Start Here
Four practice stations plus a knowledge check, each a different way to work through Chapter 3. Take them in any order. Nothing here is graded or stored, so use it as many times as you like before the quiz or lab. Have scratch paper ready for the arithmetic stations.
What this chapter asked you to be able to do
- Convert values between binary, decimal, and hexadecimal, and read multi-byte values in the correct byte order.
- Describe how bits, nibbles, bytes, words, and double-words appear in a hex editor.
- Verify a drive logical and physical sector size with platform tools before calculating any offset.
- Calculate cluster size, total file slack, RAM slack, and drive slack from real geometry values.
- Distinguish logical drives from physical drives, and logical files from physical cluster chains.
- Predict what a quick format and a full format leave recoverable on FAT and NTFS volumes.
Your progress this session
These counters update as you check answers on each station. They reset when you reload the page.
Key Terms Flashcards
Select a card to reveal its definition, then select again to flip it back. Try to state the definition before you flip. The counter tracks how many distinct cards you have opened.
Number Systems and the Units They Measure
Two short sets, both answered by typing a number rather than picking from a list. First convert a stored byte to its decimal value, then answer six counting questions about the units. Work each one from the place values or the nibble table rather than from memory.
A. What decimal value does this byte hold?
Each item gives one byte, written either in binary or in hexadecimal. Work out the value, type it, and submit. Pressing Enter submits as well.
B. How many? Type the number.
Six counting questions about the units this section covers. Each has a single whole-number answer.
Reference: the sixteen values of a nibble
| Binary | Dec | Hex | Binary | Dec | Hex |
|---|---|---|---|---|---|
| 0000 | 0 | 0 | 1000 | 8 | 8 |
| 0001 | 1 | 1 | 1001 | 9 | 9 |
| 0010 | 2 | 2 | 1010 | 10 | A |
| 0011 | 3 | 3 | 1011 | 11 | B |
| 0100 | 4 | 4 | 1100 | 12 | C |
| 0101 | 5 | 5 | 1101 | 13 | D |
| 0110 | 6 | 6 | 1110 | 14 | E |
| 0111 | 7 | 7 | 1111 | 15 | F |
Clusters Allocated and Slack Produced
For each file, work out how many whole clusters the file system hands it and how much of that space goes unused. Both answers come from the same two numbers, so do the division first and the subtraction second.
Reference: RAM slack and drive slack compared
| Component | Runs from | Runs to | Size | What it can hold |
|---|---|---|---|---|
| RAM slack | End of the file data | End of the sector that data ends in | Always less than one sector | Memory residue on older systems; zero-filled by modern Windows and Linux |
| Drive slack | End of that last written sector | End of the cluster | A whole number of sectors, usually larger | Whatever the previous occupant of the cluster left behind |
What Formatting Removes and What Survives
Two sets. First identify what was run from what the image shows, then decide what is still recoverable.
A. What happened to this volume?
Each item describes what the raw image shows. Name the operation that produced it.
B. What can still be recovered?
Given the situation, choose the recovery that is realistically available.
Knowledge Check
Ten questions across the whole chapter. Answer all of them, then check your score. Reset and try again as often as you like.