Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Digital Forensics > Microsoft Windows Storage Architecture > Flashcards

Microsoft Windows Storage Architecture Flashcards

1
Q

I/O Subsystem:

A

Sends I/O requests to file systems

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

File Systems:

A

Provides structure on raw volumes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Volume Snapshot Manager:

A

Manages snapshots

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Volume Manager:

A

Presents volumes and manages dynamic volume collections

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Partition Manager:

A

Manages partitions on volumes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Class Drivers:

A

Manages device types

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Port Drivers

A

Manages a specific transport

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Miniport Driver:

A

Provides hardware-specific functionality for a specific port driver

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Disk Subsystem:

A

Physical storage device

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

The storage driver architecture deviates from the standard Windows Driver model, only the topmost class drivers conform to the model, whereas lower-level drivers use…

A

Specialised interfaces: Port drivers can be considered a collection of support used in turn by miniport drivers

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

Windows provides Disk.sys as a class driver for…

A

Mass storage

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

Windows provides a number of port drivers, such as Storport.sys for…

A

Current storage components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Windows provides Sciport.sys and Ataport.sys for…

A

Legacy components

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Legacy drivers provide…

A

Disk scheduling

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

RAID arrays do not need…

A

Head movement and rotation optimisation and would even suffer degradation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

iSCSI:

A

An example of Storage Area Network (SAN) protocols must communicate via the regular TCP/IP protocol stack and requires further services for management

17
Q

Multipath I/O:

A

For high availability environments, some storage devices may be connected through multiple paths

18
Q

The Windows kernel doe snot use drive letters - this is an artefact of the user-land interface, instead…

A

The Object Manager retains a name space for device objects including disks, disks are then provided separate symbolic aliases: \Global??\PhysicalDriveX is thus linked to \Device\HardDiskX\DRX

19
Q

The Partition Manager acts as…

A

Function driver for disk devices and maintains the Master Boot Records (MBR) and GUID Partition Tables (GPT) on disk

20
Q

Storage Architecture - Miniport Drivers hide much of…

A

The lower-level functionality

21
Q

Storage Architecture - For SATA drives, the Advanced Host Controller Interface (AHCI) offers such an…

A

Intermediate layer; Microsoft’s StorAHCI driver covers most devices

22
Q

Storage Architecture - For solid-state drives, this is largely superseded by…

A

Non-Volatile Memory Host Controller Interface Specification (NVMHCI) supported since Windows 8.1/Server 2012R2

23
Q

Storage Architecture - The current NVM Express (NVMe) driver is substantially faster compared to…

A

SATA/SAS as it does not carry the SCSI or ATA interface legacy for hard disks

24
Q

The Virtual Disk Service (VDS) subsystem’s Logical Disk Manager (LDM) maintains…

A

A single database containing partition information for all dynamic disks, including multi-partition logical volumes

25
Q

Dynamic Disk Concepts - The database resides in a reserved space (1MB) at the end of each dynamic disk divided into…

A

Records for disks, partitions, components, volumes, a table of contents and private headers

26
Q

The precise location of the LDM database depends on whether…

A

The dynamic disk it resides on is a GPT or MBR partition

27
Q

Translating offsets into volumes for file systems is more involved for multi-partition volumes

A
  • Logical partitions making up a volume can reside on non-contiguous partitions or disks
  • Most RAID configurations result in data being divided into different locations
  • Although there are multiple variants, Windows supports only simple spanned volumes and RAID levels 0,1 and 5
28
Q

RAID Level 0 - Striping:

A

This provides no redundancy and increases the failure rate, but enhances performance and allows grouping of disks

29
Q

RAID Level 1 - Mirroring:

A

Used for enhancing reliability or performance - in an intact array, each drive can be read in a different location

30
Q

RAID Level 5 - Block-Level Striping:

A

Parity data is distributed across all disks, reducing overhead while enhancing reliability. Performance is dependent on parallel block access

31
Q

Volume Shadow Copy Service (VSS) allows snapshots to be taken of file systems:

A
  • Clone Shadow Copies

* Copy-on-Write

32
Q

Clone Shadow Copies:

A

A split mirror duplicates a volume by software or hardware mirroring, divided into a live and mirror volume - only the live volume is writable

33
Q

Copy-on-Write:

A

A differential copy only retains changes to the live data on the shadow volume, requiring overlaying with the live data to recreate an earlier state

34
Q

From Windows 8/8.1 on volume shadow copy VSC has been offered but required…

A

A second drive to extract the shadow copy - although not documented, this seems to have deprecated

35
Q

File History (FH) service relies on similar differential/journaling structures as…

A

VSS but operates on files rather than blocks

36
Q

FH acts as a backup service and also includes…

A

User data (Libraries, Desktop, Contacts and Favourites)

37
Q

Regular users may recover deleted or previous versions of file and folders which allows…

A

Forensic examiners to do the same, ideally with access to the drive on which backups are retained

38
Q

The actual amount of storage taken up by File History, the frequency and time horizon can be configured:

A
  • Within the alternate data stream, files are saved with an appended date/time stamp
  • If external storage medium for journal backup is not available, a local cache is used
  • On connecting the backup volume, the cache folder is moved to the backup volume and emptied

Digital Forensics (26 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions