Tracks & Advanced Format of Sectors In this article explain hard disk track and diffrent andvance format of sector and there uses.
Tracks
Platters have two surfaces, and each surface divides into concentric circles called tracks. They store all the information on a hard disk. Tracks on the platter partition hold large chunks of data. A modern hard disk contains tens of thousands of tracks on each platter. The rolling heads read and write from the inner to outermost part of the disk. This kind of data arrangement enables easy access to any part of the disk; therefore, hard disks get the moniker as random access storage devices.
Each track contains a number of smaller units called sectors. Every platter has the same track density. The track density refers to the compactness of the track circles so that it can hold maximum number of bits within each unit area on the surface of the platter. It also determines the storage capacity of data on the hard disk. It is a component of area density in terms of capacity and performance.
Sector
Tracks contain smaller divisions called sectors, and these sectors are the smallest physical storage units located on a hard disk platter. “Sector” is a mathematical term denoting the “pie-shaped” or angular part of the circle, surrounded by the perimeter of the circle between two radii. Each sector normally stores 512 bytes of data, with additional bytes utilized for internal drive control and for error correction and detection. This added information helps to control the drive, store the data, and perform error detection and correction. A group of sectors combines in a concentric circle to form a track. The group of tracks combines to form a surface of the disk platter. The contents of a sector are as follows:
- ID information: It contains the sector number and location that identify sectors on the disk. It also contains status information of the sectors
- Synchronization fields: The drive controller drives the read process using these fields
- Data: it is the information stored on the sector
- ECC: This code ensures integrity of the data
- Gaps: Spaces used to provide time for the controller to continue the read process
Related Product : Computer Hacking Forensic Investigator | CHFI
These elements constitute sector overhead. It is an important determinant in calculating time taken for accessing. As the hard disk uses bits for disk or data management, overhead size must be very less for higher efficiency. The file on a disk stores the data in a contiguous series for optimal space usage, while the system allocates sectors for the file according to the size of the file. If file size is 600 bytes, then it allocates two sectors, each of 512 bytes. The track number and the sector number refer to the address of any data on the hard disk.
Advanced Format: Sectors
New hard drives use 4096 byte (4 KB or 4 K) advanced format sectors. This format uses the storage surface media of a disk efficiently by merging eight 512-byte sectors into one single sector (4096 bytes). The structure of a 4K sector maintains the design elements of the 512-byte sector with representation of the beginning and the error correction coding (ECC) area with the identification and synchronization characters, respectively. The 4K sector technology removes redundant header areas, lying between the sectors.
Clusters
Clusters are the smallest accessible storage units on the hard disk. The file systems divide the volume of data stored on the disk into discreet chunks of data for greater performance and efficient disk usage. Clusters form by combining sectors in order to ease the process of handling files. Also called allocation units, the dusters are sets of tracks and sectors ranging from 2 to 32, or more, depending on the formatting scheme. The file allocation systems must be flexible in order to allocate the required sectors to files. It can be the size of one sector per cluster. Any read or write will consume the minimum space of one cluster.
To store a file, the file system should assign the required number of clusters to them. The cluster size totally depends on the disk volume. For disk volumes, each cluster varies in size from four to 64 sectors. In some cases, a cluster size may be of 128 sectors. The sectors located in a cluster are continuous. Therefore, every cluster is a continuous chunk of space on the hard disk. In a cluster, when the file system stores a file relatively smaller than size of the cluster, extra space gets wasted and called as slack space.
Cluster Size:
Cluster sizing has a significant impact on the performance of an operating system and disk utilization. Disk partitioning determines the size of a cluster and larger volumes use larger cluster sizes. The system can change the cluster size of an existing partition to enhance performance. If the cluster size is 8192 bytes, to store a file of 5000 bytes, the file system allocates whole duster to the file and allocates two clusters of 16,384 bytes if the file size is 10,000 bytes. This is why cluster size plays a vital role in maximizing the efficient use of the disk.
By using a large cluster size, the fragmentation problem diminishes, but it will greatly increase the chances of unused space. The file system, running on the computer, maintains the cluster entries.
Clusters form chains on the disk using continuous numbers for which it is not required to store the entire file in one continuous block on the disk. The file system can store it in pieces located anywhere on the disk as well as moue it anywhere after creating the file. This cluster chaining is invisible to the operating system.
Users can change the cluster size only when reformatting the drive. Following are the steps to change the cluster size:
- Right-dick the drive that you want to format, and select Format
- In the Format dialog box, choose the allocation unit size that you wish the newly formatted drive to use. You can set the cluster size from 521 bytes to 4096 bytes
Slack Space
Slack space is the wasted area of the disk cluster lying between end of the file and end of the duster when the file system allocates a full cluster to a file, which is smaller than the cluster size.
More files with larger cluster sizes results in wasted disk space due to overhead attached to them. DOS and Windows file systems use fixed-size clusters. Size consumed is irrelevant of the data storage, but the file system reserves entire space for the file. The older versions of the Windows operating system and DOS used a 16-bit allocation table, which results in the large cluster size for large partitions. For example, if the size of each partition is 4 GB and the size of each cluster is 32 K, and a file requires only 10 K, the system will allocate whole 32 K cluster, resulting in 22 K of slack space.
To eliminate this inefficiency, the system uses partitioning. Another approach to reduce the slack space is to use NIB, which allows much smaller clusters on large partitions. Archiving infrequently used files can also use compression to reduce slack. As the size of disks is increasing, this slack space problem is gaining much more importance.
Also Read : Hard Disk Interfaces
File Slack Types
- RAM Slack
RAM slack is the data storage space, which starts from the end of a file to the end of the last sector of the file, -
Drive Slack
Drive Slack is the data storage space, which starts from the end of the last sector of a file to the end of the last cluster of file.
In the field of forensic investigation, slack space is an important form of evidence. Often, slack space can contain relevant suspect information, required by the prosecutor to present as evidence in the court. For example, if the suspect deleted files of the entire hard drive cluster and saved new files, which filled half of the cluster, the other half may not be empty. It can contain the information of the deleted files, Forensic examiners can collect this data by using computer forensic tools.
Lost Clusters
A lost cluster is a File allocation table (FAT) error that results when the operating system marks clusters as used but does not allocate them to any file. The error occurs from the process FAT file system, uses to assign spaces and group files together. It is mainly a logical structure error and not a physical disk error.
Lost clusters occur when the user does not close files properly or shuts down a computer without closing an application. These errors also occur due to disk corruption such as bad drivers, resource conflicts, etc.
Operating systems mark these clusters as in use, even though they have no files assigned or linked to them. Disk checking programs can examine a complete disk volume far lost clusters. To detect lost clusters, use the program that can save them as a file or clear them. The latter case will generate and link artificial files to these clusters. This method will damage newly formed file afterward, but orphaned data is visible and it is possible to recover some parts.
Disk checking programs can scan the computer system for lost clusters using the following procedure:
- Generate a duplicate copy in the memory of FAT, noting all of the clusters marked as “in use”
- Trace the clusters, beginning from the root directory, utilized by a file, and mark them as “accounted for”, to connect them to a file. Then follow the same procedure for all the subdirectories
- Lost clusters or “orphan” clusters are the ones in use but have no account for
Chkdsk.exe or Check Disk is a built-in Windows utility that helps to detect errors in the file system and disk media. We can run the Check Disk utility If we face problems like, blue screens, difficulty to open or save files or folders. This utility also checks for bad sectors, lost clusters etc.
Steps to use the command line check disk version:
- Open Command Prompt by typing cmd in the Run utility
- Type chkdsk in the command prompt. It will run chkdsk in the Read-Only mode
- This will display the status of the current drive
Bad Sectors
Bad sectors refer to the portions of a disk that are unusable due to some flaws in them and do not support the read or write operations. The data stored in bad sectors is not completely accessible. Bad sectors might be due to configuration problems or any physical disturbances to the disk. Logical errors or bad sectors are the corrupted files on the magnetic media created by problems such as unexpected voltage surges, read/write activities, changes in boot records, viruses, etc. To detect bad sectors on the drive, use a technique called re-mapping or spare sectoring to hide bad sectors. The operating system marks the bad sectors as unusable, while formatting the disk. Users can eliminate these problems to some extent by not putting the hard disk timing too high for the drive, not using an IDE cable that is too long, using correct BIOS settings, and eliminating configuration bottlenecks. If there is some data that becomes damaged, special software that checks for and repairs bad sectors can recover it. Microsoft provides <scandisk> and <chkdsk> utilities for checking and repairing the bad sectors.
Questions related to this topic
- What is a cluster size when I format?
- How many bytes are in a cluster?
- How does block cluster size affect a file system?
- What is best cluster size for NTFS?
This Blog Article is posted by
Infosavvy, 2nd Floor, Sai Niketan, Chandavalkar Road Opp. Gora Gandhi Hotel, Above Jumbo King, beside Speakwell Institute, Borivali West, Mumbai, Maharashtra 400092
Contact us – www.info-savvy.com
