Please enable JavaScript.

Coggle requires JavaScript to display documents.

Week 5 - Coggle Diagram

- - - - can be used to rack the location of the data
      - track timestamps
      - find out exposure of an image
  - - - least sig bytes listed first
    - - most significant byes first
- - - - master file table
        
        tracks all file records on a file system, including itself
      - fix up codes
      - MFT file record data
      - File record
        
        Header
        
        File
        
        identifies the record itself and defines a series of attributes
        
        ensures that it is not corrupted by the use of fix up arrays
        
        contains metadata that is important for the whole MFT record itself as a whole
        
        where attributes begin in record
        
        record sequence count
        
        physical size + logical size
        
        MFT record number
      - collection of files records stored in a NTFS volume
    - - a file who's parent directory has been deleted and MFT record is overwritten
  - - - resident
      - non-resident
    - - Standard Information attribute
        
        MAC
      - File Name Attribute
      - Data Attribute
      - Index Root Attribute
      - Index allocation attribute
    - - Named data stream
        
        directory contents in NTFS $130
        
        INDX records
      - Unnamed data stream
- - - - i.e. Windows 7 cannot boot to an EXT volume