Glossary of Terms


ASCII (American Standard Code for Information Interchange)

A standard that assigns one text character to a number. The first 32 characters have a special meaning (control characters) and does not represent normal text characters.

Attributes

Attributes are are usually referring to the DOS attributes Archive, Read/Only, Directory, Hidden, System, Volume. In NTFS attributes are structures entirely describing a file.

BIOS (Basic Input Output System)

A software existing in the computer hardware and providing basic services for accessing disks and hard drives.

Boot Sector

The boot sector is a special sector located in the first sector of a partition describing the file system following this sector. The boot sector contains a BIOS parameter block (BPB) and specific partition parameters as well as boot code if the partition is bootable. The boot sector structure is dependant on file system type.

Cluster

A cluster is the minimum logical unit of a partition that the operating system can allocate. Its size is managed by the operating system and varies from 512 bytes to 65,536 bytes, depending on the particular file system and its partition size. A cluster is always a multiple of a "sector". Typical cluster sizes are 1, 2, 4, 8, 16, 32, 64, 128 sectors.

Cross-linked

A file which appear to operating system to be sharing the same cluster(s) due to errors in the File Allocation Table or RunList or due to that an existing file shares clusters with a deleted one.

Compressed files

Compression is a means of saving memory or storage. NTFS file system supports file compression. Once initiated, the compression is performed transparently (without user input) when the file is read or written.

Data recovery

The process of retrieving files from a drive that cannot be accessed from its operating system anymore.

Encrypted files

Encrypting is a means of protecting user data. NTFS file system encryption is based on a public-key encryption standard. Once initiated, the NTFS encryption works transparently (without user input). Files are encrypted with a randomly generated file encryption key that is encrypted with the public portion of a user's key par.

File System

The file system (such as FAT or NTFS) is the scheme how a file is store on a disk. Do not confuse it with the operating system (such as WindowsNT or WindowsXP). A file system consists of files, directories, and the information needed to locate and access these items. File systems are generally specific to the type of computer you have. Most IBM-compatible personal computers use the File Allocation Table file system (FAT) or New Technology File System (NTFS) in one form or another.

File Allocation Table (FAT)

A File Allocation Table (FAT) is a table that an operating system maintains on a hard disk that provides a map of the clusters (the basic unit of logical storage on a hard disk) that a file has been stored in. The clusters are stored as a linked-list - each entry in the FAT points to the number of the next cluster occupied by a file until the end of the file (EOF) marker is found. This scheme allows the operating system to store files in clusters that are not contiguous.
There are three kinds of FATs: 12 bit FAT (FAT12) can address up to 4096 clusters, 16 bit FAT (FAT16) can address up to 65,536 clusters and 32 bit FAT (FAT32) can address up to 4,294,967,296 clusters. The file system maintains two copies of the FAT: FAT1 and FAT2.

Fragmentation

Fragmentation is a denotation for files that are not stored consecutive (fragmented) on a drive. It occurs when you use a disk frequently, meaning creating, deleting and modifying files. If you have recently run a disk defragmentation tool on your drive, your chances of recovery are very high. Note: do NOT defragment your hard drive in a deleted recovery situation. Doing so will likely remove all remnants of the file you are trying to recover.

Hexdecimal

A coding that uses a number base of 16 instead of the common decimal base of 10. This means there are 16 combinations for each position of a number. So the numbers 0 to 9 are equal to the decimal system and the numbers 10, 11, 12, 13, 14 and 15 are expressed as A, B, C, D, E and F.
Example: hex A4 = dec 164. (10*16 + 4*1).

High-level format

The process of creating the file system structures on a disk that has already received a low-level format. For example, this is performed if you select the format option in Explorer by right clicking on a drive. This will perform a format of the drive removing all files. The data is still present on the drive and can be recovered as described in section 'Finding lost data' in the User Guide.

INT13 Extensions

A BIOS service provided for accessing disk and hard disks larger as 8 GB.

Logical drive

Logical drives are volumes known to the operating system as A:, B:, C: etc. They may be either one partition of a physical drive or a drive without multiple partition support (e.g. floppy drive).

Low-level format

The process of adding a series of concentric tracks and wedge shaped sectors to a disk magnetically. Low level formatting will also check the physical integrity of the surface of the disk by reading and writing to each sector. Bad sectors will be marked and not used by the system. While general formatting and quick formatting deletes only the volume information, low level formatting deletes all data areas and causes the same result as an overwrite.

Master Boot Record (MBR)

The Master Boot Record contains a list of all primary partitions stored on a drive. The record also contains boot code used to boot your computer.

Master File Table (MFT)

In NTFS, the Master File Table (MFT) is a database containing information about every file or directory on a NTFS volume. An entry is called MFT entry or file entry. To guarantee enough space for these entries, Windows reserves one-eighth of the disk volume for exclusive MFT use--the MFT Zone. The MFT is the most critical file on an NTFS partition and necessary for recovery.

MFT entry

A MFT entry in NTFS is an entry in the MFT (Master File Table).

MFT number

The MFT number is the position of a file entry within the MFT.

New Technology File System (NTFS)

NTFS, introduced with the first version of Microsoft Windows NT, is completely different from the traditional FAT file systems. It provides for greatly increased security, file-by-file compression, quotas, as well as compression. It is the default file system for new installations of Windows XP.

NTFS Attribute

The NTFS Attributes describe every aspect of a file in NTFS, such as file names, time stamps, file sizes, data allocations, file encryption keys, directory contents and more. NTFS Attributes can be resident or non-resident. Resident attributes are stored within the MFT entry. Non-resident attributes are stored outside using run lists.

OLE Storage format

A standarized container format for files established by Microsoft. Container means that a one file can contain other files and information. Most applications using OLE (acronym for Object Linking and Embedding) make us of this format.

Partition

A formatted section of your hard drive. Drives formatted by DOS or Windows have at least one partition, labeled "C:". Large drives can be formatted to have multiple partitions. Each partition will then behave as if it were a seperate logical drive, with its own letter (D, E, F, etc.).

Partition table

The partition table is a list of partition entries located in sector 0 of a drive. If a drive contains "extended partitions", there is a linked list of several partition tables on the drive.

Physical drive

A physical tangible drive that contains only one (e.g. a floppy drive) or multiple logical drives (e.g. hard disk).

Run List

A run list is a list of clusters used for an NTFS Attribute. If the attributes are too large to fit into the MFT entry, some of them will be non-resident, meaning the value part the specific attribute will be found outside of the entry. In this case the outside data allocation will be described by a run list.

Sector

The smallest storage allocation units on a drive. Typically, on PCs, a sector holds 512 bytes of information. Multiple sectors are grouped to "clusters".

Scan

A scan is the process of examining every single sector of a drive.

Signature Search Algorithm

A mean to identify a file by its content. The search compares parts of a sector (the smallest storage allocation unit of a drive) with signatures stored in a file type database. This database contains the most common file header signatures. If the signature matches, the file is identified as the file type the database describes. If the signature of the file to be found is known (e.g. from an existing same type of file), the database can be extended to this specific file type.

Quick Format

This process of performing only a high-level format of a disk, using the tracks and sectors already defined by an earlier formatting. Quick formatting on a disk takes far less time than performing a complete format. For example, this is performed if you select the format option in Explorer by right clicking on a drive and selecting 'quick format'. This will perform a format of the drive removing all files. The data is still present on the drive and can be recovered as described in section 'Finding lost data' in the User Guide.