| What is a cluster? |
|
|
All Microsoft operating systems rely upon the storage of data in fixed length blocks of bytes called clusters. Clusters are essentially groupings of sectors which are used to allocate the data storage area in all Microsoft operating systems, i.e., DOS, Windows, Windows 95, Windows 98, Windows NT, Windows 2000 and Windows XP. Clusters can be one sector in size to 128 sectors in size and cluster sizes vary depending on the size of the logical storage volume and the operating system involved.
These cluster sizes fall generally within the following ranges:
These are general guidelines though because cluster sizes vary between file systems. For the same disk storage space, Windows NTFS, FAT16 and FAT32 based operating systems can have wildly varying cluster sizes. In point of fact, for very small files, Windows NTFS stores the data not in a cluster, but in the Master File Table where other information about the file is stored.
The starting cluster reference number of a file is listed in the directory area of the storage device, e.g., floppy diskette or logical partition of a hard disk drive. The linking of the various potential clusters assigned to one file is done in the File Allocation Table (FAT) in DOS, Windows, Windows 95 and Windows 98 and it is the central record keeper which tracks where file data is stored. |
© 2008 Center for Computer Forensics :: 21800 Melrose Ave Ste 1 :: Southfield, MI 48075 :: 888-458-3222
The Paper Chase Is Not Just About Paper Anymore
