computer architecture - software - lesson 10 - hard drive management / logical drives - eric...

Eric Vanderburg – OS Technologies © 2005

Computer Architecture:OS Technologies

Chapter 10Hard Drive management

Eric Vanderburg


Concepts• Fragmentation

• Lost clusters – not linked

• Cross-linked clusters – multiple links

• Chkdsk can repair lost and cross-linked clusters


Disk cleanup• Downloaded files

• Offline files

• Temp files

• Recycle bin

• Setup files

• Index files

• Compress old files


• Entire drive can be compressed

• 9x can compress a FAT16 volume with DriveSpace


Cache• RAM – store data being read or

written to a drive

• On the controller – store data waiting to travel across the IDE/SCSI/SATA cable. (Used for HDD & CD)

• Sometimes called a buffer

• Buffer under run with CD-R media


Cache• Can use software caching as well, uses

system RAM. • [Config.sys] buffers=10, buffershigh= (1-99)

• DOS & 3x use SMARTDrive for HDD &FDD• 9x uses vcache• NT based systems automatically cache


Backups• Archive bit• Grandparent (monthly), Parent (weekly),

Child (daily)– Grandparent & parent backups are usually

offsite– Child backups are incremental or differential

• MS Backup program can be scheduled or a script can be written and placed in schedule tasks to perform the backup

• Backups must be tested after being made• In class: Look up some enterprise backup

solutions online


Disk Imaging/Cloning• Create an exact copy of a drive to be

replicated to another system of the same type

• DriveImage

• ImageCast

• Norton Ghost

• Deep Freeze (image changed files on restart)


Malicious Code• Virus - self-replicating code segment

which is be attached to an executable. When the program is started, the virus code may also run. If possible, the virus will replicate by attaching a copy of itself to another file. A virus may also have an additional ``payload'' that runs when specific conditions are met. – Boot sector virus – can attach to floppy– File virus– Macro virus


Malicious Code• Worm - self-replicating program, does not

require a host program, creates a copy and causes it to execute; no user intervention is required. Worms commonly utilize network services to propagate to other computer systems

• Spyware - a program that secretly monitors your actions. Could be a remote control program used by a hacker, or it could be used to gather data about users for advertising, aggregation/research, or preliminary information for an attack. Some spyware is configured to download other programs on the computer.


Malicious Code• Logic bomb – malicious code that is

triggered by an event and executed.

• Trojan horse - malicious code pretending to be a legitimate application. The user believes they are running an innocent application when the program is actually initiating its ulterior activities. Trojan horses do not replicate.


Malware can hide• Polymorphic – change signature (way

it acts)

• Encrypting – does not replicate to hide

• Stealth – alters file system info to change size and substitutes a copy of itself when opened


Tips• Reboot a computer to remove virii

from RAM

• Beware of certain attachments

• Keep update antivirus, antispam software and patch your computer


Troubleshooting• Utilities

– Norton Disk Doctor – repair HDD problems

– Partition Magic – resize partitions with data, change file system

– SpinRite – recovers data– Recover my files

• Unformat

• Undelete

computer architecture - software - lesson 10 - hard drive management / logical drives - eric...

Technology