| Appendix |
57
lost cluster
A cluster that has an assigned number in the file allocation table, even though it is not assigned to any file. You can
free up disk space by reassigning lost clusters. In DOS and Windows, you can find lost clusters with the ScanDisk
utility.
MFT records
Master File Table. A file that contains the records of every other file and directory in an NTFS-formatted hard disk
drive. The operating system needs this information to access the files.
root records
File Allocation Table. A file that contains the records of every other file and directory in a FAT-formatted hard disk
drive. The operating system needs this information to access the files. There are FAT32, FAT16 and FAT versions.
sector
The smallest unit that can be accessed on a disk. Tracks are concentric circles around the disk and the sectors are
segments within each circle.
unallocated space
Space on a hard disk where no partition exists. A partition may have been deleted or damaged or a partition may not
have been created.
unused space in MFT records
The performance of the computer system depends a lot on the performance of the MFT. When you delete files, the
MFT entry for that file is not deleted, it is marked as deleted. This is called unused space in the MFT. If unused space
is not removed from the MFT, the size of the table could grow to a point where it becomes fragmented, affecting
the performance of the MFT and possibly the performance of the computer. This space may also contain residual
confidential data (file names, file attributes, resident file data) from the files that previously occupied these spaces.
KillDisk can wipe out the residual data without touching the existing data.
Windows system caching
Windows reserves a specified amount of volatile memory for file system operations. This is done in RAM because it
is the quickest way to do these repetitive tasks.
Windows system records
The Windows registry keeps track of almost everything that happens in windows. This enhances performance of the
computer when doing repetitive tasks. Over time, these records can take up a lot of space.
Erase methods
One Pass Zeros or One Pass Random
When using One Pass Zeros or One Pass Random, the number of passes is fixed and cannot be changed. When the
write head passes through a sector, it writes only zeros or a series of random characters.
US DoD 5220.22-M
The write head passes over each sector three times. The first time with zeros (0x00), second time with 0xFF and the
third time with random characters. There is one final pass to verify random characters by reading.
Canadian CSEC ITSG-06
The write head passes over each sector, writing a Random character. On the next pass, writes the compliment of
previously written character. Final pass is Random, proceeded by a verify.