Glossary
Attributes are usually referring to the DOS attributes Archive, Read/Only, Directory, Hidden, System, Volume.
In NTFS attributes are structures entirely describing a file (see: NT Attributes).
A Boot record is a special sector describing the file system following this sector.
A cache is an area in RAM that holds a copy of disk data. This speeds up accessing this data.
Making an exact sector-by-sector image of a drive. This is recommended when you want to perform a data recovery or a forensic investigation of a drive or when the drive has physical damage (bad sectors). With the image you can work as you could work with the original drive.
A cluster is the smallest unit addressable by the file system. A cluster is always a multiple of a sector. Typical cluster sizes are 1, 2, 4, 8, 16, 32, 64, 128 sectors.
The process of retrieving files from a drive that cannot be accessed from its operating system anymore.
The DiskExplorer uses this term for the most obvious link when navigating through a drive.
A file is deleted in a FAT file system by overwriting the 1st character of its directory entry with xE5 and by releasing the FAT entries of the clusters it used. In NTFS a file is deleted by removing its reference in the MFT.
DiskExplorer uses this term to indicate that all changes are directly written to the drive. (See: Read/Write Modes)
In NTFS a directory is a list of Index Entries.
Name of a file system using a "file allocation table". Introduced with DOS and used in all Windows versions.
The file system (such as FAT or NTFS) is the scheme how a file is store on a disk. Do not confuse it with the operating system (such as Windows95 or WindowsNT).
The hexadecimal system is based on the number 16, other than the decimal system which is based on 10. The supplemental digits are A, B, C, D, E and F. Example: hex AA = dec 170. (10*16 + 10*1).
DiskExplorer uses this concept to provide browser-style back and forward capabilities (see Navigation).
An index allocation is the outside value of the non-resident $A0 attribute, which contains a list of file names establishing a directory.
An image file is a sector-by-sector copy of a drive. It can be used as a source for DiskExplorer
NTFS uses attributes to store the LFN (long file name).
The DiskExplorer uses the term link for the jump targets you can navigate to from the current position.
Logical drives are drive like A:, B:, C:, ... They are accessed using the according operation system routines.
Flag byte in the boot record describing the kind of drive. Usually xF8 for hard drives.
The MFT is a database containing information about every file or directory on a NTFS volume. An entry is called MFT entry or file entry.
The MFT number is the position of a file entry within the MFT.
DiskExplorer's concept of navigating through a drive.
Non-resident Attribute
see: NT Attributes
NTFS is a file system introduced with WindowsNT, used by Windows NT, Windows 2000 and Windows XP.
The NT Attributes describe every aspect of a file in NTFS, such as file names, time stamps, file sizes, data allocations and more:
Number Name Description $10 Standard information contains time stamps and DOS attributes $30 File name contains the file's name for different name spaces (usually NT's native Unicode file name and DOS compatible DOS file name) $80 Data if the entry represents a file, this attribute contains the file's data $90 Index root if the entry is a directory, this attribute describes the root of a binary tree in which the directory entries are located $A0 Index allocation if the entry is a directory, this attribute contains a list of file names NT Attributes can be resident or non-resident. Resident attributes are stored within the MFT entry. Non-resident attributes are store outside using run lists.
Offset describes the position within a sector, 0..511.
A partition entry describes type, location and size of a partition.
The partition table is a list of partition entries located in sector 0 of a drive. If a drive contains "extended partitions", there is a linked list of several partition tables on the drive.
Physical drives are tangible media like hard drives and diskettes. They are accessed through low-level BIOS functions.
DiskExplorer uses this term to indicate that the drive is write-protected. (See: Read/Write Modes)
Resident Attribute
see: NT Attributes
A file system's root directory constitutes the root of the directory tree.
In NTFS the root directory is described by the index buffer of MFT entry #5.
A run list is a list of clusters used for an NT Attribute. If the attributes are too large to fit into the MFT entry, some of them will be non-resident, meaning the value part the specific attribute will be found outside of the entry. In this case the outside data allocation will be described by a run list.
A Sector is the smallest unit that can be accessed on a drive. The size of a sector is always 512 bytes. Multiple sectors are grouped to "clusters".
This term describes the cluster size the file system is using. It is essential for translating a cluster number into a physical sector number.
DiskExplorer uses this term to indicate that the drive is using a 10000 sector cache for changes. (See: Read/Write Modes)
DiskExplorer uses this term to indicate a volume with its structure stored in memory.