Data Recovery Technical notes
first, the basic noun
Abbreviations |
English |
English |
Dos |
Disk Operating System |
Disk Operating System |
Mbr |
Main Boot Record |
Master Boot Record |
LBA |
Logical Block Address |
Logical Block Address |
Dpt |
Disk Partition Table |
Hard disk partition Table |
EBR |
Extended Boot Record |
Extended Boot Record |
Ldm |
Logic Disk Manager |
Logical Disk Management |
Gpt |
GUID Partition Table |
Globally uniquely identifies a disk partition table |
Efi |
Extensible Firmware Interface |
Extensible Firmware Interface |
Bios |
Basic Input/output System |
Basic input/output system |
Oem |
Original Equipment Manufacturer |
Original Equipment Manufacturer |
ii. File System
1. File system type
FAT12, FAT16, FAT32, NTFS, ExFAT
Abbreviations |
English |
English |
FAT |
File Allocation Table |
File configuration table |
Ntfs |
New Technology File System |
New File system |
Dbr |
DOS Boot Record |
DOS Boot Record |
FDT |
File Directory Table |
File directory Table |
BPB |
BIOS Parameter Block |
BIOS Parameter Block |
Efs |
Encrypting File System |
Encrypting File System |
FEK |
File Encryption Key |
File encryption key |
2. NTFS system
NTFS file system benefits: Security, recoverability, file compression, disk quotas, B + Tree file management
Abbreviations |
English |
English |
LCN |
Logical Cluster Number |
Logical Cluster number |
VCN |
Virtual Cluster Number |
Virtual cluster number |
Mft |
Master File Table |
Master File Table |
FR |
File Record |
File records |
No |
Metadata |
Meta-file |
3. The NTFS file system meta-file
Starting with "$" means that the file is hidden, the user cannot access and modify it, and the main 16 are the following:
Serial Number |
name |
English |
Description |
0 |
The MFT itself |
($Mft) |
The primary file table itself, which is the index of each file |
1 |
MFT Mirroring |
($MIFMIRR) |
Partial mirroring of the master file |
2 |
Log file |
($LogFile) |
Transaction-type log files |
3 |
Volume files |
($Volume) |
Volume file, record volume label and other information |
4 |
Property Definition Table |
($ATTRDEF) |
Property Definition list File |
5 |
root directory |
($Root) |
root directory file, managing root directory |
6 |
Bitmap file |
($Bitmap) |
Bitmap file that records the use of clusters in a partition |
7 |
Boot file |
($Boot) |
Boot file that records the data used for system boot |
8 |
Bad cluster file |
($BadClus) |
Bad cluster list file |
9 |
Disk quotas |
($Quota) |
Disk quota information in earlier Windows NT systems |
10 |
Security files |
($Secure) |
Security files |
11 |
Uppercase file |
($UpCase) |
Uppercase and lowercase character conversion table file |
12 |
Extending Metadata Files |
($Extended metadata Diectory) |
Extended Metadata Catalog |
13 |
Reparse point file |
($Extend \ $Repares) |
Reparse point file |
14 |
Change log file |
($extend \ $UsnJml) |
Encrypt log files |
15 |
Quota Management Files |
($Extend \ $Quota) |
Quota Management Files |
16 |
Object ID File |
($Extend \ $ObjId) |
Object ID File |
4. ExFATExtension file allocation table for ExFAT (Extended file Allocation table file System):
File system for Flash
5. File System Alignment does not support disk quotas
NTFS file format |
FAT32 file format |
FAT16 file format |
supports a single partition greater than 2G |
supports a single partition greater than 2G |
single partition less than 2G |
Support disk quotas |
does not support disk quotas |
Support file Compression (System) |
does not support file compression (System) |
does not support file compression (System |
supports EFS file encryption system |
does not support EFS |
does not support EFS |
resulting disk fragmentation is more Less than |
produces a moderate amount of disk fragmentation |
results in more disk fragmentation |
suitable for large disk partitions |
suitable for small and medium disk partitions |
suitable for small and 2G disk partitions |
support WindowsNT |
Support 9x, not supported NT4.0 |
does not support Win2000, supports nt,9x |