School of Forensic Science

M. Sc. Forensic Science

FSMS SII-5: Basic Concepts of Digital Forensics

UNIT - 2

Operating System

Dr. Kapil Shukla

Computer Architecture

Topics to be covered :
● Role of Operating System
● Boot Process
● Windows OS Architecture - FAT and NTFS File Systems
Operating System
● An OS is a program that controls the execution of application programs
and acts as an interface between applications and the computer
hardware.
● It can be thought of as having three objectives:
○ Convenience: An OS makes a computer more convenient to use.
○ Efficiency: An OS allows the computer system resources to be used in
an efficient manner.
○ Ability to evolve: An OS should be constructed in such a way as to
permit the effective development, testing, and introduction of new
system functions without interfering with service.
Role of Operating System
● The Operating System as a User/Computer Interface (Convenience)
● The Operating System as Resource Manager (Efficiency)
● Ease of Evolution of an Operating System (Ability to evolve)
The Operating System as a User/Computer Interface
The Operating System as Resource Manager
Ease of Evolution of an Operating System
● A major OS will evolve over time for a number of reasons:
○ Hardware upgrades plus new types of hardware
○ New services
○ Fixes
Boot Process
● Booting is basically the process of starting the computer. When the
CPU is first switched on it has nothing inside the Memory.
● In order to start the Computer, load the Operating System into the
Main Memory and then Computer is ready to take commands from the
User.
● Booting happens when we turned ON the power or the computer
RESTARTS.
● The system BIOS (Basic Input/Output System) makes the
peripheral devices active. Further, it requires that the boot device
loads the operating system into the main memory.
Boot Process - Boot Device
● A Boot device is a device that loads the operating system in Main
Memory.
● Moreover, it contains the instructions and files which start the
computer.
● Examples are the hard drive, floppy disk drive, CD/DVD drive, etc.
● Among them, the hard drive is the most used one.
Boot Process - Types of Booting
● There are two types of booting
● Cold Booting
○ A cold boot is also called a hard boot.
○ It is the process when we first start the computer.
○ The instructions are read from the ROM and the operating
system is loaded in the main memory.
● Warm Booting
○ Warm Boot is also called soft boot.
○ It refers to when we restart the computer.
○ Here, the computer does not start from the initial state.
Boot Process - Booting Steps

1. The Startup

2. BIOS: Power On Self Test

3. Loading of OS

4. System Configuration

5. Loading System Utilities

6. User Authentication
Boot Process - Booting Steps
1. The Startup

● It is the first step that involves switching the power ON.

● It supplies electricity to the main components like BIOS and processor.

2. BIOS: Power On Self Test

● It is an initial test performed by the BIOS.

● Further, this test performs an initial check on the input/output devices,
computer’s main memory, disk drives, etc.
● Moreover, if any error occurs, the system produces a beep sound.
Boot Process - Booting Steps
3. Loading of OS

● The operating system is loaded into the main memory.

● The operating system starts working and executes all the initial
files and instructions.

4. System Configuration

● The drivers are loaded into the main memory.

● Drivers are programs that help in the functioning of the
peripheral devices.
Boot Process - Booting Steps
5. Loading System Utilities

● System utilities are basic functioning programs, for example, volume

control, antivirus, etc.
● In this step, system utilities are loaded into the memory.

6. User Authentication

● If any password has been set up in the computer system, the system
checks for user authentication.
● Once the user enters the login Id and password correctly the system
finally starts.
Windows File System
Different Operating Systems use different file systems, while some OS support
multiple file system. Few file systems which are commonly used by Microsoft OS
include:

● FAT12
● FAT16
● VFAT
● FAT32
● NTFS
FAT12
● FAT (File Allocation Table) file system was developed by the DOS
operating systems.
● The first version of FAT used a 12-digit binary number(12 bits) for cluster
information, hence it was called as FAT12.
● It was useful for the smaller hard disks that came with the original IBM PC
(less than 16MB in size) and were also used to format floppy diskettes.
FAT16
● FAT16 was a standard file system for formatting hard disks for a long time, it
was developed for disks greater larger than 16MB.
● Uses 16-bit allocation table entries and is supported by all Microsoft
operating systems, from MS-DOS to Windows XP along with some
non-Microsoft operating systems, such as OS/2 and Linux. Thus, it was the
most universally compatible file system.
● Some drawbacks of FAT16 included its inability to scale well to large
disks since the cluster size increases as disk partition increases, lot of
space was wasted when a large disk greater than 2GB was formatted with
FAT16.
● It doesn’t support file-level security, that is, individual level permissions to
files and directories) and also does not support file-level compression, as
the entire drive needs to be compressed.
 FAT16
FAT-16 Directory Entry Attributes (one-bit each):
Each directory entry is 32 bytes: R: Read Only

• File Name (8 bytes) A: Archive (set when file modified, cleared

when backed up)
• Extension (3 bytes)
S: System File (file cannot be deleted by the
• Attributes (1 byte) del command)

• Reserved (10 bytes) H: Hidden File (file is not listed with dir
command)
• Time (2 bytes)
D: Directory
• Date (2 bytes)
V: Volume Label
• Block number of first file block (2 bytes)
• File size in bytes (4 bytes)
VFAT
● Virtual FAT or VFAT, is a file system driver introduced in Windows for
Workgroups 3.11 and was supported by Windows 95.
● It works in protected mode and allows usage of long filenames with
FAT16.
● VFAT is a program extension and not a file system, which handles
filenames over the 8 character limitations imposed by the original FAT16.
FAT32
● FAT32 uses a 32-bit allocation table and was first supported by the OSR 2
version of Windows 95 (95b). [OSR - OEM Service Release] [Original Equipment Manufacturer]
Advantages of FAT32 over FAT16 included:
● Efficient use of space with larger hard disks through small cluster sizes
● Support for larger partitions, up to 2TB in size, theoretically (Practically
supports up to 32GB)
● Better reliability, as includes backup copy of information in the boot record.
Disadvantages of FAT32 was that it is incompatible with several
● Versions of Windows such as MS-DOS, Windows 3.x,Windows 95a,Windows NT,
and some non-Microsoft operating systems (although FAT32 drivers were
available from third-party vendors for Windows 95, NT, and even non-Microsoft
operating systems such as Linux).
● Additionally, the overhead used by FAT32 can also slow performance slightly.
NTFS
● NTFS (New Technology File System) is the most secure file system for
computers running Microsoft Windows operating systems.
● NTFS was released in 1993 as a replacement to FAT file system on
Windows NT OS, followed by successive releases in Windows 2000, 2003
Server, XP and Vista.
● It was more robust and secure as compared to other Microsoft file systems.
NTFS handles partitions, where partitions are logical sections of a hard
disk which operate as a separate drive. Example: A hard disk could be
partitioned as C: , D: or E: drive on the computer.
● NTFS supports very large partition sizes (up to 16EB theoretically)and
permits creation of volumes that can span two or more partitions.
● It is more reliable since it supports hot fixing feature, wherein the OS
detects a bad sector on the disk and relocates the data from that sector to a
good sector, and marks the bad sector so that the system does not use it. It
happens in the background which does not require any user intervention.
Metadata and the Master File Table (MFT)
● Metadata is the information about a specific set of data, which contains
information such as author of the file, its size, and other technical information
hidden from the common user, that is, it is data about data.
● It describes a file, its format, its creation time, and other details.
● NTFS stores additional files which are hidden in the system and contain
information about users, files and other details.
● Whenever a disk is formatted to use NTFS, the files are created with their
locations being stored in these files, known as Master File Table (MFT) to
keep track of each file on the volume.
● FAT file system keeps track of files using a File Allocation Table,
● NTFS performs similar complex functions using a Master File Table.
NTFS Attributes
● A record stored in the MFT works with NTFS attributes, every file
and directory are viewed as a set of file attributes containing
information such as name, data, and security information by NTFS.
● The data which defines a file, and is used by the OS and other
software’s to decide how a file is accessed and used is called as
attribute.
● Every attribute has a code and might contain information on attribute’s
name and description in MFT.
MFT