Flashcards
Day 3 - NTFS File System Structure
Cards in this deck (33)
- 1Name 4 of the 6 NTFS features. FYI: NTFS is the latest file system by Windows1) Compression
2) Encryption
3) Disk quotas are set per-volume, per-user basis
4) Security (Permissions)
5) Mounted Volumes
6) Reliability (Journaling) using transaction based logging - 2This term = the heart of the file system. Is a file that contains admin attributes entries & individual entries for every file and directory. & used to manage filename and metadata for the NTFS.Master File Table (MFT)
- 3What are the first 16 entries in the MFT reserved for? And what symbol do they begin with?1)Administrative attribute entries
2) $ - 4What is the first entry in the MFT? Hint:( it has a Mirror)$MFT = shows disk location of the MFT
- 5What is the $LogFile in the MFT used for?for transaction-based logging
- 6What does "." represents in the MFT?Root Directory in the MFT of the file system volume c:\
- 7This administrative attribute entry is used to allocate clusters in the volume. It uses the allocated (bit value 1) and Unallocated (bit value 0)$Bitmap
- 8By retrieving this entry you can tell which clusters are allocated in the system.$Bitmap
- 9This administrative attribute entry is used to mark bad clusters.$BadClus
- 10True or false: Every file and directory on an NTFS volume has an MFT entry for itself.True
- 11Every entry has _____ and ______ that describe and contain file/directory data.Header and Attributes
- 12MFT entry attributes contain the metadata for the file or directory. True or FalseTrue
- 13Each MFT entry is subject to a 1KB size constraint. What is a Resident Attribute in regards to the previous fact?resident attribute is <1KB and is stored in the entry itself
- 14Each MFT entry is subject to a 1KB size constraint. What is a Non-Resident Attribute in regards to the previous fact?it's an attribute that is >1KB and is stored outside of the MFT entry
- 15$Index_Root contains what?information about directories, sub-directories, and files contained with-in it
- 16What resident attribute provides the most accurate time-stamps and file attributes (ARCHES)$Standard_Information
- 17$File_Name contains what?a reference to the parent Directory. Also contains file-name, size, and inherits time-stamps from the $Standard_Information attribute.
- 18This contains file data OR a pointer to the location of file data.$DATA
- 19$DATA can be either _____ or ____resident or non-resident
- 20When are Virtual Cluster Number (VCN) to Logical Cluster Number (LCN) used in the $DATA attribute?When the file's data is too large. The file data is then written to the data layer of the file system
- 21What does the VCN represent?the clusters belonging to a file
- 22What does the LCN represent?the sequence of clusters of an entire volume
- 23What timestamps (4) are used by NTFS?1) Creation Time
2) Modified Time
3) MFT Modified Time
4) Access Time - 24How is the Created time updated?when file was created
- 25How is the Modified time updated?when the contents of the $Data or $Index attributes were modified
- 26How is the MFT Modified Time time updated?when MFT entry metadata was last modified
- 27How is the Accessed Time updated?when file was last created
- 28This cluster number starts with 0 and tells how many clusters are needed?Virtual Cluster Number (VCN)
- 29This cluster number tells you the actual cluster number in the data area?Logical Cluster Number (LCN)
- 30For FAT & NTFS: Copy in the same Volume? *Only pertains to the NTFSC ^
A ^
W <->
*MFT Modified ^ - 31For FAT & NTFS: Copy to a different Volume? *Only pertains to the NTFSC ^
A ^
W <->
*MFT Modifcation ^ - 32For FAT & NTFS: MOVE in the same Volume? *Only pertains to the NTFSC <->
A <->
W <->
* MFT Modification ^ - 33For FAT & NTFS: MOVE in a different Volume? *Only pertains to the NTFSC ^
A ^
W <->
*MFT Modification ^
Information
- Description
- College Mod 7.1 Windows Flashcards on Day 3 - NTFS File System Structure, created by jeriel.juarbe on 04/08/2014.
- Created by
- jeriel.juarbe
- Views
- 18
- Rating