COMP1321 Digital Infrastructures Richard Henson November 2017

Week 6: Hard & Solid State Disk Storage Objectives: explain what a file is and why it is such a useful way to store instructions and data name the commonly used file systems used to store digital data off the motherboard explain how data is organised into files by the CPU explain how files are saved to secondary storage for fast retrieval

Storing Data Overview: https://www.youtube.com/watch?v=TQCr 9RV7twk

Files “file” ~ conventional name for a package of bytes of data Created and Used in Primary Storage : set of stored data usually in consecutive memory locations controlled directly by CPU instructions

Secondary Storage Devices Connected to the Motherboard directly (SATA connection) may need to be configured with operating system on ROM (CMOS settings) allocates a drive letter (e.g. D, E, F) indirectly (USB connection) drive letter allocated through “plug and play”

Finding data on Secondary Storage (1) Secondary storage: controlled on CPU via disk controller programs & file system manager storage locations given addresses when the media is “formatted” works just like memory but has to be loaded into memory to be CPU accessible need an EOF (end of file) marker

File Attributes When a file is saved, and data is transferred from RAM to disk, a number of “attributes” are also saved: File name & suffix: File starting address on disk: File size: Date/time saved: Whether: read-write/read-only; hidden/visible

Overview of File Organisation https://www.youtube.com/watch?v=KN8Yg JnShPM&t=30s Secondary storage devices need to organise files for quick access via starting address… tapes fine for writing, but too slow for reading!

Primary/Secondary Storage of data as files If Windows = operating system, each drive/partition allocated a letter (e.g. C:, D:, etc.

File Organisation on Disk(1) Partition: area earmarked for formatting to meet the needs of a particular file system Could be several partitions on a single disk.. Each has its own drive letter Each could be formatted for a different file system

File Organisation on Disk (2) Disk surface physically divided up into sectors size of sectors depends on formatting type 512 locations (i.e. bytes) 2048 locations files laid down in locations within sectors

Finding data on Secondary Storage Each partition creates a table/index/catalogue for files that are written to it includes file attributes otherwise file very difficult to retrieve… Method depends on filing system chosen when partition formatted… as well as formatting the surface to receive data, each filing system formatting type structures the media to receive data in its own unique way…

“Boot Sector” Important part of PC boot up involves secondary storage Starts from “boot sector” (first sector)… provides configuration information for effective communication with CPU if damaged, boot up halted! should have a backup… needs to be copied to boot sector to overwrite corrupted data

Partitions and Boot Up Whilst a disk can have multiple partitions… Only one of these contains the boot sector Boot sector configuration options… Selectable via screen menu Can point to different operating systems

Booting up: loading an Operating System… Needs to be loaded into RAM some operating systems load everything from ROM (e.g. smartphone) others (e.g. PC) use a combination… some loaded first from ROM rest from hard disk or other source disk needs a bootable partition or can’t load rest of operating system into RAM

Data Storage on Disk Partition Sectors numbered Files stored in specified sector address ranges

Disk Index/Catalogue Stores location for start of file, and size of file Also, organises files into directories/folders top folder (C:) = root rest of folders link hierarchically from the root Index/Catalogue logically allocates each file to a folder for ease of retrieval

“Fragmentation” (Data in Secondary Storage) General problem with hierarchical data storage… deleted data items leave holes in the structure New data items saved try to fill the gaps large files can be broken into fragments fragments linked by address pointers slows down retrieval

Removing Fragmentation If disk only partly fragmented… defragmented files copied into memory remaining files moved around to close up holes Previously defragmented files copied back to disk as complete files If disk >75% fragmented most effective solution is to copy all files to another partition can copy back later once original partition has all data deleted

Is it true that deleted files aren’t really deleted? Absolutely! Two things happen when a file is deleted: the first data item stored in the file (first character of filename) is changed to “?” the catalogue entry ceases to recognise & display the filename starting address shows “?” Character file system is programmed to ignore ? at such a location Rest of the data is untouched… easily demonstrated through use of a Hex editor program: can show file contents “before” and “after”

“Normal” Loading of a File from Secondary Media File catalogue essential for data retrieval application reads file catalogue displays folders and files user chooses file, application uses disk addresses to load into memory File catalogue corruption? can’t find files! backup copy on disk, in separate sector

Direct access by address on Secondary Media If both file catalogues are damaged… file (and its data) cannot be located ideally, needs to be a backup catalogue elsewhere “Hex editors” available to do the equivalent of debug –d (peek) and –e (poke) enables full search of all addresses for particular ASCII string(s) essential for recovery of data…

“Undelete” Tools also available for restoring recently deleted files “?” character poked, and restored to a real character then picked up & shown on catalogue display

WinHex Probably the most popular tool to examine hard disks readout quite similar to debug –e data presented byte-by-byte according to catalogue address range of options for extracting, overwriting data, and (like debug) writing consecutive raw data items to a file

WinHex, Disk Investigation Tools, and Forensics Essential for police: collecting evidence data recovery: to rebuild a damaged or accidentally deleted catalogue to repair a boot sector so that computer can reboot