Shared Flashcard Set

Details

1-Computer Forensics || Week 4
1-Computer Forensics || Week 4
75
Computer Science
Undergraduate 4
09/11/2018

Additional Computer Science Flashcards

 


 

Cards

Term
Little Endian
Definition
The bytes are processed in reverse order.
Term
Big Endian
Definition
The bytes are processed in the order presented.
Term
What is always processed in Big Endian?
Definition
ASCII
Term
In Little Endian, do you flip the order of the individual bits in a single byte?
Definition
No, each byte stays the same, they are just processed in reverse order.

1A00 becomes 001A, not 00A1.
Term
What is the smallest unit address on a disk?
Definition
A sector
Term
How many bytes is a sector, unless otherwise specified?
Definition
512 bytes
Term
What is a volume?
Definition
Collection of addressable sectors than an OS or app can use for data storage.
Term
Do sectors in a volume need to be consecutive on a physical storage device?
Definition
No
Term
What is an example of a volume that is located in consecutive sectors?
Definition
Hard disk
Term
What is a partition?
Definition
A collection of consecutive sectors in a volume.
Term
What is a partition dependent on?
Definition
The operating system
Term
What is a partition system not dependent on?
Definition
The type of interface on the hard disk
Term
By definition a partition is also a what?
Definition
Volume
Term
What is the purpose of a partition system?
Definition
To organize the layout of a volume.
Term
The starting and ending sectors for each partition are essential and specified where?
Definition
In the partition data structure.
Term
The starting and ending sectors of a partition do not have what type of information?
Definition
Boundary
Term
What is a byte?
Definition
A pair of bits.
Term
What is an invalid partition?
Definition
A partition inside of another partition, or a partition that overlaps with another partition.
Term
What is a Master Boot Record?
Definition
The first 512-byte sector of a disk.
Term
Where are DOS partitions used?
Definition
DOS, Windows, Linux and IA32-based FreeBSD and OpenBSD systems.
Term
MBR includes what?
Definition
A partition table which as four entries.
Term
Each entry of a partition table can have what?
Definition
Up to one partition.
Term
Each entry in a partition table includes what fields?
Definition
Starting CHS address

Ending CHS address

Starting LBA address

Number of sectors in partition

Type of partition

Flags
Term
What OS doesn't care about the type of partition?
Definition
Linux
Term
What do flags on a partition determine determine?
Definition
Whether or not a partition is bootable.
Term
What is a Primary File System Partition?
Definition
Partition whose entry in the Master Boot Record and the partition contains a file system or other structured data.
Term
What is a Primary Extended Partition?
Definition
Partition whose entry is in the Master Boot Record, and the partition contains multiple partitions.
Term
What is a Secondary File System Partition?
Definition
Located inside the primary extended partition bounds and contains a file system or other structured data.
Term
What is another name for a Secondary File System Partition?
Definition
Logical Partition
Term
What is a Secondary Extended Partition?
Definition
Partition that contains a partition table and a secondary file system partition.
Term
Can you have more than four partitions in the Master Boot Record?
Definition
Yes, by using a Primary Extended Partition System to then allow for a Secondary Partition File System Partition.
Term
Boot Code in Master Boot Record exists where?
Definition
In the first 446 bytes of the first 512 byte sector.
Term
What processes the partition table in the Master Boot Record and identifies which partition has the bootable flag set?
Definition
Standard Microsoft Boot Code
Term
The code in the start of the partition will be what specific?
Definition
OS
Term
What happens when the Standard Microsoft Boot Code finds a bootable partition?
Definition
It looks in the first sector of the partition and executes the code found there.
Term
Where do Bootsector Viruses insert themselves so that they are executed every time the computer is booted?
Definition
The first 446 bytes of the MBR.
Term
What are Bootkits?
Definition
Bootsector Viruses
Term
Multiple OS boot option code can be where?
Definition
Either in Boot Code or in the bootable partition.
Term
How are bytes indexed?
Definition
The first byte is always indexed as 0 and counts up.
Term
What are bytes Index 0 to Index 445?
Definition
Boot Code
Term
How many bytes are each Partition Table Entry?
Definition
16
Term
If the Bootcode is the first 446 bytes of the Master Boot Record, then what are the remaining 512 bytes of the Master Boot Record?
Definition
The Partition Table Entries and Signature Value.
Term
In this class the Starting Sector is considered what?
Definition
The starting LBA address
Term
Disk Images start with what?
Definition
Master Boot Record
Term
Do Partition Images start with a Master Boot Record?
Definition
No, only disk images start with the Master Boot Record.
Term
How to Calculate Ending Sector In Decimal?
Definition
Starting Sector (In Decimal) + Size in Sectors (In Decimal) - 1
Term
Is it possible to have an allocated space between partitions?
Definition
Yes
Term
On average, when does the next partition begin?
Definition
The byte immediately after the end of the previous partition.
Term
Does the sequence of the partition entries have to do with the actual sequence of the partitions?
Definition
No, they don't have to be in the actual order they are listed as in the partition table.
Term
What is becoming obsolete?
Definition
BIOS Using MBR
Term
What is replacing BIOS?
Definition
Extensible Firmware Interface and Unified EFI
Term
What is EFI?
Definition
Extensible Firmware Interface
Term
What is UEFI?
Definition
Unified EFI
Term
EFI and UEFI use what in place of MBR?
Definition
GPT
Term
EFI and UEFI is used mainly in systems with what?
Definition
64 bit Intel processors
Term
What does GUID stand for?
Definition
Globally Unique ID
Term
GUID Partition Table can support how many partitions?
Definition
128
Term
GUID Partition Tables use a LBA address of how many bits?
Definition
64
Term
Protective MBR contains a DOS partition table with how many entries?
Definition
1
Term
What is the one entry in the DOS partition table in Protective MBR for?
Definition
A partition with a type of 0xEE that spans the entire disk.
Term
What is the partition with a type of 0xEE that spans the entire disk, that is the one entry of the DOS partition table in Protective MBR for?
Definition
So that legacy computers can recognize the disk as being used and do not try to format it.
Term
Does EFI use the partition with a type of 0xEE that spans the entire disk, that is the one entry of the DOS partition table in Protective MBR?
Definition
No
Term
What are the five areas in GPT Disk?
Definition
GPT Header

Partition Table

Partition Area

Backup Area
Term
Where does the GPT Header Start?
Definition
Sector 1
Term
The GPT Header typically fits in how many sectors?
Definition
1
Term
What does a GPT Header Define?
Definition
Size and location of the partition table, which are fixed when the GPT disk is created.
Term
Windows limits the number of entries in the partition table on GPT Disk to what?
Definition
128
Term
What does the GPT header contain so that errors or modifications can be detected?
Definition
Checksum of the header and the partition table.
Term
What does each entry of a GPT Disk Partition Table contain?
Definition
Starting and ending address, a type value, a name, attribute flags, and a GUID value.
Term
What about a GPT Disk Partition Table is supposed to be unique for that system and is set when the partition table is created?
Definition
The 128 bit GUID
Term
What is the GPT Disk Partition Area?
Definition
Largest area and contains the sectors that will be allocated to partitions.
Term
Where is the starting and ending sector of the GPT Disk Partition Area defined?
Definition
The GPT Header
Term
What is is located in the sector following the partition area and contains a backup copy of the partition table and the GPT header?
Definition
The Backup Area of a GPT Disk
Term
In what order are the contents of the Backup Area of a GPT Disk?
Definition
Copy of the partition table, then the GPT header.
Term
GPT Headers need 32 sectors due to what math?
Definition
(128*128)/512
Supporting users have an ad free experience!