PC Technicians - Slaithwaite Adult Education

Home

Each week the pages are divided into 2 sections.

Lesson overview and supplement
Further reading resources

You can assume that any topic discussed in the overview and supplement sections may be in the unit exam. Further reading is basically as stated. It will expand on topics or just be of interest.

Any pages linked are meant to be scanned for relevant supporting information to the taught lesson - Not necessarily read word for word.

We discussed principles of File Systems, in particular the FAT and NTFS systems and how data is recovered.

Blocks and Clusters

Word document showing Clusters and Blocks

An unformatted and partitioned hard drive consists of blocks of 512 bytes to hold data. These blocks when partitioned and formatted are clustered together to form Minimum Allocation Units varying in size dependent on the capacity of the drive and file system used. Typically for NTFS a cluster is 4kb or 8 blocks. FAT32 can have clusters of 4kb to 64kb on large drives.

FAT - File Allocation Table

FAT is a table of information stored on a hard disk drive containing information about the files/folders on a drive, their start cluster location and basic file attributes like read only or hidden.

FAT relies on a set area of memory to hold this information and is limited by this size. There are FAT12, FAT16 and FAT32 with FAT12 being used on floppy disks.

On large drives the clusters are larger. Small files leave slack in the cluster which becomes unusable, marginally reducing the capacity of the drive.

FAT has virtually no file/folder security features.

NTFS - New Technology File System

NTFS uses a Master File Table or MFT, to maintain a list of files and their location on a drive.

Unlike FAT, NTFS is not limited by size and can maintain 4kb clusters on very large drives.

NTFS has very powerful security features enabling file/folder level permissions by setting properties in an Access Control List or ACL

NTFS is known as a Journaling file system. This means that extra information is stored with the file/folder in headers and footers that enhance recovery and maintain the security. Linux uses a similar journaling file system named EXT3.

File Recovery / Data Protection

When deleting or formatting data on a drive only the directory tables are affected, the data remains in the clusters on the drive. These files can be recovered using software like Ontrack's Easy Recovery Pro or the free PC Inspector .

To protect confidential or sensitive data from being recovered (a requirement in law under the Data Protection Act) either physically destroy disposed hard drives or use an erasing tool such as the free and open source Portable Eraser.

Portable Eraser can erase individual files or an entire drive and acheives this by writing random data to every block within the clusters up to 7 times over. This process can take a very long time to complete.