Recovery of deleted contents of file
Steps to access NTFS volume using BIOS function
Association B/w DPB and BPB
Difference b/w logical and physical view of memory
Different type of computer viruses
Partition table virus
Boot sector virus
Why should we not calculate FSIfo block information again and again in FAT?
Usage of DMA mode register
What are viruses?
Viruses are special programs having ability to embed themselves in system resources and
there on propagate themselves.
States of viruses?
Dormant state: a virus in dormant state embedded itself within and is observing system
Activation state: a virus when activated would typically perform some unwanted task
causing data lose. This state may triggered as a result of some event.
Infection state: a virus triggered itself into this state as a result of some disk
operation .In this state it will infect some media or file in order to propagate itself.
How larger files can be managed using FAT
Difference b/w primary and extended partition
1. convert LSN to LBA - 5 marks
2. write on FAT (generic) - 5 marks
3. write MFT internal structure - 5 marks
4. cross reference links - 3 marks
5. paging and non-contigious memory allocations - 3 marks
6. difference b/w logical and physical file view - 2 marks
50% MCQ's are from last 10 chapters rest from first 35 chapters
nothing's from last 4 chapters in long qs like memory + viruses chapters .. so my tip to
well prepare last 4 chaptors
1) Disadvantage of undocumented service of interrupts
2) Difference between programmed I/O and interrupt I/O
3) When delete file what happen to chain of cluster in FAT
4) Contiguous memory management p#325
5) What is highest capacity of disk using IDE and extended Bios Function? P# 212
1) In which media storage head touches the surface of the disk and why?p#203
2) How cross reference detects p#316
3) Possible entries are there in FAT12 and FAT16
4) ISR (interrupt service routine) for EOI (end of interrupt) write the line of code for
this in C
5) From where, in partition table’s data part we can check the drive is bootable or
Not.P#332 not sure
1) Why we convert cluster number to sector number
2) How LSN be translated into LBA P# 311
3) How chain of cluster managed in FAT12 P#291
System Programming CS609
Final-term 15 February 2011
Solved by eagle_eye
Total 45 Questions 30 MCQ’s and 15 descriptive questions.
1) DOS command ________ which gives the status of the memory and also points
memory area occupied by which process.
_None of the given
2) Each entry in the IVT is ________ in size.
_4-bytes (P # 12)
3) The tail value of the keyboard buffer should be examined to get to the ______ of
_Start (P # 56)
_None of given)
4) Interrupt Procedures are Reentrant procedures.
_True (P # 38
5) ______ is Disk interrupt.
_13H (P # 42)
6) Boot block consists of ______ bytes.
_512 (P # 242)
7) In parallel communication, the maximum numbers of bits we can send between
computers are ________.
14h include __________ which is used to send a byte.
_Service #1 (P # 121)
9) The status register _____ is the main control register.
_B (P # 146)
10) The DMA requests to acquire buses through the ________ signal.
_HOLD (P # 186)
_None of Given
11) The keyboard device writes a code 0xFA on the port 60H to indicate that the
_Input buffer is full
_Byte has been received properly (P # 179)
_Output buffer is full
_None of the given
12) A single DMA can transfer ______ operands to and from memory in a single a
_8-bits (P # 186)
13) For supporting long file names, _________ fragments can be supported.
14) In FAT12, to calculate the address or offset from index, we need to multiply it
_3/2 (p# 267)
15) ________ Register can be used to show that the channel is single transfer, block
demand transfer mode.
_DMA Command register
_DMA Request Register
_DMA Mode Register
_DMA controller Register
16) LBA address can be used in place of the CHS address.
_True (p# 235)
17) In FAT12, the maximum range of clusters is ……...
_0 ~ FEFH
_2 ~ FEFH (p# 266, 272) not sure
_3 ~ FEFH
18) Each partition information chunk is 16 bytes long and the last two bytes at the
end of the
partition table data part is the partition table signature whose value should be
indicating that the code part contains valid executable code.
_AA55 (p# 219)
19) _________ is used to identify the cause of interrupt.
_Modem control register
_Modem status register
_Interrupt ID register (P # 116)
20) In NTFS, up to ________ characters are used to store files names,
21) A cluster is a collection of contiguous _______.
_Blocks (P # 242)
_None of Given
22) In BPB, root directory is saved in _________.
23) In NTFS, total sizes of MFT entries are _______.
24) In NTFS, _______ store the contents of file.
_Both small & large file Record
_None of given
25) In NTFS, contents and indexed of file is stored in _________.
_Both small & large file Record
_None of given
26) Service 21H/52H service returns the address of DOS internal data structures in
________behind the address returned lies the far address of the first MCB in
_4-bytes (P # 322)
27) 80386 can have ___________ control registers.
_4 (P # 331)
• 80386 and above have 4 Control Registers CR0 ~ CR3.
28) When the content of the file is _____, it means it can be terminated or no
29) The partition table uses the extended _________ service.
_13H (P # 234)
30) The entry point of execution in EXE File can be
_Start of the first instruction
_Start of the last instruction
_Anywhere in the Program (P # 335)
_Can be in the middle of the program
31) Which data structure is derived from BPB and where it resides? [2 Marks] (P #
BPB (BIOS Parameter Block)
• Situated within the Boot Block.
• Contains vital information about the file system.
BIOS parameter block is a data structure maintained by DOS in the boot block for
32) In DMA programming Model, what is the main purpose of base register? [2
• The Mode register is conveyed which Channel is to be programmed and for what purpose
i.e. Read Cycle, Write
Cycle, Memory to memory transfer.
• A request to DMA is made to start its transfer
The purpose of base register holds the base address
33) What is mirroring in FAT32? [2 Marks] (P # 286)
FAT32 evidently will contain more entries and can hence manage a very large disk
In reflection of the anatomy of FAT32 based system the method used to translate the
cluster # into LSN also
34) If LSN=0, then it means __________. [2 Marks] (P # 240)
LSN is relative address with respect to the start of Logical Drive
Each logical partition has LSN=0 block which is the first block in logical drive and is not
necessarily the first
block on physical drive.
35) How we can perform the CPUID test? [2 Marks] (P # 166)
• 486 will pass the alignment test.
• To distinguish 486 with Pentium CPUID Test is used.
36) Write the LBA and CHS address of the MBR. [2 Marks] (P # 218)
Sec = 1 or LBA = 0
• Partition Table at CHS = 001 is also called MBR (Master Boot Record).
37) Write the function to convert BCD into ASCII code. [3 Marks] ( P # 148)
38) How cross references of clusters is detected? [3 Marks] (P # 316)
• If a cluster lie in more than one file chain, then it’s said to be Cross Referenced.
• Cross references can be detected easily by traversing through the chain of all files
and marking the
cluster # during traversal.
• If a cluster is referenced more than once then it indicates a cross reference.
• To solve the problem only one reference should be maintained.
39) What is the main benefit of defragmenter? [3 Marks] (P # 316)
• Disk fragmentation is unwanted.
• Defragmentation Software reserves space for each file in contiguous block by
moving the data in clusters
• As a result of defragmentation the FAT entries will change and data will move from
one cluster to other
localized cluster to reduce seek time
• Defragmentation has high computation cost and thus cannot be performed
40) In NTFS, where the backups of boot block are store &why? [3 Marks] (P # 302)
41) Write down the names of states of the Viruses. [3 Marks] (p #331)
• Viruses are special program having ability to embed themselves in system
resources and there on spread
State of Viruses
• Dormant State:
A Virus in dormant state has embedded itself within and is observing system
• Activation State:
A Virus when activated would typically perform some unwanted tasks causing data
loss. This state may
triggered as result of some event.
• Infection State:
A Virus is triggered into this state typically as a result of some disk operation. In this
state, the Virus will
infect some media or file in order to propagate itself.
42) What control information PSP (Program Segment Prefix) contains? [3 Marks] ( p
PSP (Program Segment Prefix)
• is situated before the start of a process.
• contains control information like DTA (Disk Transfer Area) and command line
1. Why we need to convert the cluster number into sector number? [5 Marks] (P #
All the system calls use the LSN address. If the cluster number is known it should be
converted into LSN to
access the blocks within the cluster. Moreover all the information about file management
uses the cluster
number rather than the LSN for simplicity and for the purpose of managing large disk
space. So here we devise
a formula to convert the cluster number into LSN.
43) Write the Anatomy of FAT32 based file system. [5 Marks] (P # 293)
44) What is descriptor of memory segment? And what are the attributes of memory
management? [5 Marks] (P # 326)
• A Descriptor describes a Memory Segment by storing attributes related to a
• Significant attributes of a Memory Segment can be its base (starting) address, it
length or limit and its
CS609 All subjective part
Q # 1 Write down the structure of segment register in protected modes? [Markes:5]
(P # 326)
• In Protected Mode the Segment Registers are used as Selector.
• As the name suggest they are used to select a descriptor entry from some Descriptor Table.
Q # 2 Write down the anatomy of NTFS based file system? [Markes: 5] (P # 301)
The following slide shows the anatomy of an NTFS based system.
Q # 3 Find the root directory sector where reserved sectors = 1 and sector per
FAT=9. Use appropriate
assumption where needed [Markes: 5]
Q # 4 How many maximum root directory entries are possible in FAT 12 & FAT 16?
The number of entries for FAT 12 or FAT16 are limited
A FAT theoretically will contain 2n entries where n is 12 for FAT 12 and 16 for FAT16.
Q # 6 [Markes:3]
How contents of small and large files are managed in MFT ? (P #303) ( I can’t find
There is an entry for each file in the MFT. There can be difference in the way a file is
upon the size of the file.
Q # 7 what is the segmentation is context of non contiguous memory management
[Markes:2] (p # 325)
Q # 9 Write down the major enhancement of FAT32 comparing to FAT12 and 16.
[Markes:2] (P #
In the FAT32 there is another special reserved block called FSInfo sector. The block
information required by the operating system while cluster allocation/deallocation to files.
This information is
also critical for FAT16 based systems. But in FAT12 and 16 this information is calculated
when ever required.
This calculation at the time of allocation is not feasible in FAT32 as the size of FAT32 is
very large and such
calculations will consume a lots of time, so to save time this information is stored in the
FSInfo block and is
updated at the time of allocation/deallocation.
Q # 10 Write down the purpose of interrupt 12H and interrupt 15H/88H. [Markes:2]
(P # 162)
Used for memory interfaced.
Returns = No. of KB above 1MB mark.
Q # 11 [Markes:2] (P # 139) (be sure about this question answer I m not sure _ )
For what he purpose services are used
LAH /06 Set Alarm
LAH /07 Disable Alarm
LAH /09 Read Alarm