Shared Flashcard Set

Details

IS 463 Test 1 Week 4 Digital Forensics Foundation
Disk Volume and Partition Systems
12
Other
Undergraduate 4
09/10/2018

Additional Other Flashcards

 


 

Cards

Term
Volume
Definition
  • A collection of addressable sectors that an Operating System (OS) or application can use for data storage. The sectors in a volume need NOT be consecutive on a physical storage device
  • A hard disk is an example that is located in consecutive sectors
Term
Partition
Definition
  • A collection of consecutive sectors in a volume.
  • By definition, this is also a volume.
  • Is dependent on the operating system and not the type of interface on the hard disk
    • Windows: FAT, NTFS
    • Mac: HFS+
    • Linux: Ext2
  • The purpose is to organize the layout of a volume
    • The starting and ending locations (sectors) for each partition are essential and specified in the PDS
    • The starting and ending sectors do not have boundary information
Term
DOS style partition using MBR
Definition
  • Master Boot Record (MBR) is in the first 512-byte sector of a disk
  • DOS partitions used with DOS, Windows, Linux, and IA32-based FreeBSD and Open BSD systems
  • MBR includes partition table which has four entries. (meaning up to 4 partitions)
  • Each entry has following fields:
    • Starting CHS address (for Windows 98,ME, etc.)
    • Ending CHS address
    • Starting LBA address (for Windows 2000 and beyond)
    • Number of sectors in partition
    • Type of partition (FAT, NTFS, etc., Linux does not care the type)
    • Flags (bootable or not)
Term
DOS Partitions
Definition
  • A primary file system partition is a partition whose entry is in the MBR and the partition contains a file system or other structured data.
  • A primary extended partition is a partition whose entry is in the MBR, and the partition contains additional partitions.

 

  • A secondary file system partition, also called a logical partition in Windows, is located inside the primary extended partition bounds and contains a file system or other structured data.
  • A secondary extended partition is a partition that contains a partition table and a secondary file system partition.
Term
Boot Code in MBR
Definition
  • Exists in the first 446 bytes of the first sector (512-bytes)
  • Standard Microsoft boot code processes the partition table in the MBR and identifies which partition has the bootable flag set.
    • When it finds such a partition, it looks in the first sector of the partition and executes the code found there. The code in the start of the partition will be operating system-specific.
  • Boot sector viruses or Bootkits insert themselves into the first 446 bytes of the MBR so that they are executed every time the computer is booted.
  • Multiple OS boot option code can be either in Boot Code or i the bootable partition
Term
GUID Partition Table (GPT)
Definition
  • BIOS uses MBR (mostly) -> getting obsolete
  • Extensible Firmware Interface (EFI) and Unified EFI (UEFI) replaces BIOS
  • EFI and UEFI use GPT instead of MBR
  • EFI/UEFI is used mainly in systems with 64 bit Intel processors
  • GUID stands for Globally Unique ID
  • can support up to 128 partitions and uses 64-bit LBA addresses

 

Term
5 Areas in GPT Disk
Definition
  • Protective MBR
    • contains a DOS partition table with one entry. The single entry is for a partition with a type of 0xEE that spans the entire disk
    • This partition exists so that legacy computers can recognize the disk as being used and do not try to format it
    • EFI does not actually use partitions, though
  • GPT header
    • starts in sector 1 (typically fits in 1 sector)
    • defines the size and location of the partition table, which are fixed when the GPT disk is created
    • Windows limits the number of entries in the partition table to 128
    • also contains a checksum of the header and the partition table so that errors or modification can be detected
  • Partition table
    • Each entry contains a starting and ending address, a type value, a name, attribute flags, and a GUID value.
    • The 128-bit GUID is supposed to be unique for that system and is set when the partition table is created
  • Partition Area
    • The largest area and contains the sectors that will be allocated to partitions
    • The starting and ending sectors for this area (not the each partition area) are defined in the GPT header
  • Backup area
    • Contains a backup copy of the partition table and the GPT header (in this order, meaning a backup copy of the GPT header is the last sector of the GPT). It is located in the sector following the Partition area
Term
Protective MBR
Definition
  • Contains a DOS partition table with one entry. The single entry is for a partition with a type of 0xEE that spans the entire disk
  • This partition exists so that legacy computers can recognize the disk as being used and do not try to format it
  • EFI does not actually use partitions, though
Term
Protective MBR: GPT header
Definition
  • starts in sector 1 (typically fits in 1 sector)
  • defines the size and location of the partition table, which are fixed when the GPT disk is created
  • Windows limits the number of entries in the partition table to 128
  • also contains a checksum of the header and the partition table so that errors or modification can be detected
Term
Protective MBR: Partition table
Definition
  • Each entry contains a starting and ending address, a type value, a name, attribute flags, and a GUID value.
  • The 128-bit GUID is supposed to be unique for that system and is set when the partition table is created
Term
Protective MBR: Partition Area
Definition
  • The largest area and contains the sectors that will be allocated to partitions
  • The starting and ending sectors for this area (not the each partition area) are defined in the GPT header
Term
Backup area
Definition
  • Contains a backup copy of the partition table and the GPT header (in this order, meaning a backup copy of the GPT header is the last sector of the GPT). It is located in the sector following the Partition area
Supporting users have an ad free experience!