DOCSLIB.ORG

22 Logical Areas

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
22 Logical Areas CSC414 Formatting a Disk Computer Logical Areas of Preparing a disk for use System a Disk - Low-Level Format - Places tracks and sectors on platters Fundamentals - Partition Disk - Creates logical disks (volumes) - Hard Disk Only - High-Level Format - Creates and initializes file system for each volume Digital Forensics Center THINK BIG WE DO Department of Computer Science and Statics - Boot Record - File Allocation Table (FAT) and a copy U R I - Root Directory http://www.forensics.cs.uri.edu - Data Area Boot Record Boot Record Master Boot Record (MBR) Volume Boot Record (VBR) - Physical Location - Contains bootstrap startup code for system - Cylinder 0, Side 0, Sector 1 (0, 0, 1) boot sequence - First sector, on the first track, on the first side - A very short program that reads the rest of the operating system - First sector read by BIOS/Firmware - Volume Information - Contains disk information - Partition start, end and number of sectors - Number of bytes per sector - Logical Location - Total number of sectors per disk - Sector 0 on volume or partition - Number of sectors per track - Often is Sector 63 on DOS disks - Number of heads - Partition Table - Signature >> 55AA Hex - If bootable, location of boot volume VBR - located in the last two bytes of the sector Boot Record Boot Record For a floppy diskette: Master Boot Record - There is only a master boot record (MBR) - A valid MBR is required to access any diskette - either bootable or non-bootable - Attempting to boot from a bootable diskette with a missing or corrupt MBR gives a NON BOOT DISK or DISK ERROR message - An invalid MBR on a data diskette results in a GENERAL FAILURE Boot Record File Allocation Table Master Boot Record File Allocation Table (FAT) 4 KB Cluster Size Cluster Next (8 blocks) - System for storage of files and : : myFile.docx 14 KB subdirectories in Data Area : : Clusters 4 - Maintains the clusters used by needed (16 KB) 44 0 every file on the disk 45 46 System Directory - If a file uses more than one cluster: myFile.docx 46 49 - FAT points to the next cluster File Start = 45 47 48 - "A chain of clusters" 48 <EOF> - FAT marks the last cluster in a chain Unused extra space <EOF> Hex: FFF 49 50 at end of cluster is - Which clusters are available for use 50 <EOF> called Slack - Which clusters have bad sectors Cluster : : 47 <BAD> Hex: FF7 : : File Allocation Table File Allocation Table File Allocation Table (FAT) File Allocation Table (FAT) - Number of entries (clusters) is limited by the number of bits used to represent cluster IDs (numbers) FAT/FAT12 FAT16 FAT32 Maximum Number 4084 65,526 268,435,456 of Clusters Cluster size is Cluster Sizes determined by the 1 to 8 4 to 64 8 to 64 (sectors) operating system and Numbering for data clusters begins at 2 Cluster Sizes 0.5 KB to 4 KB 2 KB to 32 KB 4 KB to 32 KB file system and Clusters 0 and 1 are for system data (sectors) depends on partition Boot Record, FAT, and Root Directory Maximum Volume 16,736,256 2,147,123,200 about 241 Size (16 MB) (2 GB) size. maxVolumeSize = maxClusterSize x maxNumberofCLusters Root Directory Root Directory Directory of items at root level A file with Directory Entries information of volume Root Directory Subdirectories about other files - 32 bytes of information Treated similar to files - One entry for each - File Name or Subdirectory Name Can be created, modified and deleted - Root Directory File or File File Subdirectory File Subdirectory File File Consumes entire cluster Special Subdirectory entries: - Root Subdirectory - Starting Cluster . dot referred to as “self” - Total size of the root directory is fixed - the beginning of the chain of clusters .. dot-dot called “parent” File File File File File Subdirectory - Dependent on the media and format - Size in bytes - Maximum number of entries it can contain - Date and Time Groups (DTG) DTGs Attributes is fixed Creation DTG read-only? File File File File - Floppy Disk (1.44 MB) - Attributes Modification DTG hidden? Last Access DTG system? - maximum of 224 entries executable? - Most Hard Disks subdirectory? - 512 root directory entries Cluster 4 KB Data Area Data Area Size (8 blocks) myFile.docx 14 KB Clusters 4 Operating system must Remainder of the volume/partition /** apples.cpp Slack needed (16 KB) Computes the cost per apple of a box of apples allocate 2 KB more than Input: cost of box of apples Output: the input data needed for file the cost per apple if bought by the box - Unused space at end of sector or cluster - where file and subdirectory data is stored */ #include <iostream> using namespace std; int main() { File Slack (Disk Slack) - can contain erased and/or hidden data const int APPLES_PER_BOX = 24; double costPerBox = 0.0; cout << "How much does a box of apples cost? $"; University of Rhode Island - Data found in unused blocks of cluster cin >> costPerBox; - all types of digital data double costPerApple = costPerBox / APPLES_PER_BOX;CSC 414 Computer System Fundamentals Summer 2011 Syllabus cout << "\nApples per box: " << APPLES_PER_BOX << endl; Teaching Staff: Victor Fay-Wolfe ([email protected]) - Previous directories and files, previous RAM slack, previously unused space, and space cout << "Cost per box: $" << costPerBox << endl; Timothy Henry ([email protected]) cout << "Cost per apple: $" << costPerApple << endl; Sean Alvarez ([email protected]) Kevin Bryan ([email protected]) Logical Addressing of this area is return 0; Course Meets: Online May 23 ± July 29 overwritten with a disk cleaning utility. } // end main Course Web Page: https://homepage.cs.uri.edu/courses/online/woc/ by Logical Sector Number or Goals: x Learn the principles and concepts underlying computer operating systems RAM Slack x Learn to install, configure, and manipulate a modern computer operating system Cluster x Learn the principles and concepts underlying computer networks x Learn to install, configure, and manipulate modern computer networks - Data found in unused bytes of a block x Learn the basics of computer and network hardware x Introduce digital forensics concepts and practices - First cluster referenced in FAT is 2 x Introduce OS and network tools and concepts used in digital forensics - Prior to Windows 95, RAM Slack was obtained from active RAM and could contain useful data Course Materials: Textbooks x The Architecture of Computer Hardware, Systems Software & Networking : An - Starting with Windows 95 RAM slack is filled with hex 00 - Cluster numbers are consecutive until the Information Technology Approach, 4th Edition, By Irv Englander, 2009 John Wiley & RAM Sons, Inc.; ISBN: 978-0471-71542-9 File Slack x (Optional) A+ Certification All-In-One Exam Guide, 7th Edition, By Mike Myers, 2010 Slack McGraw Hill Publishing; ISBN: 978-0-07-170133-4 (only if student wants to pursue A+ myFile.docx end of the Data Area certification) Software x WinHex Specialist (discounted academic pricing available) x Other Forensics software (VMware, and others) 1 | Page Clusters Sectors / Blocks Logical Areas of the Disk Digital Forensics Center Department of Computer Science and Statics THINK BIG WE DO U R I http://www.forensics.cs.uri.edu.
Load more

Recommended publications
  • Operating System Boot from Fully Encrypted Device
    MASARYK UNIVERSITY FACULTY OF INFORMATICS Operating system boot from fully encrypted device BACHELOR'S THESIS Daniel Chromik Brno, Fall 2016 Replace this page with a copy of the official signed thesis assignment and the copy of the Statement of an Author. Declaration Hereby I declare that this paper is my original authorial work, which I have worked out by my own. All sources, references and literature used or excerpted during elaboration of this work are properly cited and listed in complete reference to the due source. Daniel Chromik Advisor: ing. Milan Brož i Acknowledgement I would like to thank my advisor, Ing. Milan Brož, for his guidance and his patience of a saint. Another round of thanks I would like to send towards my family and friends for their support. ii Abstract The goal of this work is description of existing solutions for boot• ing Linux and Windows from fully encrypted devices with Secure Boot. Before that, though, early boot process and bootloaders are de• scribed. A simple Linux distribution is then set up to boot from a fully encrypted device. And lastly, existing Windows encryption solutions are described. iii Keywords boot process, Linux, Windows, disk encryption, GRUB 2, LUKS iv Contents 1 Introduction 1 1.1 Thesis goals 1 1.2 Thesis structure 2 2 Boot Process Description 3 2.1 Early Boot Process 3 2.2 Firmware interfaces 4 2.2.1 BIOS - Basic Input/Output System 4 2.2.2 UEFI - Unified Extended Firmware Interface . 5 2.3 Partitioning tables 5 2.3.1 MBR - Master Boot Record 5 2.3.2 GPT - GUID Partition Table 7 2.4
    [Show full text]
  • Partition Wizard About Minitool Partition Wizard Minitool Partition Wizard Is an Easy-To-Use Partitioning Software with High Security and Efficiency
    MiniTool Partition Wizard About MiniTool Partition Wizard MiniTool Partition Wizard is an easy-to-use partitioning software with high security and efficiency. Due of its simple user interface, you can create, delete, format, move, and resize partitions with ease. What’s more, your data will always be protected when using MiniTool Partition Wizard to move and resize partitions. Main Functions of MiniTool Partition Wizard: Resize/ Move partitions Merge Partitions Create partitions Delete partitions Change Partition Label Delete all partitions Format partitions Change Cluster Size Convert file system Convert FAT to NTFS Convert NTFS to FAT Explore Partition Check Partitions Recovery Partition Wipe disk Wipe partition Copy partition Copy disks Initialize to MBR disk Initialize to GPT disk Align All Partitions Align Partition Convert MBR Disk to GPT Disk Convert GPT Disk to MBR Disk Dynamic Disk Create volume Delete Volume Format Volume Move/Resize Volume Wipe Volume Explore Volume Check File System Change Volume Label Change Volume Letter Change Volume Cluster Size Volume Properties MiniTool Partition Wizard Staring MiniTool Partition Wizard You can start MiniTool Partition Wizard from the Start menu in Windows Click Start menu > All Programs > MiniTool Partition Wizard xxx Edition > MiniTool Partition Wizard xxx Edition Xxx is your present edition of MiniTool Partition Wizard, Such as Home, Professional, Server, and Enterprise MiniTool Partition Wizard Hardware Requirements Minimum Hardware requirements: 500 MHz x86 or compatible CPU. 256mb RAM memory. Mouse and Keyboard. Recommended Hardware requirements: 1 GHz x86 or compatible CPU. 512mb RAM memory. Mouse and Keyboard. MiniTool Partition Wizard System Requirements Note: you should have access to administration while using Partition Wizard.
    [Show full text]
  • Computer Hardware
    Chapter Computer Hardware ENCE EXAM TOPICS COVERED IN 1 THIS CHAPTER: ✓ Computer hardware components ✓ The boot process ✓ Partitions ✓ File systems COPYRIGHTED MATERIAL Computer forensics examiners deal most often with the media on which evidentiary data is stored. This includes, but is not lim- ited to, hard drives, CDs, DVDs, fl ash memory devices, smart phones, tablets, and even legacy fl oppies and tapes. Although these devices might be the bane of the examiner’s existence, media devices don’t exist in a void, and knowledge of a computer’s various components and functions is a must for the competent examiner. As an examiner, you may be called upon to explain how a computer functions to a jury. Doing so requires you know a computer’s function from a technical standpoint and that you can translate those technical concepts into real-world, easy-to-understand terms. As an examiner, you may also be subjected to a voir dire examination by opposing coun- sel to challenge your competence to testify. Acronyms are hardly in short supply in the fi eld of computing—some well-known and meaningful, others more obscure. Imagine being asked during such an examination to explain several of the common acronyms used with computers, such as RAM, CMOS, SCSI, BIOS, and POST. If you were to draw a blank on some obscure or even common acronym, picture its impact on your credibility. Some acronyms are difficult to remember because their meaning is often obscure or meaningless. A good example is TWAIN, which stands for T ech- nology W ithout a n I nteresting N ame.
    [Show full text]
  • Master Boot Record Vs Guid Mac
    Master Boot Record Vs Guid Mac Wallace is therefor divinatory after kickable Noach excoriating his philosophizer hourlong. When Odell perches dilaceratinghis tithes gravitated usward ornot alkalize arco enough, comparatively is Apollo and kraal? enduringly, If funked how or following augitic is Norris Enrico? usually brails his germens However, half the UEFI supports the MBR and GPT. Following your suggested steps, these backups will appear helpful to restore prod data. OK, GPT makes for playing more logical choice based on compatibility. Formatting a suit Drive are Hard Disk. In this guide, is welcome your comments or thoughts below. Thus, making, or paid other OS. Enter an open Disk Management window. Erase panel, or the GUID Partition that, we have covered the difference between MBR and GPT to care unit while partitioning a drive. Each record in less directory is searched by comparing the hash value. Disk Utility have to its important tasks button activated for adding, total capacity, create new Container will be created as well. Hard money fix Windows Problems? MBR conversion, the main VBR and the backup VBR. At trial three Linux emergency systems ship with GPT fdisk. In else, the user may decide was the hijack is unimportant to them. GB even if lesser alignment values are detected. Interoperability of the file system also important. Although it hard be read natively by Linux, she likes shopping, the utility Partition Manager has endeavor to working when Disk Utility if nothing to remain your MBR formatted external USB hard disk drive. One station time machine, reformat the storage device, GPT can notice similar problem they attempt to recover the damaged data between another location on the disk.
    [Show full text]
  • Wikipedia: Design of the FAT File System
    Design of the FAT file system A FAT file system is a specific type of computer file system architecture and FAT a family of industry-standard file systems utilizing it. Developer(s) Microsoft, SCP, IBM, [3] The FAT file system is a legacy file system which is simple and robust. It Compaq, Digital offers good performance even in very light-weight implementations, but Research, Novell, cannot deliver the same performance, reliability and scalability as some Caldera modern file systems. It is, however, supported for compatibility reasons by Full name File Allocation Table: nearly all currently developed operating systems for personal computers and FAT12 (12- many home computers, mobile devices and embedded systems, and thus is a bit version), well suited format for data exchange between computers and devices of almost FAT16 (16- any type and age from 1981 through the present. bit versions), Originally designed in 1977 for use on floppy disks, FAT was soon adapted and FAT32 (32-bit version used almost universally on hard disks throughout the DOS and Windows 9x with 28 bits used), eras for two decades. Today, FAT file systems are still commonly found on exFAT (64- floppy disks, USB sticks, flash and other solid-state memory cards and bit versions) modules, and many portable and embedded devices. DCF implements FAT as Introduced 1977 (Standalone the standard file system for digital cameras since 1998.[4] FAT is also utilized Disk BASIC-80) for the EFI system partition (partition type 0xEF) in the boot stage of EFI- FAT12: August 1980 compliant computers. (SCP QDOS) FAT16: August 1984 For floppy disks, FAT has been standardized as ECMA-107[5] and (IBM PC DOS 3.0) ISO/IEC 9293:1994[6] (superseding ISO 9293:1987[7]).
    [Show full text]
  • Virus Infection Techniques: Boot Record Viruses
    Virus Infection Techniques: Boot Record Viruses Bill Harrison CS4440/7440 Malware Analysis and Defense Reading } Start reading Chapter 4 of Szor 2 Virus Infection Techniques } We will survey common locations of virus infections: MBR (Master Boot Record) Boot sector Executable files (*.EXE, *.COM, *.BAT, etc.) } Most of the examples of these viruses, especially the first two types, are from the DOS and floppy disk era 3 Why Study Older Viruses? } Vulnerabilities remain very similar over time, along with the means to exploit them and defend against them } Modern Internet worms differ mainly in the use of the internet for transport, and are otherwise similar to older viruses } Older viruses illustrate the virus vs. antivirus battle over many generations 4 Boot-up Infections and the PC Boot-up Sequence } PC boot-up sequence: 1. BIOS searches for boot device (might be a diskette, hard disk, or CD-ROM) 2. MBR (Master Boot Record) is read into memory from the beginning of the first disk partition; execution proceeds from memory 5 Master Boot Record Structure Boot-up Sequence cont’d. 3. Beginning of MBR has tiny code called the boot- strap loader 4. Data area within MBR has the disk PT (partition table) 5. Boot-strap loader reads PT and finds the active boot partition 6. Boot-strap loader loads the first sector of the active partition into memory and jumps to it; this is called the boot sector 7 Boot-up Sequence cont’d. } MBR is always at BIOS the very first sector of the hard MBR: Expanded View MBR Boot-strap loader code (446 disk (first 512
    [Show full text]
  • Master Boot Record (MBR)
    Master Boot Record (MBR) Offset Size (bytes) Description 0 436 MBR Bootstrap (flat binary executable code) 436 10 Optional "unique" disk ID1 446 64 MBR Partition Table, with 4 entries (below) 446 16 First partition table entry 462 16 Second partition table entry 478 16 Third partition table entry 494 16 Fourth partition table entry 510 2 (0x55, 0xAA) "Valid bootsector" signature bytes Partition Entry Offset Size Description 0 1 byte Boot indicator bit flag: 0 = no, 0x80 = bootable (or "active") 1 1 byte Starting head 2 6 bits Starting sector (Bits 6-7 are the upper two bits for the Starting Cylinder field.) 3 10 bits Starting Cylinder 4 1 byte Partition Type (0xB or 0xC for FAT32). 5 1 byte Ending Head 6 6 bits Ending Sector (Bits 6-7 are the upper two bits for the ending cylinder field) 7 10 bits Ending Cylinder 8 4 bytes Relative Sector (offset, in sectors, from start of disk to start of the partition) 12 4 bytes Total Sectors in partition BIOS Parameter Block (BPB) Offset Size Meaning (bytes) (bytes) 0 3 The first three bytes EB XX 90 disassemble to JMP SHORT XX NOP. 3 8 OEM identifier. 11 2 The number of Bytes per sector (all numbers are in the little-endian format). 13 1 Number of sectors per cluster. 14 2 Number of reserved sectors. The boot record sectors are included in this value. 16 1 Number of File Allocation Tables (FAT's) on the storage media. Often 2. 17 2 Max # of directory entries (0 for FAT32 which stores directories in data region).
    [Show full text]
  • Exploration of Windows Vista Advanced Forensic Topics – Day 1
    Windows Vista and NTFS File System Internals Exploration of Windows Vista Advanced Forensic Topics – Day 1 LAW ENFORCEMENT SENSITIVE INFORMATION – DO NOT SHARE THESE MATERIALS ©2007 Microsoft Corporation – All Rights Reserved Windows Client Forensics (Windows Vista Advanced Topics) Transactional NTFS and Registry Explained LAW ENFORCEMENT SENSITIVE INFORMATION – DO NOT SHARE THESE MATERIALS ©2007 Microsoft Corporation – All Rights Reserved New Features Important Changes of Interest LAW ENFORCEMENT SENSITIVE INFORMATION – DO NOT SHARE THESE MATERIALS ©2007 Microsoft Corporation – All Rights Reserved Self-Healing File System • Vista includes a “self-healing” function which can correct certain errors in the system • Vista maintains a list of hashes of known files and checks the hashes periodically • On non-system files Vista will validate the file metadata • Files whose hashes do not match or metadata is not valid will be replaced the next time the system is rebooted LAW ENFORCEMENT SENSITIVE INFORMATION – DO NOT SHARE THESE MATERIALS ©2007 Microsoft Corporation – All Rights Reserved Self-Healing File System • Equivalent to Chkdsk and defrag processes constantly running in the background • This has the potential to decrease the usefulness of the free space and slack space on the disk as well as limit the ability to recover deleted files LAW ENFORCEMENT SENSITIVE INFORMATION – DO NOT SHARE THESE MATERIALS ©2007 Microsoft Corporation – All Rights Reserved Self-Healing File System • Healed files can be identified by an examination of the event
    [Show full text]
  • NTFS from Wikipedia, the Free Encyclopedia Jump To: Navigation, Search NTFS Developer Microsoft Introduced July 1993 (Windows
    NTFS From Wikipedia, the free encyclopedia Jump to: navigation, search NTFS Developer Microsoft Introduced July 1993 (Windows NT 3.1) Partition identifier 0x07 (MBR) EBD0A0A2-B9E5-4433-87C0-68B6B72699C7 (GPT) Structures Directory contents B+ tree[1] File allocation Bitmap/Extents Bad blocks $badclus Limits Max file size 264 bytes (16 EiB) minus 1 KiB [2] Max number of files 4,294,967,295 (232-1)[2] Max filename length 255 UTF-16 code units[3] Max volume size 264 ? 1 clusters [2] Allowed characters in filenames In Posix namespace, any UTF-16 code unit (case sensitive) except U+0000 (NUL) and / (slash). In Win32 namespace, any UTF-16 code unit (case insensitive) except U+0000 (NUL) / (slash) \ (backslash) : (colon) * (asterisk) ? (Question mark) " (quote) < (less than) > (greater than) and | (pipe) [3] Features Dates recorded Creation, modification, POSIX change, access Date range 1 January 1601 ʹ 28 May 60056 (File times are 64-bit numbers counting 100- nanosecond intervals (ten million per second) since 1601, which is 58,000+ years) Date resolution 100ns Forks Yes (see Alternate data streams below) Attributes Read-only, hidden, system, archive, not content indexed, off-line, temporary File system permissions ACLs Transparent compression Per-file, LZ77 (Windows NT 3.51 onward) Transparent encryption Per-file, DESX (Windows 2000 onward), Triple DES (Windows XP onward), AES (Windows XP Service Pack 1, Windows Server 2003 onward) Single Instance Storage Yes Supported operating systems Windows NT family (Windows NT 3.1 to Windows NT 4.0, Windows 2000, Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008) NTFS is the standard file system of Windows NT, including its later versions Windows 2000, Windows XP, Windows Server 2003, Windows Server 2008, and Windows Vista.[4] NTFS supersedes the FAT file system as the preferred file system for Microsoft͛s ͞Windows͟-branded operating systems.
    [Show full text]
  • UEFI, Booting & Partition Management
    UEFI, Booting & Partition Management Kelvin Cording July 2018 Unified Extendible Interface (UEFI) • Modern computer and Windows are moving away from the traditional MBR based boot- up processes to hardware and software using UEFI • Win 8 introduced UEFI • If Windows 8 is already installed using Legacy BIOS, it can't be converted to UEFI. A new OS installation is required. Understanding a computer boot up process When you hit the power button of your PC, an execution begins that will eventually load the Operating System into memory. This first execution depends on the partition structure of your hard disk. We have two types of partition structures (or formats): MBR and GPT. The partition structure on a drive defines three things: • The structure of data on the drive. • The code used during startup if a partition is bootable. • Where a partition begins and ends. MBR -Master Boot Record GPT Globally Unique Identifier Partition Table = GUID Partition A comparison of GPT and MBR partition structures A comparison of GPT and MBR partition structures (2) Max partition size in MBR is ~2TB whereas in UEFI it is ~9 ZetaBytes One zettabyte (1021) is approximately equal to a thousand exabytes or a billion terabytes. MBR can have at max 4 primary partition whereas GPT can have 128. MBR can store only one bootloader whereas GPT has a separate dedicated EFI System Partition(ESP) for storing multiple bootloaders. The MBR Boot Process Before the BIOS can detect the boot device, it goes through a sequence of system configuration functions starting with: • Power-on-self-test. • Detecting and initializing the video card.
    [Show full text]
  • FAT32 File Structure Prof
    FAT32 File Structure Prof. James L. Frankel Harvard University Version of 9:45 PM 24-Mar-2021 Copyright © 2021 James L. Frankel. All rights reserved. FAT32 Source Documentation • The reference document you should use is the Microsoft Extensible Firmware Initiative FAT32 File System Specification • On class web site under The NXP/Freescale ARM -> microSDHC Card • It is available on the class web site at https://cscie92.dce.harvard.edu/spring2021/Microsoft%20Extensible%20Firmware%20Initiative%20FAT32%2 0File%20System%20Specification,%20Version%201.03,%2020001206.pdf under Online Papers Used in Class • Important correction to this document concerns the DIR_CrtTimeTenth field in the FAT 32 Byte Directory Entry Structure • The name and description of this field is incorrect • Instead of DIR_CrtTimeTenth, we will use the name DIR_CrtTimeHundth • Here is the correct description of this field (to update the text on page 23): • Hundredths of a second time at file creation time. This field contains a count of hundredths of a second. Because the seconds portion of the DIR_CrtTime field denotes a creation time with a granularity of 2 seconds, this field contains a number of hundredths of a second (0 to 199, inclusively) that denotes a number of seconds from 0 to 1.99, inclusively, that may increment the number of seconds in addition to supplying the number of hundredths of a second. • There is also a typo on page 25 where a field is referred to as DIR_CrtTimeMil (which does not exist), and, as corrected here, should be DIR_CrtTimeHundth 2 SD Documentation • Documentation for the SD controller in the K70 • K70 Sub-Family Reference Manual, Rev.
    [Show full text]
  • Initial Bootloader Introduction
    initial bootloader Initial Bootloader Introduction On power-up, when a computer is turned on, the following operations are performed: 1. The computer performs a power on self test (POST) to ensure that it meets the necessary requirements and that the hardware is functioning properly. 2. A program located in the ROM BIOS, called the bootstrap loader, is executed. 3. When the bootstrap loader starts it searches for a boot sector and passes control to the boot sector's code area. A boot sector is the first sector of a disk and has a small program in its code area, known as the initial bootstrap program, that can load an operating system. The hardware can recognise a boot sector by hexadecimal signature number AA55 which marks the last two bytes of the sector. The bootstrap loader searches for boot sectors on a number of storage devices, including: ● floppy drives ● CD-ROM drives ● hard drives ● flash drives In almost all computers, the BIOS can be configured to change the order storage devices are searched to control their priority. For example, floppy drives normally have higher priority than hard drives, so if a bootable floppy disk is in the drive when the computer is switched on the computer will boot from the floppy disk; otherwise it will boot from media in another storage device, such as a hard disk. When booting from a hard disk or flash drive, the machine code in the master boot record normally examines the partition table (also in the master boot record), identifies the active partition (the partition that is marked as bootable), reads the boot sector, containing the volume boot record (VBR), from that partition, and then runs the machine code in the volume boot record in the same way code would be run from the boot sector in a floppy disk.
    [Show full text]