System console

The system console, root console or simply console is the text entry and display device for system administration messages, particularly those from the BIOS or boot loader, the kernel, from the init system and from the system logger.

On traditional minicomputers, the console was a serial console, an RS-232 serial link to a terminal such as a DEC VT100. This terminal was usually kept in a secured room since it could be used for certain privileged functions such as halting the system or selecting which media to boot from. Large midrange systems, e.g. those from Sun Microsystems, Hewlett-Packard and IBM, still use serial consoles. In larger installations, the console ports are attached to multiplexers or network-connected multiport serial servers that let an operator connect his terminal to any of the attached servers.

On PCs, the computer's attached keyboard and monitor have the equivalent function. Since the monitor cable carries video signals, it cannot be extended very far. Often, installations with many servers therefore use keyboard/video multiplexers (KVM switches) and possibly video amplifiers to centralize console access. In recent years, KVM/IP devices have become available that allow a remote computer to view the video output and send keyboard input via any TCP/IP network and therefore the Internet.

Some PC BIOSes, especially in servers, also support serial consoles, giving access to the BIOS through a serial port so that the simpler and cheaper serial console infrastructure can be used. Even where BIOS support is lacking, some operating systems, e.g. FreeBSD and Linux, can be configured for serial console operation either during bootup, or after startup.

It is usually possible to log in from the console. Depending on configuration, the operating system may treat a login session from the console as being more trustworthy than a login session from other sources.

Routers and Managed Switches (as well as other networking and telecoms equipment) may also have console ports in particular Cisco Systems routers and switches that use Cisco IOS are normally configured via their console ports.

From Wikipedia, the free encyclopedia

White screen of death

n Windows 95, Windows 98, Windows Me, Windows 2000, and (possibly) also Windows NT, a White Box of Doom or White screen of death will appear if an error occurs while loading a system-critical application or process, such as the system shell (e.g. Explorer.exe). It has a similar appearance to a General Protection Fault, or GPF.

Clicking "OK" will normally cause the computer to shut down, or it may result in another similar error. This error may also appear if, at startup, an illegal operation occurs during the startup process. Also it will make your computer freeze and you have to shut the computer down.

Some computers, such as Dell computers, have boot errors that result in a WSOD

This error may occasionally be ignored, as it may just have been a single occurrence of a failed startup sequence; however, if it should occur repeatedly, the user may then be required to reinstall Windows.

A way to work around this if you don't want to install Windows is to set the shell to Winfile.exe.

BSOD ( Blue Screen of Death)

Windows NT

In Windows NT, Windows 2000, Windows XP, Windows Server 2003, and Windows Vista, the blue screen of death occurs when the kernel or a driver running in kernel mode encounters an error from which it cannot recover. This is usually caused by an illegal operation being performed. The only safe action the operating system can take in this situation is to restart the computer. As a result, data may be lost, as users are not given an opportunity to save data that has not yet been saved to the hard drive.

Blue screens are known as "Stop errors" in the Windows Resource Kit documentation. They are referred to as "bug checks" in the Windows Software development kit and Driver development kit documentation.

Windows 2000 (can also be configured to display debug info like the Windows NT example)

The text on the error screen contains the code of the error as well as its symbolic name (e.g. 0x0000001E, KMODE_EXCEPTION_NOT_HANDLED) along with four error-dependent values in parentheses that are there to help software engineers with fixing the problem that occurred. Depending on the error code, it may display the address where the problem occurred, along with the driver which is loaded at that address. Under Windows NT and 2000, the second and third sections of the screen may contain information on all loaded drivers and a stack dump, respectively. The driver information is in three columns; the first lists the base address of the driver, the second lists the driver's creation date (as a Unix timestamp), and the third lists the name of the driver.

By default, Windows will create a memory dump file because a blue screen error occurs. Depending on the OS version, there may be several formats this can be saved in, ranging from a 64 KB "mini dump" to a "complete dump" which is effectively a copy of the entire contents of physical RAM. The resulting memory dump file may be debugged later, using a kernel debugger. A debugger is necessary to obtain a stack trace, and may be required to ascertain the true cause of the problem; as the information onscreen is limited and thus possibly misleading, it may hide the true source of the error.

Windows NT 3.5

Microsoft Windows can also be configured to send live debugging information to a kernel debugger running on a separate computer. (Windows XP also allows for kernel debugging from the machine that is running the OS.) If a blue screen error is encountered while a live kernel debugger is attached to the system, Windows will halt execution and cause the debugger to "break in", rather than displaying the BSOD. The debugger can then be used to examine the contents of memory and determine the source of the problem.

The Windows debugger is available as a free download from Microsoft.

Windows includes a feature that can be used to cause a blue screen manually. To enable it, the user must add a value to the Windows registry. After that, a BSOD will appear when the user presses the SCROLL LOCK key twice while holding the right CTRL key.^[3] This feature is primarily useful for obtaining a memory dump of the computer while it is in a given state. As such, it is generally used to aid in troubleshooting system hangs.

By default, Windows XP is configured to save only a 64K minidump when it encounters a blue screen, and then to automatically reboot the computer. Because this process happens very quickly, the blue screen may be seen only for an instant or not at all. Users have sometimes noted this as a random reboot rather than a traditional stop error, and are only aware of an issue after Windows reboots and displays a notification that it has recovered from a serious error.

A BSOD can also be caused by a critical boot loader error, where the operating system is unable to access the boot partition due to incorrect storage drivers or similar problems. The error code in this situation is STOP 0x0000007B (INACCESSIBLE_BOOT_DEVICE). In such cases, there is no memory dump saved. Since the system is unable to boot from the hard drive in this situation, correction of the problem often requires booting from the Microsoft Windows CD. After booting to the CD, it may be possible to correct the problem by performing a repair install or by using the Recovery Console (with CHKDSK).

The color blue was chosen because there was a version of Windows NT for the DEC Alpha platform and there the console colors could not be changed in an easy way. For consistency reasons blue became the color for Stop errors on all platforms (alpha/i386/mips/ppc).

ReactOS

ReactOS

ReactOS, an attempt at creating a free software/open source implementation of a Windows NT-compatible operating system, also features its own BSOD similar to the Windows NT/XP one.

Windows 9x

Windows 9x/Me

The blue screen of death also occurs in Microsoft's home desktop operating systems Windows 95, 98, and Me. Here it is less serious, but more common. In these operating systems, the BSOD is the main way for virtual device drivers to report errors to the user. It is internally referred to by the name of "_VWIN32_FaultPopup". A Windows 9x/Me BSOD gives the user the option either to restart or continue. However, VxDs do not display BSODs frivolously — they usually indicate a problem which cannot be fixed without restarting the computer, and hence after a BSOD is displayed the system is usually unstable or unresponsive.

Two of the most common reasons for BSODs are:

• Problems that occur with incompatible versions of DLLs. This cause is sometimes referred to as DLL hell. Windows loads these DLLs into memory when they are needed by application programs; if versions are changed, the next time an application loads the DLL it may be different from what the application expects. These incompatibilities increase over time as more new software is installed, and is one of the main reasons why a freshly-installed copy of Windows is more stable than an "old" one.

• Faulty or poorly written device drivers, hardware incompatibilities, or damaged hardware may also cause a BSOD. If you have just installed a new piece of hardware, updated a driver, or installed an Operating System update shortly before you see the BSOD, be sure to investigate these causes also.

In Windows 95 and 98, a BSOD occurred when the system attempted to access the file "c:\con\con" on the hard drive. This was often inserted on websites to crash users' machines. Microsoft has released a patch for this.

The BSOD can appear if a user ejects a removable medium while it is being read on 9x/ME. This is particularly common while using Microsoft Office: if a user simply wants to view a document, he might eject a floppy disk before exiting the program. Since Microsoft Office always creates a temporary file in the same directory, it will trigger a BSOD upon exiting because it will attempt to delete the file on the disk that is no longer in the drive.

This type of blue screen is no longer seen in Windows NT, 2000, and XP. In the case of these less serious software errors, the program may still crash, but it will not take down the entire operating system with it due to better memory management and decreased legacy support. In these systems, the "true" BSOD is seen only in cases where the entire operating system crashes.

Windows CE 5.0

Windows CE

The simplest version of the blue screen occurs in Windows CE except the versions for Pocket PC. The blue screen in Windows CE 3.0 is similar to the one in Windows 95 and 98.

Windows for Workgroups 3.11

Windows for Workgroups

Windows for Workgroups' Blue Screen of Death is very similair to the Windows 9x BSoD.

Xbox Error Message

Xbox

Although the Microsoft Xbox usually shows a Green Screen of Death when a critical error occurs, this model was seen showing a BSOD during the presentation of Forza Motorsport at the CeBIT computer fair in Hannover in March 2005.

Boot Loader Function

Boot loader

Most computer systems can only execute code found in the memory (ROM or RAM). Modern operating systems are stored on hard disks, or occasionally on LiveCDs, USB flash drives, or other non-volatile storage devices. When a computer is first powered on, it doesn't have an operating system in memory. The computer's hardware alone cannot perform complex actions such as loading a program from disk, so an apparent paradox exists: to load the operating system into memory, one appears to need to have an operating system already loaded.

The solution is to use a special small program, called a bootstrap loader, bootstrap or boot loader. This program's only job is to load other software for the operating system to start. Often, multiple-stage boot loaders are used, in which several small programs of increasing complexity summon each other, until the last of them loads the operating system. The name bootstrap loader comes from the image of one pulling oneself up by one's bootstraps (see bootstrapping). It derives from the very earliest days of computers and is possibly one of the oldest pieces of computer terminology in common use.

Early programmable computers had a row of toggle switches on the front panel to allow the operator to manually enter the binary boot instructions into memory before transferring control to the CPU. The boot loader would then read the operating system in from an outside storage medium such as paper tape, punched card, or a disk drive.

Pseudo-assembly code for the bootloader might be as simple as the following eight instructions:

0: set the P register to 8
1: check paper tape reader ready
2: if not ready, jump to 1
3: read a byte from paper tape reader to accumulator
4: if end of tape, jump to 8
5: store accumulator to address in P register
6: increment the P register
7: jump to 1

A related example is based on a loader for a 1970's Nicolet Instrument Corporation minicomputer. Note that the bytes of the second-stage loader are read from paper tape in reverse order.

0: set the P register to 106
1: check paper tape reader ready
2: if not ready, jump to 1
3: read a byte from paper tape reader to accumulator
4: store accumulator to address in P register
5: decrement the P register
6: jump to 1

The length of the second stage loader is such that the final byte overwrites location 6. After the instruction in location 5 executes, location 6 starts the second stage loader executing. The second stage loader then waits for the much longer tape containing the operating system to be placed in the tape reader. The difference between the boot loader and second stage loader is the addition of checking code to trap paper tape read errors, a frequent occurrence with the hardware of the time, which in this case was an ASR-33 teletype.

In modern computers the bootstrapping process begins with the CPU executing software contained in ROM (for example, the BIOS of an IBM PC) at a predefined address (the CPU is designed to execute this software after reset without outside help). This software contains rudimentary functionality to search for devices eligible to participate in booting, and load a small program from a special section (most commonly the boot sector) of the most promising device. It is usually possible to configure the BIOS so that only a certain device can be booted from and/or to give priority to some devices over others (a CD or DVD drive is usually given priority over a hard disk, for instance).

Boot loaders may face peculiar constraints, especially in size; for instance, on the IBM PC and compatibles, the first stage of boot loaders located on hard drives must fit into the first 446 bytes of the Master Boot Record, in order to leave room for the 64-byte partition table and the 2-byte 0xAA55 'signature', which the BIOS requires for a proper boot loader.

Some operating systems, most notably pre-1995 Macintosh systems from Apple, are so closely interwoven with their hardware that it is impossible to natively boot an operating system other than the standard one. A common solution in such situations is to design a bootloader that works as a program belonging to the standard OS that hijacks the system and loads the alternative OS. This technique was used by Apple for its A/UX Unix implementation and copied by various freeware operating systems and BeOS Personal Edition 5.

What is msconfig

MSConfig, or System Configuration Utility, is a boot configuration utility bundled with all Microsoft Windows operating systems released after 1995 except Windows 2000. Windows 2000 users can download the utility separately, however. This tool modifies which programs run at startup, edits certain configuration files, and simplifies controls over Windows services. Part of the base Windows install, it can be accessed by running 'msconfig' on any system on which the user has administrator access.

Files that can be edited through MSConfig include AUTOEXEC.BAT, CONFIG.SYS, WIN.INI, SYSTEM.INI on Windows 9x systems, and BOOT.INI on Windows NT systems. The chief benefit to using MSCONFIG to edit these files is that it provides a simplified GUI to indirectly manipulate the sections of those files and the Windows registry tree pertaining to the Windows boot sequence.

The most recent version of MSConfig, released with Windows Vista, features a greatly simplified user interface and increased support for managing services.

Causes and cures of defragments action needed

Causes and cures

Fragmentation occurs when the operating system cannot or will not allocate enough contiguous space to store a complete file as a unit, but instead puts parts of it in gaps between other files (usually those gaps exist because they formerly held a file that the operating system has subsequently deleted or because the operating system allocated excess space for the file in the first place). As advances in technology bring larger disk drives, the performance loss due to fragmentation squares with each doubling of the size of the drive.^{[citation needed]} Larger files and greater numbers of files also contribute to fragmentation and consequent performance loss. Defragmentation attempts to alleviate these problems.

Consider the following scenario, as shown by the image on the right:

An otherwise blank disk has 5 files, A, B, C, D and E each using 10 blocks of space (for this section, a block is an allocation unit of that system, it could be 1K, 100K or 1 megabyte and is not any specific size). On a blank disk, all of these files will be allocated one after the other. (Example (1) on the image.) If file B is deleted, there are two options, leave the space for B empty and use it again later, or compress all the files after B so that the empty space follows it. This could be time consuming if there were hundreds or thousands of files which needed to be moved, so in general the empty space is simply left there, marked in a table as available for later use, then used again as needed.^[1] (Example (2) on the image.) Now, if a new file, F, is allocated 7 blocks of space, it can be placed into the first 7 blocks of the space formerly holding the file B and the 3 blocks following it will remain available. (Example (3) on the image.) If another new file, G is added, and needs only three blocks, it could then occupy the space after F and before C. (Example (4) on the image). Now, if subsequently F needs to be expanded, since the space immediately following it is no longer available, there are two options: (1) add a new block somewhere else and indicate that F has a second extent, or (2) move the file F to someplace else where it can be created as one contiguous file of the new, larger size. The latter operation may not be possible as the file may be larger than any one contiguous space available, or the file conceivably could be so large the operation would take an undesirably long period of time, thus the usual practice is simply to create an extent somewhere else and chain the new extent onto the old one. (Example (5) on the image.) Repeat this practice hundreds or thousands of times and eventually the file system has many free segments in many places and many files may be spread over many extents. If, as a result of free space fragmentation, a newly created file (or a file which has been extended) has to be placed in a large number of extents, access time for that file (or for all files) may become excessively long.

The process of creating new files, and of deleting and expanding existing files, may sometimes be colloquially referred to as churn, and can occur at both the level of the general root file system, but in subdirectories as well. Fragmentation not only occurs at the level of individual files, but also when different files in a directory (and maybe its subdirectories), that are often read in a sequence, start to "drift apart" as a result of "churn".

A defragmentation program must move files around within the free space available to undo fragmentation. This is a memory intensive operation and cannot be performed on a file system with no free space. The reorganization involved in defragmentation does not change logical location of the files (defined as their location within the directory structure).

Another common strategy to optimize defragmentation and to reduce the impact of fragmentation is to partition the hard disk(s) in a way that separates partitions of the file system that experience many more reads than writes from the more volatile zones where files are created and deleted frequently. In Microsoft Windows, the contents of directories such as "\Program Files" or "\Windows" are modified far less frequently than they are read. The directories that contain the users' profiles are modified constantly (especially with the Temp directory and Internet Explorer cache creating thousands of files that are deleted in a few days). If files from user profiles are held on a dedicated partition (as is commonly done on UNIX systems), the defragmenter runs better since it does not need to deal with all the static files from other directories. For partitions with relatively little write activity, defragmentation performance greatly improves after the first defragmentation, since the defragmenter will need to defrag only a small number of new files in the future.

Myths

Myths

Defragging the disk will not stop a system from malfunctioning or crashing because the filesystem is designed to work with fragmented files. [2] Since defrag cannot be run on a filesystem marked as dirty without first running chkdsk [3], a user who intends to run defrag "to fix a system acting strangely" often ends up running chkdsk, which repairs file system errors, the end result of which may mislead the user into thinking that defrag fixed the problem when it was actually fixed by chkdsk.

In fact, in a modern multi-user operating system, an ordinary user cannot defragment the system disks since superuser access is required to move system files. Additionally, modern file systems such as NTFS are designed to decrease the likelihood of fragmentation. [4] Improvements in modern hard drives such as RAM cache, faster platter rotation speed, and greater data density reduce the negative impact of fragmentation on system performance to some degree, though increases in commonly used data quantities offset those benefits. However, modern systems profit enormously from the huge disk capacities currently available, since partially filled disks fragment much less than full disks. [5] In any case, these limitations of defragmentation have led to design decisions in modern operating systems like Windows Vista to automatically defragment in a background process but not to attempt to defragment a volume 100% because doing so would only produce negligible performance gains. [6]

Kinds of File System in a Computer

Filesystems

• FAT DOS 6.x and Windows 9x-systems come with a defragmentation utility called Defrag. The DOS version is a limited version of Norton SpeedDisk.
• NTFS Windows 2000 and newer include an online defragmentation tool based on Diskeeper. NT 4 and below do not have built-in defragmentation utilities.
• ext2 uses an offline defragmenter called e2defrag, which does not work with its successor ext3, unless the ext3 filesystem is temporarily down-graded to ext2.
• JFS has a defragfs utility on IBM operating systems.
• HFS Plus in 1998 introduced a number of optimizations to the allocation algorithms in an attempt to defragment files while they're being accessed without a separate defragmenter.
• XFS provides an online defragmentation utility called xfs_fsr.

An introduction to computer forensics

by: Kevin Cohen

Computer Forensics is the process of investigating electronic devices or computer media for the purpose of discovering and analyzing available, deleted, or "hidden" information that may serve as useful evidence in supporting both claims and defenses of a legal matter as well as it can helpful when data have been accidentally deleted or lost due to hardware failure.

However, this is a very old technique but now it has been changed a lot because of technological advances, modern tools and software’s which makes Computer Forensics much easier for Computer Forensic Experts to find & restore more evidence/data faster and with more accuracy.

Computer forensics has change the way digital evidence is gathered & used as evidence of a crime & it is done using advanced techniques and technologies. A computer forensic expert uses these techniques to discover evidence from an electronic storage device for a possible crime. The data can be from any kind of electronic device like Pen drives, discs, tapes, handhelds, PDAs, memory stick, Emails, logs, hidden or deleted files etc.

Most of us think that deleting a file or history will remove it completely from the hard disk drive. In realty, it only removes the file from the location but the actual file still remains on your computer. It is easier to track what has been done on your computer but difficult to say by whom though it is possible to alter or delete the data completely from your storage device. It depends on computer forensic expert’s skills how well he can find and restore the data without any loss or change.

Computer forensics got widespread attention during the Enron scandal widely believed to be the biggest computer forensics investigation ever. Nowadays Computer Forensics & Electronic discovery is becoming a standard part of litigation of all types, especially large litigations involving corporate matters in which there are large amounts of data.

Computer forensics can be used to uncover a fraud, unauthorized use of a computer, violation of company policies, inadequate record keeping etc… by tracking e-mails, chat-history, files, tapes, sites people browse or any other form of electronic communications.

Data security is one of the biggest issues that the corporate world is facing now by publishing company’s internet/policies & consequences for violations, signing of compliance documents by employees. Businesses can initiate monitoring their own computer systems to avoid legal consequences in future. Making employees aware that monitoring software and Computer forensics personnel are available could prevent workers from wrong doing.

With the use of computers in everyday life and increasing amount of hi-tech crimes, Computer forensics is a growing niche in the litigation support sector. Unlike many jobs in information technology sector, chances are that computer forensics services will not be outsourced to other country because of the confidentiality of the data business which will not allow it to travel just to save a little cash.


source link