CS609 Final Term Subjective Paper Solved with references March (2014)

Transcription

1 CS609 Final Term Subjective Paper Solved with references March (2014) Q1. How larger file contents can be managed using FAT? 2 marks - Larger files would be comprised of numerous clusters. The first Cluster # can be read from FCB for rest of the Cluster, a chain is maintained within the FAT. As large files would be composed of many clusters the first Cluster number is obtained from FCB and the subsequent clusters can be obtained from FAT by using the previous cluster Number to obtain the next cluster number and so on. In order for FAT to manage files with satisfactory efficiency, it groups sectors into larger blocks referred to as clusters. A cluster is the smallest unit of disk space that can be allocated to a file, which is why clusters are often called allocation units. Each cluster can be used by one and only one resident file. Only the "data area" is divided into clusters, the rest of the partition is simply sectors. Cluster size is determined by the size of the disk volume and every file must be allocated an even number of clusters. Cluster sizing has a significant impact on performance and disk utilization. Larger cluster sizes result in more wasted space because files are less likely to fill up an even number of clusters. Q:2 When we talk about FAT32, what is the size of FS Info block? 2 marks On a FAT32 volume, the FAT can be a large data structure, unlike on FAT16 where it is limited to a maximum of 128K worth of sectors and FAT12 where it is limited to a maximum of 6K worth of sectors. FS Info block contains information required at the time of allocation/de-allocation to the file. Size of FAT 32 is huge at allocation/de-allocation time so calculating these values is not feasible, therefore these are stored in FS Info block. Q:3 Which control information PSP contains? 2m PSP is situated before the start of a process. Contains control information like DTA (Disk Transfer Area) and command line parameters. Contains the Segment address of the PSP and the program controlled by MCB. The Sony PSP contains technology that is fairly advanced. This webpage details all the different PSP models ranging from the original PSP (from now on called PSP Fat), to the later PSP Slim, PSP Brite, and PSP Go. Main PSP Features One of the main features of the PSP is being a high tech gaming gear. The gaming engine hardware is as powerful as a full size PS2, but at a quarter of the size. The PSP allows game playing mainly through UMD discs, but you can also load the game via the Memory Stick (or

2 internal Flash in the PSP Go). The /PSP/GAME directory of the Memory Stick can contain any directory having an EBOOT.PBP file (the game executable), which will end up showing in the "GAME->Memory Stick" XMB menu screen. From there, you can select it to run it. Although the gaming functionality is the main selling point of the machine, after using it awhile, you will start appreciating the picture viewer, MP3 player (with speakers) and MPEG4 video player. You can actually squeeze a DVD movie onto a memory stick and play it on the wide-screen LCD display. Q:4 Which is the location of timer count in BIOS data area? Timer location in BIOS data area is 40:6CH. 2 Marks Q:5 Explain the purpose of file control block(fcb)? 3 Marks Control information about files is maintained in a data structure called the File control block (FCB). The FCB for each file is created and stored in the disk. We can get information about the file such as size, date time of creation, data time of last modification etc from FCB. Further we can also impose restrictions on file such as read only, archived etc using FCB. A file control block (FCB), also called a file descriptor, is a type of data structure that is temporarily allocated by a computer operating system to maintain the status of a data file that is being created or otherwise manipulated. In most instances, a file control block is used to store basic information about a file, such as its name, extension and location on a logical drive, as well as dynamic information such as the current address within the file that is being read. Originally, a file control block was a very well-defined structure under certain operating systems, but it since has become a more generic term for the structure used to track information about an actively handled file. One important purpose of a file control block is to help the file system keep track of what state the file is in to prevent different operations from attempting to modify the file in conflicting ways, such as reading from an area of the file that is currently being written to. The structure not only is used for data files, but also can be used to track information about directories, although the data structure usually is shortened to remove unnecessary fields, because a directory cannot contain data. Q:6 In NTFS, where the backups of boot block are stored and why? 3 Marks The NTFS "Backup Boot Sector" is not really part of the NTFS Volume; it's actually stored in a sector immediately following the last sector of the Volume, which makes an NTFS Volume's partition size 1 sector larger than its Volume size! If the NTFS boot sector is damaged, data cannot be accessed. Windows will prompt the drive is not formatted, do you want to format it now? Linux mount will display wrong fs type, bad option, and bad superblock. TestDisk can use the backup boot sector to fix a corrupted NTFS boot sector. The primary boot sector is sector zero of the file system and the backup NTFS boot sector is located near the end of the file system. Even if the boot sector is accidentally overwritten, the backup should be intact. TestDisk checks the boot sector and the backup boot sector.

3 Q:7 What are three different kinds of computer viruses? 3 Marks Types of Viruses Partition Table Virus Boot Sector Virus File Viruses Q:8 Write a C program that should print your name using int 21H with the help of int86 function See Page#19 for idea solution detail Idea solution: #include <dos.h> union REGS regs; main() { regs.h.ah = 0; regs.h.al = 1; int86( 0x10, &regs, &regs ); printf("fourty by Twenty-Five color mode."); Q:9 What will be the impact of placing E5 in place of first character of file name? 5 marks DOS perform file deletion by placing 0xE5 at the first byte of it FCB entry and placing 0's (meaning available) in the entries for the file clusters in the FAT. The only difference that has occurred is that the first character has been replaced by a byte with the value 0xE5. Two tasks should be performed successfully to undelete a file -- Replacing the 0xE5 entry in FCB by a valid file name character. -- placing the appropriate values in FAT for representation of file cluster chain. If any one of the above cannot be done then the file cannot be fully re cove re d. Q:10 How partition table virus fools DOS about conventional memory? 5 marks The transient part of Command.Com loads itself such that its last byte is loaded in the last byte of Conventional Memory. If somehow there is some Memory beyond Command.Com s transient part it will not be accessible by DOS.

4 At 40:13H a word contains the amount of KBs in Conventional Memory which is typically 640. If the value at 40:13H is somehow reduced to 638 the transient part of Command.Com will load itself such that its last byte is loaded at the last byte of 638KB mark in Conventional RAM. In this way last 2KB will be left unused by DOS. This amount of memory is used by the Virus according to its own size. Q:11 Write down a TSR program, when ever user presses a key it displays it thrice. For example if user has pressed "A" it will display "AAA"? 5 marks #include <dos.h> Void interrupt (*old)( ); Void interrupt newfunc ( ); Void main ( ) { old = getvect(0x09); setvect (0x09,newfunc); keep(0,1000); void interrupt newfunc ( ) { (*old)( ); (*old)( ); (*old)( ); This program simply intercepts the keyboard interrupt and places the address of newint in the IVT. The newint simply invokes the original interrupt 9 thrice. Therefore the same character input will be placed in the keyboard buffer thrice i.e. three characters will be received for each character input. Paper 2: Q:2 Write down autonomy of NTFS file system?

5 In NTFS based system. The FAT and root Directory has been replaced by the MFT. It will generally have two copies the other copy will be a mirror image of the original. Rests of the blocks are reserved for user data. In the middle of the volume is a copy of the first 16 MTF records which are very important to the system. Write the limitation of bios disk()? Large sized disk are available now with thousands of tracks But this BIOS routine only is capable of accessing a max. Of 1024 tracks. Hence if a large disk is being used not whole of the disk can be accessed using this routine This function uses the int 13H services. The parameter sizes provided by these services may not be sufficient to hold the track number of block to be accessed. Q: 6 LSN = 0 and LBA = 0 are same things? Why if yes or no? Why not? 3m LBA = 0 is not the same as LSN=0. The LBA=0 block is the first block on disk. Whereas each logical partition has LSN=0 block which is the first block in logical drive and is not necessarily the first block on physical drive. Q:7 Major enhancements on FAT 32 comparing with FAT 12 and FAT 16? The major difference between FAT 16 and FAT 32 is of course the FAT size. FAT32 evidently will contain more entries and can hence manage a very large disk whereas FAT16 can manage a space of 2 GB maximum practically. The numerals in the names FAT12, FAT16, and FAT32 refer to the number of bits required for a file allocation table entry. FAT12 uses a 12-bit file allocation table entry (2 12 clusters). FAT16 uses a 16-bit file allocation table entry (2 16 clusters). FAT32 uses a 32-bit file allocation table entry. However, Windows 2000 reserves the first 4 bits of a FAT32 file allocation table entry, which means FAT32 has a theoretical maximum of 2 28 clusters. Q:8 In DMA what is purpose of count register? Number of bytes to be loaded is placed in the count register. The lower 16bits are loaded in the base address register and the number of bytes to be loaded is placed in the

6 count register. Each DMA channel has associated with it a 16 bit address register and a 16 bit count register. To initiate a data transfer the device driver sets up the DMA channel's address and count registers together with the direction of the data transfer, read or write. It then tells the device that it may start the DMA when it wishes. When the transfer is complete the device interrupts the PC. Whilst the transfer is taking place the CPU is free to do other things. Q:9 Difference between COM file and DOS EXE? The main difference in COM File and DOS EXE File is that the COM File starts its execution from the first instruction, whereas the entry point of execution in EXE File can be anywhere in the Program. COM File is a mirror image of the program code. Its image on disk is as it is loaded into the memory. COM Files are single segment files in which both Code and Data resides. COM File will typically have a Three Bytes near Jump Instruction. The entry point in case of EXE File is tempered by the Virus which is s to red in a 27-byte header in EXE File. Q:11 Calculate the sector no for the following ICH we have the following info blocks per cluster = 8 first user block number = 20 Sector No. = (Clust_no - 2)* Blocks per Clust + First User Block # Sector No. = (2)* 8 +20=36 Q:12 Find the root directory sector where reserved sector = 1 and sector per FAT = 9, use appropriate assumption? Root dir sector=reserved sector+2 *(sector per FAT)=1+2*9=19 2) Suppose we read the contents of Drive parameter block and get the following information. Number of reserved blocks=2 Number of blocks in FAT= 7 Number of blocks in root directory=32 Find the number of systems blocks. Make the appropriate assumptions when needed. Now in the example sector per FAT is unknown. No. of System Area Blocks = Reserved Block + Sector per FAT * No. of FAT's + No. of entries * Root dir =reserved sector+2*sector per FAT

7 2*sector per FAT= Root dir - reserved sector=32-2=30 Sector per FAT=30/2=15 No. of System Area Blocks = * =151 Write three Data Structures for Memory DOS use? MCB (Memory Control Block) EB (Environment Block) PSP (Program Segment Prefix) 2) Scan Disk Surface Scan for Bad Sectors It attempts to write a block. After write it reads back the block contents. Performs the CRC test on data read back. If there is an error then the data on that block is not stable and the cluster of that block should be marked bad. The cluster is marked bad by placing the appropriate code for bad cluster so that they may not be allocated to any file. 5) Structure of Partitioning Table Total size of Partition Table is 512 bytes. First 446 bytes contains code which loads the boot block of active partition and is executed at Boot Time. Rest of the 66 bytes is the Data part. Last two bytes of the Data part is the Partition table signature. 6) Find root dir if reserved sector = 1 and size of fat is 9? Root DIR Sector: Reserved sectors +2 * (size of FAT) = * 9 = 19 Write the functionality of abs read and abs write? abs read( ) is used to read a block given its LSN abs write( ) is used to write a block given its LSN absread(int drive, int nsects, long lsec, void *buffer); abswrite(int drive, int nsects, long lsec, void *buffer);

8 File size is 12k and cluster size is 4 is k shyd blocks find krne thy 2 marks Number of blocks within a cluster is in power of 2=4 2 =16 1st sector no formula 2 marks The boot sector is the first sector in a series of reserved sectors. The size of a sector (in bytes) is recorded in the boot sector; it is typically 512 bytes for hard disks. The CompactFlash specification standardizes a sector to 512 bytes. On hard disks, the first sector is called variously the master boot record, the partition sector, or the partition table. This record or table tells how and whether the disk has been divided into logical partitions (for example, you can divide your hard drive into two logical partitions or drives so that you can load different operating systems on to the disk and switch back of forth).

9 Write the formula of direct addressing? 2 marks segment*10h+offset 1st user block no given, Blocks per cluster is given find the sector. Sector No. = (Clust_no - 2)* Blocks per Clust + First User Block # Name three descriptor table 3 marks 1. Global descriptor table (GDT) 2. Local descriptor table (LDT) 3. Interrupt descriptor table (IDT) If LSN given then how to read a block 3 marks If the LSN address is known the absread () function can be used to read a block and abswrite() can be used to write on it. What is the purpose of control register in DMA 3 marks The purpose of the DMA Control Register for each channel is to control the operations of that DMA channel. lists the purposes of the individual bits in the DMA Control Register. The DMA Control Register is: in CP15 c11 one 32 bit read/write register for each DMA channel common to Secure and Nonsecure worlds Accessible in user and privileged modes. Purpose: Controls the DMA transfer request mechanism. Usage constraints: There are no usage constraints. Configurations: This register is available in all configurations. Attributes: Offset 0xC10, Type RW, Reset 0x , Width32. Address translation from logical to physical 3 marks seg * 10H + offset for Logical to Physical address translation Modem controller register?

10 In case software oriented flow control technique is used the bits 0 and 1 need to be set in that case. Bit #3 need to be set to enable interrupts. Moreover if a single computer is available to a developer the UART contains a self test mode which can be used by the programmer to self test the software. Keyboard writing protocol...5 marks Wait till input buffer is full Write on buffer Wait till output buffer is full Check the acknowledgement byte Repeat the process if it was previously unsuccessful. Mathematical translation for LBA translation? LBA address = (C * H' +H)* S' + S - 1 Where C = Selected cylinder number H' = No. of heads H = Selected head number S'=Maximum Sector number S= Selected Sector number Boot block structure, jmp code part OSName BIOS

11 Parameter Block codepart: A jump instruction (near jump of 3 bytes size) is used to jump to the code part and skip the data part so that it is not interpreted as instructions by the processor. Find root dir sector.5 marks Formula :Root Dir Sector= reserved sectors +2 * (size of FAT) Paper no 3 1. How large file contain can be managed using FAT? Larger files would be comprised of numerous clusters. The first Cluster # can be read from FCB for rest of the Cluster, a chain is maintained within the FAT. Answer in simple words is in green as large files would be composed of many clusters the first Cluster number is obtained from FCB and the subsequent clusters can be obtained from FAT by using the previous cluster Number to obtain the next cluster number and so on. What do you mean by mirroring in FAT32? The FAT and root directory has been replaced by the MFT. It will generally have two copies the other copy will be a mirror image of the original. Rests of the blocks are reserved for user data. In the middle of the volume is a copy of the first 16 MTF records which are very important to the system. On all FAT drives, there may be multiple copies of the FAT. If an error occurs reading the primary copy, the file system will attempt to read from the backup copies. On FAT16 and FAT12 drives, the first FAT is always the primary copy and a modification will automatically be written to all copies. However, on FAT32 drives, FAT mirroring can be disabled, and a FAT other than the first one can be the primary (or "active") copy of the FAT. 3. Enlist all the activities that are to be performed when interrupt 9 occurs? The service 15H/4FH is called the keyboard hook service. This service does not perform any useful output; it is there to be intercepted by applications which need to alter the keyboard layout. It called by interrupt 9H after it has acquired the scan code of input character from the keyboard port while the scan code is in AL register. When this service returns interrupt 9H translates the scan code into ASCII code and places it in buffer. This service normally does nothing and returns as it is but a programmer can intercept it in order to change the scan code in AL and hence altering the input or keyboard layout.

12 Answer is reads scan code then converts to ASCII and Place it in keyboard buffer and return these are the activities performed when interupt 9 occurs. The newint simply invokes the original interrupt 9 thrice. Therefore the same character input will be placed in the keyboard buffer thrice i.e. three characters will be received for each character input. Whenever the interrupt 9 occurs it reads the keyboard port 0x60. If the port contains 83 then it means DEL was pressed, if so it places the code 25 in the buffer and then updates the head in circular manner. The code 25 placed instead of 83 represents the combinations CTRL+Y. The program when resident will cause the program to receive CTRL+Y combination whenever DEL is pressed by the user. i.e. in Borland C environment CTRL+Y combination is used to delete a line, if this program is resident then in Borland C environment a line will be deleted whenever DEL is pressed by the user. Write a Formula to transfer the cluster # in LSN for FAT32 file System. page no No of System area blocks= reserved block+ fat per sector*no of FAT+no of enteries*32 First user block NO. = No of system area blocks Sector No. =(clust_no_2)*blocks per cluster first user block no In reflection of the anatomy of FAT32 based system the method used to translate the cluster # into LSN also varies. The following formula is used for this purpose. Starting Sector # for a Cluster Starting Sector = Reserved Sect. + FatSize *FatCopies + (cluster # - 2) *size of cluster Can we send the data to keyboard yes or not? Yes we can. How many maximum possible entries are there in FAT32 and FAT16? In FAT16 we can have 2^16=65536 entries. FAT32 evidently will contain more entries and can hence manage a very large disk whereas FAT16 can manage a space of 2 GB maximum practically. Anatomy of FAT32?

13 Starting block(s) is /are the boot block(s), immediately after which the FAT (File allocation table) starts. A typical volume will contain two copies of FAT. After FAT the root directory is situated which contain information about the files and folders in the root directory? Whole of this area constitutes the systems area rest of the area is used to store user data and folders. TSR program that sets the caps lock bit in the keyboard status bytes whenever interrupt 8 occurs. #include <dos.h> void interrupt (*old)(); void interrupt new(); char far *scr=(char far* ) 0x ; void main() { old=getvect(0x08); setvect(0x08,new); keep(0,1000); void interrupt new (){ *scr=64; (*old)(); gets the address stored at the vector of interrupt 8 and stores it in the pointer oldint. The address of the interrupt function newint is then placed at the vector of int 8 and the

14 program is made memory resident. From this point onwards whenever interrupt 8 occurs the interrupt function newint is invoked. This function after performing its operation calls the original interrupt 8 whose address has been stored in oldint pointer. Q. What is difference between tracks and sectors? Tracks are the circular division of the disk and the sectors are the longitudinal division of the disk. The tracks are concentric circles around the central spindle on either side of each platter. Tracks physically above each other on the platters are grouped together into cylinders which are then further subdivided into sectors of 512 bytes apiece. The sector is a disk s smallest accessible unit. Drives use a technique called zoned-bit recording in which tracks on the outside of the disk contain more sectors than those on the inside. Q# Write down procedure to convert a cluster number into sector number - NTFS simply the following formula will be used to translate the sector number into cluster number. Sector # = Cluster # * Sector per Cluster Q: In FAT32, what is the size of FSInfo? - On a FAT32 volume, the FAT can be a large data structure, unlike on FAT16 where it is limited to a maximum of 128K worth of sectors and FAT12 where it is limited to a maximum of 6K worth of sectors. In which storage media head touches the surface of disk and in which does not and why it is so? Pg The head is touching the surface of floppy disk which rotates at a low speed of 300 RPM. The head is not touching the surface of hard disk which run at high speeds up to 9600 RPM but is at a few microns distance from the surface What is difference b/w Primary and extended Partition? pg Partition defined in the MBR (Master Boot Record) is primary partition. Each Primary Partition contains information about its respective O.S. However if only one O.S. is to be installed then extended partitions. The extended partition may again be divided into a number of partitions, information about further partitions will be kept in extended partition table which will be the first physical block within extended partition (i.e. it will not the first block of primary partition.). Moreover there can be extended partitions within extended partitions and such that in then end there are number of logical partitions this can go on till the last drive number in DOS.

15 Suppose a disk is divided into two partition and we have read MBR at LBA=0 to get information about primary partition a) How many bytes of code part we need to skip to get information about primary partition? b) How many bytes of code part we need to read information? Define the following terms relating to HDD (Hard Disk Drive). Solution: - (1) Block: - Blocks are the sectors per track, smallest addressable unit in memory; address of block is specified as a unique combination of three parameters. (2) Sector: - Each track can hold many thousands of bytes of data. It would be wasteful to make a track the smallest unit of storage on the disk, since this would mean small files wasted a large amount of space. Therefore, each track is broken into smaller units called sectors. (3) Track: - All information stored on a hard disk is recorded in tracks, which are concentric circles placed on the surface of each platter, much like the annual rings of a tree. The tracks are numbered, starting from zero, starting at the outside of the platter and increasing as you go in. A modern hard disk has tens of thousands of tracks on each platter (4) Cluster: - Cluster is the collection of contiguous blocks. User data is divided into cluster, number of blocks within a cluster is in power of 2. Cluster size can be varying depending upon the size of the disk. (5) Cylinder: - Cylinder is a collection of corresponding tracks if track on platter changes so will the tracks on rest of the platters as all the heads move simultaneously (6) Seek Time: - While accessing a selected block Time required by the head to reach the particular track/cylinder is called seek time (7) Access Time: -

16 The accumulative time that is required to access the selected block is called access time (8) LBA (Logical Block Addressing): - LBA is the address of relative to the start of physical drive i.e. (absolute). (9) LSN (Logical Sector Number): - If the blocks are indexed from the boot block such that the boot block has index = 0. Then this index is called LSN. LSN is relative index from the start of logical drive not the physical drive. (10) DAP (Disk Address Packet): - Disk Address Packet is data structure used by extended in 13H services to address a block and other information for accessing the block. (11) BPB (BIOS Parameter Block): - BIOS Parameter Block is a data structure maintained by DOS in the boot block for each drive. The boot block is typically a 512 byte block it contain some code and data. The data part constitutes the BPB. (12) DPB (Drive Parameter Block): - Beside the BPB there is another data structure can be used equivalently called the DPB. The operating system translates the information in BPB on disk into the DPB which is maintained main memory. This data structure can be accessed using the undocumented services 21H/32H.

17 Current papers: Q. What is the size of FSinfo in FAT32? 512 bytes FSInfo Sector Structure size is 512 -bytes and in FAT32 BPB_FSinfo size is 2 byte at 48 offset Q. First partition table maintains information about ----? 2m The first partition table maintains information about the primary and extended partitions. Q2. Find the root directory sector. Where reserved sector = 1 and sector per FAT = 9. Use appropriate assumption where needed? 5 Marks Root DIR Sector: reserved sectors +2 * (size of FAT) = * 9 = 19 Q. Write the limitation of bios disk ()? Large sized disk are available now with thousands of tracks But this BIOS routine only is capable of accessing a max. of 1024 tracks. Hence if a large disk is being used not whole of the disk can be accessed using this routine This function uses the int 13H services. The parameter sizes provided by these services may not be sufficient to hold the track number of block to be accessed. Q. How DMA works in Block transfer mode? In block transfer mode the DMA is programmed to transfer a block and does not pause or halt until the whole block is transferred irrespective of the requests received meanwhile. In Single transfer mode the DMA transfers a single byte on each request and updates the counter registers on each transfer and the registers need not be programmed again. On the next request the DMA will again transfer a single byte beginning from the location it last ended. Q. How cross reference of clusters can be detected?

18 If a cluster lies in more than one file chain, then its s aid to be Cross Referenced. Cross references can pose great Problems. Cross references can be detected easily by traversing through the chain of all files and marking the cluster # during traversal. If a cluster is referenced more than once then it indicates a cross reference. To solve the problem only one reference should be maintained. Q. LSN = 0 and LBA = 0 are same things? Why if yes or no? LBA = 0 is not the same as LSN=0. The LBA=0 block is the first block on disk. Whereas each logical partition has LSN=0 block which is the first block in logical drive and is not necessarily the first block on physical drive. Q3. Calculate the sector no for the following I C H we have the following info blocks per cluster = 8 first user block number = 20 - Sector No. = (Clust_no 2)* Blocks per Clust + First User Block # Sector No. = (2)* 8 +20=36 1) Write three Data Structures for Memory DOS use? MCB (Memory Control Block) MCB is a 16-bytes large structure. MCB is us ed to control an allocated blo ck in memory. Every allocated block will have a MCB before the start of block. EB (Environment Block) Contains Environment information like Environment variables and file paths for that program PSP (Program Segment Prefix is situated before the start of a process. contains control information like DTA (Disk Transfer Area) and command line parameters. 2) Scan Disk Surface Scan for Bad Sectors? It attempts to write a block. After write it reads back the block contents.

19 Performs the CRC test on data read back. If there is an error then the data on that block is not stable and the cluster of that block should be marked bad. The cluster is marked bad by placing the appropriate code for bad cluster so that they may not be allocated to any file. 3) How to recover a Deleted Files? How can we recover the deleted contents of file? Explain each step of recovery in detail. 0xE5 at the start of file entry is used to mark the file as deleted. The contents of file still remain on disk. The contents can be recovered by placing a valid file name, character in place of E5 and then recovering the chain of file in FAT. If somehow the clusters used by deleted file have been overwritten by some other file, it cannot be recovered. In the contents of the above given root directory notice an entry named SECOND. The attribute byte of this entry is 0x20 which indicates that it s a directory, the size is 0 which shows that there is now user data in it, but even though the size 0 it has a first cluster which is 0x12. Converting 0x12 into LSN and then reading its contents we get the following dump. This shows that this cluster contains the FCBs for all the file and folders within this directory. Q. Possible entries in FAT12 and FAT16 2 marks FAT is a simple table which contains cluster number of each file. FAT12 will have 12-bit wide entries and can have 2^12 entries maximum. A FAT theoretically will contain 2 n entries where n is 12 for FAT 12 and 16 for FAT16. Q. What is highest capacity of disk using IDE and extended Bios Function? 2 marks Hence highest physical capacity of the disk according to the IDE interface is 255x16x65536x512 = 127GB. Extended BIOS functions allow to access disk with sizes greater than 504 MB through LBA translation. Q. What does it indicates if the value of first byte of data part of the partition table is 80h? 2 80H if Bootable, 0 if Not

20 Boot Indicator. Indicates whether the partition is the system partition. Legal values are: 00 = Do not use for booting. 80 = System partition. If it is 00, then the partition is not the active partition (does not contain the boot loader). If it is 80 or greater, as in the example, this means it is the active (bootable) partition. Only one partition can be marked as active. The second piece of information applies to fixed disks. If the first fixed disk contains the active partition, this number will be 80. If it were the second fixed disk, this number would be 81, and so on. Q. What are three different kinds of computer viruses? 3 Marks Types of Viruses Partition Table Virus Boot Sector Virus File Viruses Q. How the descriptor table and what are the attributes of segments? 3 marks How descriptor describes a memory segment and what are the attributes of memory segment? 5m Descriptor table describes the memory segment by storing its attributes related to that memory segment and their significant attributes are: Base address, length and limit, right access. If the Descriptor describes a memory segment then the Access Rights Byte will have the following meaning. P DPL S E X RW A Descriptors are structures, which must with the Prozessor a length of 8 byte possess and "somewhere" in the main memory be. They describe (therefore it also the name: Descriptor; tons describe, English, describe) a segment in the memory. A descriptor records thereby the following characteristics of a segment: the physical start address within the memory (32 bits), the length of the segment (20 bits) and Additional information, like rights of access or the Segmentyp (data or code segment). Q. How Accessing NTFS volume in DOS? 5 marks How a NTFS volume can be accessed in DOS? 2m NTFS volume cannot be accessed in DOS using DOS based function like absread ( ) etc. DOS device drivers do not understand the NTFS data structures like MFT etc. If NTFS volume is accessed in DOS, it will fire the error of Invalid Media.

21 Q# Write down procedure to convert a cluster number into sector number No of System area blocks= reserved block+ fat per sector*no of FAT+no of enteries*32 First user block NO. = No of system area blocks Sector No. =(clust_no_2)*blocks per cluster first user block no 1. How can content of large and small file manage in MFT? This design makes file access very fast. Consider, for example, the FAT file system, which uses a file allocation table to list the names and addresses of each file. FAT directory entries contain an index into the file allocation table. When you want to view a file, FAT first reads the file allocation table and assures that it exists. Then FAT retrieves the file by searching the chain of allocation units assigned to the file. With NTFS, as soon as you look up the file, it's there for you to use. Directory records are housed within the master file table just like file records. Instead of data, directories contain index information. Small directory records reside entirely within the MFT structure. Large directories are organized into B-trees, having records with pointers to external clusters containing directory entries that could not be contained within the MFT structure. 2. Possible factors that will be affected by changing disk capacity? The possible factors is Size of cluster will be affected by changing disk capacity. Because, as size of disk increase cluster size increases. 3. Which file system keeps the back up of its boot block? How is the first filesystem (called the root filesystem, because it contains the root directory) mounted, since it obviously can't be mounted on another filesystem? Well, the answer is that it is done by magic. The root filesystem is magically mounted at boot time, and one can rely on it to always be mounted. If the root filesystem can't be mounted, the system does not boot. The name of the filesystem that is magically mounted as root is either compiled into the kernel, or set using LILO or rdev.

22 There are many MS-DOS defragmentation programs that move blocks around in the filesystem to remove fragmentation. For other filesystems, defragmentation must be done by backing up the filesystem, re-creating it, and restoring the files from backups. Backing up a filesystem before defragmenting is a good idea for all filesystems, since many things can go wrong during the defragmentation. 5. Advantages and disadvantages of FAT32 5 marks FAT32 evidently will contain more entries and can hence manage a very large disk whereas FAT16 can manage a space of 2 GB maximum practically. No fixed space reserved for root directory. In the FAT32 there is another special reserved block called FS Info sector. The block contains some information required by the operating system while cluster allocation/deal location to files. Advantages of FAT32 include: FAT32 has some advantages over the FAT 16 file system in regards to improved reliability. For example, under the FAT 16 file system, the root directory is located only at the beginning of the hard disk. If anything were to happen to this section of the hard disk, such as the development of bad sectors, the whole drive will become unusable as the file index will become damaged. Therefore, one will have to seek out special disk recovery tools to try to recover the data, which more than likely will be unsuccessful. By using the FAT 32 file system, the root directory can be located anywhere on the hard disk. Therefore, if anything happens to the section of the hard disk storing the root directory, the FAT 32 file system s built in utilities will be able to move the root directory to a safe location on the hard disk and repair the defective area. In addition, the FAT 32 file system can use both the default and the backup copy of the File Allocation Table. This means that if something were to happen to the default FAT, your system will continue to run by using the backup copy until the default can be repaired. Disadvantages of FAT32 include: The largest FAT32 volume that Windows 2000 can format is 32 GB. FAT32 volumes are not directly accessible from operating systems other than Windows 95 OSR2 and Windows 98. If you have a startup failure, you cannot start the computer by using an MS-DOS or Windows 95 (excluding version OSR2 and later) bootable floppy disk. There is no built-in file system security or compression scheme with FAT Where head touch where don't touch the surface of the disk? The head is touching the surface of floppy disk which rotates at a low speed of 300 RPM. The head is not touching the surface of hard disk which runs at high speeds up to 9600 RPM but is at a few microns distance from the surface.

23 Advantages of FAT16 Advantages of FAT16 include: MS-DOS, Windows 95, Windows 98, Windows NT, Windows 2000, and some UNIX operating systems can use FAT16. There are many software tools that can address problems and recover data on FAT16 volumes. If you have a startup failure, you can start the computer by using an MS-DOS bootable floppy disk to troubleshoot the problem. FAT16 is efficient, in speed and storage, on volumes smaller than 256 MB. Top Of Page Disadvantages of FAT16 Disadvantages of FAT16 include: The root folder can manage a maximum of 512 entries. The use of long file names (LFNs) can significantly reduce the number of available entries. FAT16 is limited to 65,536 clusters, but because certain clusters are reserved, it has a practical limit of 65,524. The largest FAT16 volume on Windows 2000 is limited to 4 GB and uses a cluster size of 64 KB. To maintain compatibility with MS-DOS, Windows 95, and Windows 98, a volume cannot be larger than 2 GB. FAT16 is inefficient on larger volume sizes, as the size of the cluster increases. The space allocated for storing a file is based on the size of the cluster allocation granularity, not the file size. For example, a 10-KB file stored on a 1.2-GB volume, which uses a 32-KB cluster, wastes 22 KB of disk space. The boot sector is not backed up. There is no built-in file system security or compression scheme with FAT16. Top Of Page Advantages of FAT32 FAT32 has the following enhancements: The root folder on a FAT32 drive is an ordinary cluster chain and can be located anywhere on the volume. For this reason, FAT32 does not restrict the number of entries in the root folder. FAT32 uses smaller clusters (4 KB for volumes up to 8 GB), so it allocates disk space more efficiently than FAT16. Depending on the size of your files, FAT32 creates the potential for tens and even hundreds of megabytes of additional free disk space on larger volumes compared to FAT16. FAT32 can automatically use the backup copy of the file allocation table instead of the default copy (with FAT16, only a disk repair tool such as Chkdsk can implement the backup). The boot sector is automatically backed up at a specified location on the volume, so FAT32 volumes are less susceptible to single points of failure than FAT16 volumes. Top Of Page Disadvantages of FAT32 Disadvantages of FAT32 include: The largest FAT32 volume that Windows 2000 can format is 32 GB. FAT32 volumes are not directly accessible from operating systems other than Windows 95 OSR2 and Windows 98. If you have a startup failure, you cannot start the computer by using an MS-DOS or Windows 95 (excluding version OSR2 and later) bootable floppy disk. There is no built-in file system security or compression scheme with FAT32. CS609 - Final Term Papers Fall 2012 Q#1 In how many ways higher PC can operate? - (Page 319) Higher PCs can operate in two modes

24 REAL MODE PROTECTED MODE Q#2 In FAT32, what is the size of FSInfo? On a FAT32 volume, the FAT can be a large data structure, unlike on FAT16 where it is limited to a maximum of 128K worth of sectors and FAT12 where it is limited to a maximum of 6K worth of sectors. Q#3 A disk is divided into three partition. What type of information is represented in code part of partition table? - (Page 219) code part contains valid executable code Q#4 Differences between FAT16 and FAT32 Q#5 How ISR sends EOI (End of interrupt) signals to master and slave.required statement must be in C program void irq_handler(registers_t regs) { // Send an EOI (end of interrupt) signal to the PICs. // If this interrupt involved the slave. if (regs.int_no >= 40) { // Send reset signal to slave. outb(0xa0, 0x20); // Send reset signal to master. (As well as slave, if necessary).

25 outb(0x20, 0x20); if (interrupt_handlers[regs.int_no]!= 0) { isr_t handler = interrupt_handlers[regs.int_no]; handler(&regs); Q#7 Distinguish between and (Page 170) If the sign of infinity can be reversed than the coprocessor is otherwise its Q#8 Write down procedure to convert a cluster number into sector number - (Page 308) NTFS simply the following formula will be used to translate the sector number into cluster number. Sector # = Cluster # * Sector Per Cluster Q#9 How a PC operates in protected mode? - (Page 326) PC has to be shifted to Protected Mode if originally boots in Real Mode. In Protected Mode whole of the RAM is accessible that includes the Conventional, Expanded and Extended Memories. OS like Windows has a memory management system for Protected Mode. A privilege level can be assigned to a memory area restricting its access. Q#10 Describe how a chain of cluster in FAT12 is managed? - (Page 291)

26 CS609 - Final Term Papers Fall marks. How larger file contents can be managed using FAT? - (Page 264) Larger files would be comprised of numerous clusters. The first Cluster # can be read from FCB for rest of the Cluster, a chain is maintained within the FAT. what is the control information in PSP (program segment prefix) contain? - (Page 321) It contains control information like DTA (Disk Transfer Area) and command line parameters. How many possible entries are there in FAT12 and FAT16? - Click here for detail FAT12 and FAT16 media typically use 512 root directory entries.

27 Write down the names of three data structure used for memory management? - (Page 321) DOS makes use of various Data Structures for Memory Management: MCB ( Memory Control Block ) EB ( Environment Block ) PSP ( Program Segment Prefix ) 5 Marks. What are interrupt function pointers? Explain with examples. - (Page 22) Interrupt pointers and functions Interrupt functions are special function that as compared to simple functions for reasons discussed earlier. It can be declared using the keyword interrupt as shown in the following examples. void interrupt newint ( ) { Similarly a pointer to such interrupt type function can also be declared as following void interrupt (*intptr) ( ); where intptr is the interrupt pointer and it can be assigned an address using the getvect() function intptr = getvect(0x08); Now interrupt number 8 can be invoked using the interrupt vector as following (*intptr) ( ); What is fragmentation? And how we remove it using defragmentation. - (Page 316)

28 Fragmentation means that clusters of a same file are not contiguously placed, rather they are far apart, increasing seek time hence access time. So its desirable that files clusters may be placed contiguously, this can be done by compaction or defragme notation. Defragmentation Software reserves space for each file in contiguous block by moving the data in clusters and Re-adjusting. As a result of defragmentation the FAT entries will change and data will move from one cluster to other localized cluster to reduce seek time. Defragmentation has high computation cost and thus cannot be performe d frequently. What is cluster? Describe it key characteristics. - (Page 342) A cluster is a collection of contiguous blocks. User Data is divided into clusters Number of blocks within a cluster is in power of 2. Cluster size can vary depending upon the size of the disk. DOS has a built in limit of 128 blocks per cluster. But practically limit of 64 blocks per cluster has been established. A cluster is not the same as block and also there are no system calls available which use the cluster number. All the system calls use the LSN address. If the cluster number is known it should be converted into LSN to access the blocks within the cluster. Moreover all the information about file management uses the cluster number rather than the LSN for simplicity and for the purpose of managing large disk space. So here we devise a formula to convert the cluster number into LSN. After calculating the sector number for the cluster the contents of the file can be accessed by reading all the blocks within the cluster. In this way only the starting cluster will be read. If the file contains a number of cluster the subsequent clusters numbers within the file chain can be accessed from the FAT. Int 0*0f can be used to perform program interrupt printer I/O. what are the requirements to enable it. - (Page 96) The interrupt should be enabled in the printer control register; secondly it should also be unmasked in the IMR in

29 PIC. The program can then intercept or set the vector of interrupt 0x0f by placing the address of its function newint(); The newint() will now be called whenever the printer can perform output. This newint() function writes the next byte in buffer to the data registers and then send a pulse on the strobe signal to tell the printer that data has been sent to it. When whole of the buffer has been sent the int 0x0f vector is restored, interrupt is masked and the memory for the program is de-allocated. CS609 - Final Term Papers Fall 2012 Q4) What is the difference between the getvect and sectvect function? - setvect() :- Get Interrupt Vector Entry Setvect() stores the address of an interrupt handler (which must be declared to be of type void interrupt) in the specified interrupt vector. For example, the code needed to store the address of kb_ih() (the keyboard interrupt handler) in interrupt vector location KEY_INT (with the value 9) is: setvect(key_int, kb_ih); getvect() :- Set Interrupt Vector Entry The getvect() function returns a copy of the 32-bit interrupt address stored in a specific interrupt vector. For example, the code to obtain a copy of the original clock handler's address stored in interrupt vector 8(defined in i8259.h as CLK_INT) and to store it in the variable old_clock (declared to be of type void interrupt), would be: void interrupt (*old_clock)();... old_clock = getvect(clk_int); Q2) what is MFT? - Each file on an NTFS volume is represented by a record in a special file called the master file table (MFT). NTFS reserves the first 16 records of the table for special information. Q3) Write the names of three different viruses? - (Page 332) Partition Table Virus

30 Boot Sector Virus File Viruses Q4) Name the registers used by program interrupt controller(pci)? - (Page 50) ISR, IMR and IRR 4 question of 5 marks Q1) Write down the TSR program that intercepts the interrupt 17H and gives all the spaces in print document. - (Page 88) #include <dos.h> void interrupt (*old)( ); void interrupt newint ( ); main( ) { old = getvect(0x17); setvect(0x17,newint); keep(0,1000); void interrupt new () { if (_AH==0) { if ((_AL=='A') (_AL=='Z')) //corrected return; (*old)(); Q3) How disk scan identify the bad sectors?

31 - (Page 315) It attempts to write a block. After write it reads back the block contents. Performs the CRC test on data read back. If there is an error then the data on that block is not stable the cluster of that block should be marked bad. The cluster is marked bad by placing the appropriate code for bad cluster so that they may not be allocated to any file. Q4) Write down an algorithm that can be used to extract the entries from a FAT12 data structure? - (Page 267) offset = cluster No * 3/2 temp = cluster No * 3%2 if (temp == 0) { Then the entry is even, consider the word at this offset. Make a 12-bit value, by selecting the low Nibble of the high byte of this. Use this Nibble as the higher 4-bits. And use the low byte as the lower eight bits. else { The entry is odd, consider the word at this offset. Select the high Nibble of the low byte as lower 4-bits. And select high byte as the higher 8-bits. CS609 - Final Term Papers Spring ) Recovery of deleted contents of file write all steps?

32 - (Page 279) The contents can be recovered by placing a valid file name, character in place of E5 and then recovering the chain of file in FAT. If somehow the clusters used by deleted file have been overwritten by some other file, it cannot be recovered. 5) Write down state of viruses only name? - (Page 331) Dormant State Activation State Infection State 8) On interrupt 13H/42H write down the states of DS:SI registers? - (Page 216) DS:SI= far address of Disk address packet 9) What is COM File? - (Page 333) COM File is a mirror image of the program code. Its image on disk is as it is loaded into the memory. COM Files are single segment files in which both Code and Data resides. COM File will typically have a Three Bytes Near Jump Instruction as the first instruction in program which will transfer the execution to the Code Part of the Program. 10) De fragmentation has high computation cost explain why & how? - (Page 316) Defragmentation Software reserves space for each file in contiguous block by moving the data in clusters and readjusting. As a result of defragmentation the FAT entries will change and data will move from one cluster to other localized cluster to reduce seek time Defragmentation has high computation cost and thus cannot be performe d frequently. CS609 - Final Term Papers Spring 2012 DTE want to communicate with DCE sing RC232c protocol,how does this