Backup Encyclopedia:: C

A B C D E F G H I J K L M N O P Q R S T U V W X Y Z | View All

Character

A representation – coded in binary digits – of a letter, number, or other symbol.

Character Set

All the letters, numbers, and characters a computer can use to represent data. American Standard Code for Information Interchange (ASCII) is a standard single-byte character-encoding scheme used for text-based data. ASCII uses designated 7-bit or 8-bit number combinations to represent either 128 or 256 possible characters. Standard ASCII uses 7 bits to represent all uppercase and lowercase letters, the number 0 through to 9, punctuation marks, and special control characters used in U.S. English. Most current x86 systems support the use of extended (or “high”) ASCII. Extended ASCII allows the eighth bit of each character to identify an additional 128 special symbol characters, foreign-language letters, and graphic symbols.
See: American Standard Code for Information Interchange (ASCII Checkpoint Record).

Check Disk (chkdsk.exe)

Chkdsk.exe – one of many maintenance and troubleshooting tools available - is a command-line tool that verifies the logical integrity of a filesystem for a Windows NT family operating system’s volumes. Chkdsk corrects the predictable, non-destructive hard disk drive and filesystem inconsistencies that occur as a result of a system failure prior to the next system restart. If the filesystem’s structures become damaged, any of Windows NT family operating systems will automatically schedule chkdsk to run the next time that the computer is booted. At any time, it is possible to manually run chkdsk at the command prompt, Windows Explorer or My Computer. Volumes that have filesystem errors are known as dirty volumes. For Windows XP Professional and Server 2003 there is the additional Chkntfs.exe command-line tool, i.e., chkntfs.exe c:. To determine whether a volume is dirty there is also the fsuntil.exe dirty query tool i.e., fsutil.exe dirt query c:.
Chkdsk can be run without parameters (also called switches) but it will run in read-only mode. In this mode, chkdsk examines the hard disk drive(s) and then reports whether it has found any filesystem inconsistencies without repairing them. When chkdsk is run with parameters, such as /f or /r, it repairs errors related to the filesystem structures. The volume will not be available while chkdsk is running and will not relinquish control until it is complete. If the volume is being checked during the startup process the computer is not available until the chkdsk process has completed in pre-Windows mode if the volume to be checked is the boot volume. For non-boot volumes no open files must be in use otherwise they will need to be closed before chkdsk can lock the volume and run in Windows.
When chkdsk is run on an NTFS volume, the chkdsk process consists of three major stages with an optional forth and fifth stage. Chkdsk displays it progress for each stage.

1. Chkdsk verifies each file record segment in the master file table (MTF)

During stage 1, chkdsk examines each file record segment in the volume’s MFT. A specific file record segment in the MFT uniquely identifies every file and directory on an NTFS volume. The percent complete that chkdsk displays during this phase is the percent of the MTF that has been verified.

2. Chkdsk checks the directories in the volume

During stage 2, chkdsk examines each of the indexes (directories) on the volume for internal consistency and verifies that every file and directory represented by the file record segment in the MTF is referenced by at least one directory. Chkdsk also confirms that every file or subdirectory referenced in each directory actually exists as a valid file record segment in the MFT; checking for circular directory references. Chkdsk then confirms that the timestamp and the file size information associated with files are up to date in the directory listings for those files. The percent complete that chkdsk displays during this phase is the percent of the total number of files on the volume that are checked. The larger the number of files in the volume the longer it will take to complete stage 2.

3. Chkdsk verifies the security descriptors for each volume

During stage 3, chkdsk examines each of the security descriptors associated with each file and directory on the volume by verifying that each security descriptor structure is well formed and internally consistent. The percent complete that chkdsk displays during this phase is the percent of the number of files and directories on the volume that are checked

4-5. Optional stages: chkdsk reads every sector on the volume to confirm stability

Chkdsk performs stages 4 and 5 if specified by using the /r parameter when running chkdsk. The r/ parameter confirms that the sectors in each cluster are usable. Specifying the /r parameter is usually not necessary because NTFS identifies and remaps bad sectors during the course of normal operation, but the use of the /r parameter should be used if there is a suspicion that the hard disk drive has had bad sectors. During stage 4, chkdsk verifies all clusters in use. In stage 5 chkdsk verifies all unused clusters. The percent complete that chkdsk displays during stage 4 is based on the percent of used clusters that are checked. The percent complete that chkdsk displays during stage 5 is the percent of unused clusters that are checked. Used clusters typically take longer to check than unused clusters. For a volume with mostly unused clusters stage 4 will take longer that stage 5.

The GUI Check Disk (or applet) equivalent is found by right clicking on a volume within My Computer or Windows Explorer. However, chkdsk runs in read-only mode in addition to the r/ (scan for and attempt recovery of bad sectors) and f/ (automatically fix filesystem errors) parameters.
Check Disk creates and displays a status report for a volume, based on the filesystem used, listing and correcting errors on the volume.
An important point to remember is that Scan Disk (for non-Windows NT family operating systems) and Check Disk (for Windows NT family operating systems) can restore access to files if hard disk drive and filesystem critical structures are damaged. Nevertheless, these tools do not correctly address the problems arising from bad sectors. The principal concern of Scan Disk and Check Disk is to ensure in favour of a consistent filesystem, not the data residing on it. Consequently, assess to data can be compromised as a repair may only be completed successfully by removing references to certain files from the filesystem. These removed files (or fragments of them) then appear as filexxxx.chk files.
Scan Disk and Check Disk handle read problems poorly. If they encounter a read problem (or bad sector), the entire cluster that the bad sector was a part of is discarded. In addition, since Scan Disk and Check Disk, by default, only check the used areas of the hard disk drive; bad sectors may not become a problem until the operating system writes data to it. In particular, Scan Disk is unable to work with bad sectors in a FAT area at all; Scan Disk will not recover these sectors. With Check Disk, there is hope.
Chkdsk’s filesystem consistency-checking application runs during a boot sequence. The boot-time version of Chkdsk is a native application named Autochk.exe (\System32\Autochk.exe). The Session Manager (\System32\Smss.exe) runs it because it is specified as a boot-run program in the HKLM\CurrentControlSet\Control\Session Manager\BootExecute value. Chkdsk accesses each drive letter to see whether the volume associated with the letter requires a consistency check.
Chkdsk is less than ideal for removing bad sectors from use. Chkdsk can take considerable time to find and recover bad sectors and for these reasons it is not a first-line data recovery tool.
On NTFS, Chkdsk runs only when unexpected or unreadable filesystem data is found and NTFS cannot recover from a redundant volume or from redundant filesystem structures on a single volume - the system boot sector and parts of the MTF required for booting the system and running the NTFS recovery procedure are duplicated. The redundancy ensures that NTFS will always be able to boot and recover itself.

Check Disk (Syntax)

Parameters/Switches (Effects)

Filename

FAT12/16/32 only. Specifies the file or set of files to check for fragmentation. Wildcard characters (* and ?) are permitted.

Path

FAT12/16/32 only. Specifies the location of a file or set of files within the folder structure of the volume.

Size

NTFS only. Changes the log file size to the specified number of KBs. Must be used with the /I switch.

Volume

FAT12/16/32 only. Specifies the drive letter, followed by a colon ( : ), volume, mount points, or volume name.

NTFS only. Using this parameter can reduce the time needed to complete a Chkdsk run but may result in the volume remaining corrupted after Chkdsk completes, e.g., loops on the NTFS volume. The /c parameter skips the process that detects cycles in the directory structure. Cycles are a rare form of corruption in which the subdirectory has itself a parent. Such loops might be inaccessible from the rest of the directory tree and should result in orphan files. Files can become orphaned when file record segments remain but are not referenced by any directory entry. The file representation by the file record segment might be intact in all ways except that the file is invisible to all programs, including backup programs. Use with caution.

NTFS only. Using this parameter can reduce the time needed to complete a Chkdsk run but may result in the volume remaining corrupted after Chkdsk completes its run. The i/ parameter skips the process that compares directory entries to the file record segments that correspond to those entries. All file record segments in the master file table (MFT) uniquely identifies every file and directory in an NTFS volume. Using the i/ parameter will result in the directory entries being checked to verify that they are self-consistent, but the directory entries are not necessarily consistent with the data stored in their corresponding file record segments. Using this parameter may result in files becoming orphaned if directory entries remain but the directory encounters errors when attempting to access them.

NTFS only. Displays current size of the log file.

Locates bad sectors and recovers readable information (implies /f). If Chkdsk.exe cannot lock the volume, it offers to check it the next time the computer restarts. Because NTFS also identifies and remaps bad sectors during the course of normal operations, it is usually not necessary to use the /f parameter useless there is a suspicion that a hard disk drive has bad sectors.

On FAT12/16/32 only. Displays the full path and name of every file on the volume.

NTFS only. Forces the volume to dismount first, if necessary. All opened handles to the volume are then invalid (implies /f). This parameter does not work on the boot volume. The computer must be restarted to dismount the boot volume.

NTFS only. Changes the size of the log file to the specified number of KBs. Displays the current size if the user does not enter a new size.

If the system loses power, stops responding, or is restarting unrepentantly, NTFS runs a recovery procedure when Windows XP and Server 2003 (may not apply to Windows 2000) restarts that accesses information stored in this log file. The size of the log file depends on the size of the volume. Normally the log file will not need resizing. However, if the number of changes to the volume is so great that NTFS fills the log before all metadata is written to disk, NTFS must force the metadata to disk and free the log space. When such a scenario occurs, Windows XP and Server 2003 may stop responding momentarily. To eliminate the performance impact of forcing the metadata to disk, increase the size of the log file.

Displays the Chkdsk.exe switches.

Chkdsk supports only a few specialised local command functions, and in particular on the system partition, as shown in the table of commands above.

See: Attribute (Resident & Non-Resident), Attribute List, Base File Record, Basic Volume, Directory, Dynamic Volume, File, and Master File Table (MFT).

Checksum (or Verification)

Checksum, short for summation check, is a technique for determining whether a package of data is valid. The package, a string of binary digits, is added up (summed) and compared with the expected number. More generally, it refers to any kind of redundancy check.
The simplest form of checksum is a parity bit appended on to 7-bit numbers, e.g., ASCII characters, such that the total number of ones (1s) is always even ("even parity") or odd ("odd parity"). However, this simple form of checksum, which simply adds up the asserted bits in the data, cannot detect a number of types of errors, e.g., bytes re-ordered within a message, inserting or deleting zero-valued bytes and multiple errors which sum to zero.
A more sophisticated, powerful and easily implemented checksum designed to address simple checksum weaknesses is the cyclic redundancy check (often abbreviated CRC) - a form of hash function. CRC considers not only the value of each byte but also its position. The CRC technique, using simple yet efficient algorithms, is used to protect blocks of data called frames, e.g., a packet of network traffic or a block of a file. The most commonly used CRC polynomials are:

CRC-16 or CRC-16-IBM polynomial:

(x16+x15+x2+1, the reciprocal polynomial being x16+x14+x1+1)

CRC-32-IEEE 802.3 polynomial:

(x32+x26+x23+x22+x16+x12+x11+x10+x8+x7+x5+x4+x2+x+1)

The specific CRC produced is defined by the polynomial used (to produce an n-bit CRC requires a degree-n polynomial, e.g., the number of the highest non-zero coefficient for CRC-32 and CRC-16 is 33 and 17 bits, respectively). The error-detection ability (strength) of a CRC depends on the degree of its key polynomial and on the specific key polynomial used. The cost of the ability to detect more types of errors is the increased complexity of computing the checksum, which is based on the algebra of polynomials over the integers (mod 2 or modulo 2). It is substantially more reliable in detecting transmission errors, and is a common error-checking protocol used in types of transmission, as well as storage of data. A CRC is computed and appended before transmission or storage, and verified afterwards by the recipient to confirm that no changes occurred in transit, for example.
Good CRC polynomials are often primitive polynomials, which have the best 2-bit error detection, or polynomials whose factors are a primitive polynomial of degree n−1 and x+1, which detects all odd numbers of bit errors, and has half the 2-bit error detection ability of a primitive polynomial of degree n.
Although these types of redundancy check are useful in detecting accidental modification such as corruption to stored data or errors in a communication channel, they provide no security against a malicious agent as their simple mathematical structure makes them trivial to circumvent. To provide this level of integrity, the use of a cryptographic hash function, such as SHA-256, is necessary. Moreover, while useful for error detection, CRCs cannot be safely relied upon to verify data integrity, that no changes whatsoever have occurred since. The reason is due to the linear structure of CRC polynomials; therefore, it is extremely easy to intentionally change data without modifying its CRC. Using CRC-32 for data integrity testing is less of an issue than with CRC-16.
Closely related to CRCs are error-correcting codes, which are based on closely related mathematical principles.
An error-correcting code (EEC) is an algorithm for expressing a sequence of numbers such that any errors which are introduced can be detected and corrected, within certain limitations, based on the remaining numbers. The study of error-correcting codes and the associated mathematics is known as coding theory. Coding theory, sometimes called algebraic coding theory, deals with the design of error-correcting codes for the reliable transmission of information across noisy channels. It makes use of classical and modern algebraic techniques involving finite fields, group theory, and polynomial algebra. It has connections with other areas of discrete mathematics, especially number theory and the theory of experimental designs.
Error detection is much simpler than error correction.
See: Bit Binary Digit, Binary Number Base System, and Data.

CHS (Cylinder, Head, Sector)

Starting and Ending Cylinder, Head, and Sector fields (collectively known as the CHS fields) are additional elements of the partition table. These fields are essential for starting the computer. The master boot code uses these fields to find and load the boot sector of the active partition. The Starting CHS fields for non-active partitions point to the boot sectors of the remaining primary partitions and the extended boot record (EBR) of the first logical drive in the extended partition. Knowing the starting sector of an extended partition is very important for low-level hard disk drive troubleshooting. If the hard disk drive fails you will need to work with the partition starting point, among other factors, to retrieve stored data.
There is a special 7.8GB (approx. 16,450,560 sectors) limit regardless of the filesystem used and is determined by the maximum hard disk drive’s capacity described by the partition table when the standard 512-byte user sector is used for low-level formatting. For this reason, and to accommodate sizes larger than 7.8GB, Windows-based operating systems that support BIOS INT 13h extensions can access partitions that exceed the first 7.8GB of the hard disk drive ignoring the Starting and Ending CHS fields in favour of the Relative Sectors and Total Sectors fields. BIOS interrupt calls, such as the INT 13, are a facility that DOS programs, and some other software such as boot loaders, use to invoke the BIOS’s facilities. Some operating systems also use the BIOS to probe and initialise hardware resources during their early stages of booting. To read sectors beyond the 7.8GB limit the function 42h of INT13h Extensions should be used. Windows NT family operating systems will place the appropriate values in these otherwise defunct fields because non-Windows NT architecturally based operating systems will use them as they do support BIOS INT 13h extensions, e.g., Windows 9x and Millennium. Consequently, both the operating system and the computer must support BIOS INT 13h extensions in order to create partitions that exceed the first 7.8GB of a hard disk drive. The Relative Sectors field represents the offset from the beginning of the hard disk drive to the beginning of the volume, counting by sectors, for the volume described by the partition table entry. The Total Sectors field represents the total number of sectors in the volume. Using the Relative Sectors and Total Sectors fields, results in a 32-bit number, provides eight more bits than the CHS scheme to represent the total number of sectors. This allows for the creation of a partition table containing up to 232 sectors. With a standard sector size of 512 bytes, the 32 bits used to represent the Relative Sectors and Total Sectors fields translates into a maximum partition size of 2 Terabytes (or 2^32). This addressing scheme is only used in Windows NT family operating systems with an NTFS and FAT32 filesystem. The sector address that a MBR-style partition structures use is 32-bits. A 32-bit sector address is sufficient only to access 2 terabytes of storage.
In other words, it is the term used to describe the non-translating scheme used by the BIOS to access IDE (Integrated Drive Electronics) hard disk drives that are less than or equal to 528MB in capacity, known for it limitation as “The 528MB or 504MiB Barrier” or “The 1024 Cylinder Barrier” because the hard disk drive is too large for the BIOS to translate. The BIOS limitation in translating large hard disk drives has resulted in hard disk drive manufacturers offering "hard disk drive translation" or "dynamic hard disk drive overlay" software.
Sectors were addressed using the cylinder-head-sector notation, or 'CHS addressing' but Logical Block Addressing (LBA or “LBA” addressing) has superseded this.
Hard disk drive read/write heads float over the logically divided platter surface, one above and one below each platter. The individual platters are divided into tracks and the tracks are divided into sectors. The outer tracks form one cylinder; all following tracks from corresponding cylinders etc. By describing a specific cylinder, head and sector, one specific sector can be addressed.
Modern operating systems and software no longer use CHS addressing. This is due to the limitations of several standards and specifications (the Int13h and IDE specifications); particularly hard disk drives larger than approximately 7.8GB could not be addressed any further. CHS addressing is now obsolete, but the partition table specification still reserves room for cylinder, head and sector values; partitions tend to start and end at cylinder boundaries.
Modern operating systems and software addresses a sector regarding a hard disk drive as one huge line of sectors - starting sector zero (0) as the first sector up to the last sector on the hard disk drive. This is called LBA.
LBA can be converted to CHS and vice versa. Converting LBA to CHS is hard disk drive dependant: the CHS geometry of a hard disk drive defines where a cylinder stops and the next one starts.
See: Boot Code, LBA (Logical Block Addressing), Mebibyte (symbol Mi), Megabyte or Decimal Megabyte (symbol MB or Mb) and, Sector.

Cluster (or Allocation Unit)

In data storage, in a filesystem, a cluster is the smallest amount (same-size) addressable unit (or block) that many filesystem formats use for NTFS and the file allocation table (FAT) file to hold a file. Each cluster is uniquely numbered using 16 bits. All filesystems used by Windows organise hard disk drives based on clusters, which consist of one or more contiguous sectors. The smaller the cluster size (or cluster factor, established when a volume is formatted and expressed as a number of bytes in the cluster, e.g., 1,024, 2,048, 8,096 or higher for larger volumes, determining how many blocks of data will be grouped together), the more efficiently a disk stores information. If no cluster size is specified (or assigned) during formatting, the Windows NT family operating system’s Disk Management assigns the default size (when formatting a volume as NTFS by using the format command from the command line without specifying a cluster size; in Disk Management without changing the allocation unit size from Default in the Format dialog box), which does vary and can be overridden, and is based on the size of the volume and the filesystem used. Some operating system environments, unlike the fixed open systems and Windows platforms, use a variable block size, variable-block architecture. Nevertheless, the cluster size is always a multiple of the sector size; an integral number of physical sectors, always a power of 2, e.g., 1, 2, 4, 8…,. These defaults are selected to reduce the amount of space lost and the amount of fragmentation on the volume. As a file is unlikely to be a perfect multiple of a cluster size, fragmentation occurs. Cluster is interchangeable with allocation unit.
Internally, NTFS refers to clusters (or allocation units) and not sectors. NTFS uses the cluster as its unit of allocation to maintain its independence from physical sector sizes. This independence allows NTFS to efficiently support very large hard disk drives by using a larger cluster factor, e.g., 4KB, or to support non-standard hard disk drives that have a sector size other than 512-user bytes.
On larger volumes, use of a larger cluster factor can reduce fragmentation and speed allocation, at a small cost in terms of wasted disk space. NTFS refers to physical locations on a hard disk drive by means of logical cluster number (LCN). LCNs are simply the numbering of all clusters from the beginning of the volume to the end. To convert a LCN to a physical hard disk drive address, NTFS multiplies the LCN by the cluster factor to get the physical byte offset on the volume, as the hard disk drive driver interface requires. NTFS refers to the data within a file by means of virtual cluster numbers (VCNs). VCNs number the clusters belonging to a particular file from zero (0) through to m. VCNs are not necessarily physically contiguous, however, as a VCN can be mapped to any number of LCNs on the volume.
Note: Under a FAT filesystem only 512-byte sectors are supported; consequently, both the sector per cluster and the cluster size are fixed.See: Attribute (Resident & Non-Resident), Sectors, FAT (12-, 16-, and 32-bit), File Allocation Table, and NTFS (New Technology Filesystem).

Cluster Factor

The cluster size (or blocking factor) on a volume which is established when a user formats the volume with either the format command or the Disk Manager Microsoft Management Console (MMC) snap-in, determines how many blocks of data will be grouped together.
Note: The physical platters are logically divided and allocated into cylinders, tracks, and sectors as part of the disk subsystem’s formatting. Each sector contains one or more blocks of data depending on the blocking factor that is used to format the disk, e.g., 1,024, 2,048, 8,096 or higher for larger volumes (also known as the disk’s cluster size), determines how many blocks of data will be grouped together.
See: Cluster (or Allocation Unit), and Allocation Unit (or Cluster).

Code Page

A means of providing support for character sets and keyboards layouts for different countries or regions. A code page is a table that relates the binary character codes used by a program to keys on the keyboard or to characters on the display. Different code pages include different special characters, typically customised for a language or a group of languages. Windows uses code pages to translate keyboard input into character values for non-Unicode based applications, and to translate character values into characters for non-Unicode based output displays.
See: Code pages supported by Microsoft

Cold Boot

The act of starting a computer from the power-off state. If the computer is on, this requires cycling the power off and then back on. A cold boot causes all RAM (also known as physical memory) to be forcibly cleared.
When the computer is powered on the System BIOS begins its complex and convoluted POST sequence of duties when the CPU is reset, i.e., powered on, cold or warm boot. To ascertain a warm boot or a cold boot the ROM BIOS starts up routines to check the value of two bytes located at memory location 0000:0472. Any value other than 1234h or 0x1234 (indicating a warm boot) indicates that it is a cold boot.

Command

An instruction that tells the computer to start, stop, or continue an operation.

COMMAND.COM

An operating system file that is loaded last when the computer is booted. The command interpreter or user interface is the program-loader portion of DOS.
See: Booting, and Command Interpreter.

Command Interpreter

An operating system program that controls the shell or user interface. The command interpreter for DOS is COMMAND.COM; the command interpreter for Windows is WIN.COM; the command interpreter for Windows NT family operating systems is CMD.COM.
See: COMMAND.COM.

Compressed File or Folder

A file or folder (containing files) that has been reduced in size via one or more compression techniques.

Lossless: Preserves all the original information in an image or other data structures.
Lossy: Achieves optical data reduction by discarding redundant and unnecessary information in an image. For example, MPEG, JPEG, JPG.
Data: Mathematical algorithms are applied to the data to eliminate redundancies.

ZIP and RAR files are typically "archives" (a file that contain other files). Generally, the files in an archive are compressed - reducing the original archive’s content files. However, archiving compression is more effective for RAR than for the ZIP format. Archiving makes it easy to group, transport, and copy files faster. For this reason, even though the ZIP format is universally used and accepted as a de facto standard, RAR is still an alternative archiving favourite for many users. There are many ZIP and RAR archiving programs; the most widely used are WinZip and WinRAR.
Many of the attractive advances that RAR has over ZIP have now been addressed with WinZip V9 onwards. Nevertheless, RAR has an important part to play in the archiving fraternity. The RAR format has a significantly improved compression engine compared to the one used for the ZIP format, especially in solid mode. Another important feature of RAR is its support for multi-volume archives. A solid archive, for example, is a RAR archive packed by a special compression method, which treats all files, within the archive, as one continuous data stream. Solid archives are supported only by the RAR archiving format. ZIP archives are always non-solid. The archiving method for RAR archives is a user selectable option and may be solid or non-solid, but solid archiving significantly increases compression, especially when adding a large number of small, similar files. However, there are some disadvantages to using RAR solid archiving (see WinRAR’s Help File for further details).
Many users who archive material frequently use both WinRAR for the RAR format advantages and WinZip for the ZIP format advantages.

Crash

A malfunction that brings work to a halt. A system crash is usually caused by a software malfunction, and ordinarily a crash can be overcome by restarting the system by rebooting the computer – a warm boot. A head crash entails physical damage to the hard disk drive’s media and possible data lose.
See: Stop Error, Blue Screen of Death (BSoD), Blue Screen, Stop Message, Exception Error, or Fatal System Error, System Crash and Warm Boot.

Cylinder

The set of tracks on a hard disk drive that are on each side of all the platters in a stack. They are equidistant from the centre of the hard disk drive. The total number of tracks that can be read without moving the heads. In other words, the set of tracks that are at the same head position on a hard disk drive. Cylinder numbers start at zero (0), with cylinder zero (0) at the outer edge of the logically divided platter. A cylinder is approximately 8MB in size.
See: CHS (Cylinder, Head, Sector).