OS into the RAM?

Master Boot Record (MBR)

What file contains information about various files present on the disk, their locations, and sizes. In practice, _______ almost always refers to the 512- byte boot sector or partition sector of a disk?

Master Boot Record (MBR)

What is the Master Boot Record (MBR) used for?

Holding a partition table which refers to the partitions of a hard disk

What is the Master Boot Record (MBR) used for?

Bootstrapping an OS

What is the Master Boot Record (MBR) used for?

Distinctively recognizing individual hard disk media with a 32-bit disk signature

The Master Boot Record (MBR) consists of which of the following structures?

Partition Table

The Master Boot Record (MBR) consists of which of the following structures?

Master Boot Code

What is a 64-byte data structure that stores information about the types of partitions present on the hard disk and their locations?

Partition Table

What table has a standard layout that does not depend on the OS and is capable of describing only four partitions, which are primary or physical partitions? All other partitions are logical partitions linked to one of the primary partitions.

Partition Table

What is a small piece of computer code that the system loads into the BIOS and executes to initiate the system’s boot process?

Master Boot Code

Which of the following does the master boot code implement a function?

Examines the partition table to find the active partition

Which of the following does the master boot code implement a function?

Locates the first sector of the active partition

Which of the following does the master boot code implement a function?

Loads a boot sector copy from the active partition into memory

Which of the following does the master boot code implement a function?

Transfers control to the executable code in the boot sector

The structure of a Master Boot Record (MBR) consists of three parts. Which of the following is one of the three parts?

Master Boot Code or Boot Strap

The structure of a Master Boot Record (MBR) consists of three parts. Which of the following is one of the three parts?

Partition Table

The structure of a Master Boot Record (MBR) consists of three parts. Which of the following is one of the three parts?

Disk Signature

What part of the structure of the Master Boot Record (MBR) is an executable code and responsible for loading OS into computer memory and consists of a data structure of 446 bytes?

Master Boot Code or Boot Strap

What part of the structure of the Master Boot Record (MBR) maintains the data of all the hard disk partitions and consists of a data structure 64 bytes?

Partition Table

What part of the structure of the Master Boot Record (MBR) is located at the end of the MBR and contains only 2 bytes of data and is required by BIOS during booting?

Disk signature

In UNIX/Linux, the ____ command helps create backups and restore Master Boot Record (MBR).

dd

What is the creation of logical divisions on a storage device (HDD/SSD) to allow the user to apply OS-specific logical formatting?

Disk partitioning

What refers to the creation of logical drives for effective memory management, and a partition is a logical drive for storing data?

Partitioning

What allows an investigator to access these hidden or vacant areas of the disk?

Disk Editor

Partitions have two types, which of the following is one of the two?

Primary partition

Partitions have two types, which of the following is one of the two?

Extended partition

Which of the following partition type is the drive that holds information regarding the OS, the system area, and other information required for booting? In MS-DOS and earlier versions of Microsoft Windows systems, the first partition (C:) must be a primary partition.

Primary partition

Which of the following partition type is the logical drive that holds information regarding the data and files stored on the disk?

Extended partition

Which of the following tools are available for examining disk partitions to view file headers and important information about files?

Disk Edit

Which of the following tools are available for examining disk partitions to view file headers and important information about files?

WinHex

Which of the following tools are available for examining disk partitions to view file headers and important information about files?

Hex Workshop

What is data structure situated at sector 1 in the volume boot record (VBR) of a hard disk and explains the physical layout of a disk volume?

BIOS Parameter Block (BPB)

What describes the physical layout of a data storage volume, such as the number of heads and the size of the tracks on the drive?

BIOS Parameter Block (BPB)

______ in file systems such as FAT12 (except in DOS 1.x), FAT16, FAT32, HPFS (High Performance File System), and NTFS (New Technology File System) defines the filesystem structure.

BIOS Parameter Block (BPB)

What assists investigators to locate the file table on the hard drive?

BIOS Parameter Block (BPB)

What is a 128-bit unique number generated by the Windows OS for identifying a specific device, a document, a database entry, and/or the user?

Globally Unique Identifier (GUID)

In general, _________ are displayed as 32 hexadecimal digits with groups separated by hyphens.

Globally Unique Identifier (GUID)

Which of the following is a common use for Globally Unique Identifiers (GUID)?

GUIDs are used to identify COM (Component Object Model

Which of the following is a common use for Globally Unique Identifiers (GUID)?

In database tables, GUIDs are used as primary key values

Which of the following is a common use for Globally Unique Identifiers (GUID)?

In some instances, a website may assign a GUID to a user’s browser to record and track the session

Which of the following is a common use for Globally Unique Identifiers (GUID)?

Windows assigns a GUID to a username to identify user accounts

True or False: The Windows OS assigns a GUID to the registry for recognizing Component Object Model (COM) dynamic-link libraries (DLLs) as well as to user accounts by username (domain).

True

What is a standard partitioning scheme for hard disks and a part of the Unified Extensible Firmware Interface (UEFI), which replaces legacy BIOS firmware interfaces?

Globally Unique Identifier (GUID)

What replaces legacy BIOS firmware interfaces?

Unified Extensible Firmware Interface (UEFI)

What assigns 16,384 bytes for the Partition Entry Array. Since the disk has 512-byte sectors with a partition entry array of 16,384 bytes and a minimum size of 128 bytes for each partition entry, LBA 34 is the first usable sector?

Unified Extensible Firmware Interface (UEFI)

Which of the following are advantages of the GUID Partition Table GPT disk layout?

Supports a maximum partition size ranging from 2 Tebibytes (TiB) to 8 Zebibytes (ZiB)

Which of the following are advantages of the GUID Partition Table GPT disk layout?

It allows users to have 128 partitions in Windows using the GPT partition layout

Which of the following are advantages of the GUID Partition Table GPT disk layout?

GPT partition and boot data are more secure than MBR because GPT stores data in multiple locations across a disk

Which of the following are advantages of the GUID Partition Table GPT disk layout?

Provides primary and backup partition tables for redundancy

Which of the following are advantages of the GUID Partition Table GPT disk layout?

It uses cyclic redundancy checks (CRCs) to ensure data integrity

Which of the following are advantages of the GUID Partition Table GPT disk layout?

Uses CRC32 checksums that detect errors in the header and partition table