Glossary

APFS
Apple File System, released in 2017 as a replacement for HFS+
APSB
Volume Superblock in APFS, each representing a different file system state.
Attributes
Attributes are usually referring to the DOS attributes Archive, Read/Only, Directory, Hidden, System, Volume. See Recovery Tree.
In NTFS, attributes are structures within an MFT record describing a file (see: NT Attributes).
Block
A Block is the smallest unit addressable by the file system, also called a cluster.
Under APFS, a block refers to a unit of file system metadata organized in B-Trees of blocks.
Boot record
A Boot record is a special sector describing the file system following this sector. Boot records are used in all file systems, sometimes called Superblock (APFS, EXT) or Volume Header (HFS+).
Cloning a drive
Making an exact sector-by-sector image of a drive. You may want to do this, if you need to perform a data recovery on a drive that has physical damage (bad sectors). You can work with the image as you would work with the original drive.
Cluster
A cluster is the smallest unit addressable by the file system. A cluster is always a multiple of a sector. Typical cluster sizes are 1, 2, 4, 8, 16, 32, 64, 128 sectors. In file systems other than NTFS or FAT, clusters are sometimes called blocks
Cluster Size
See Sectors Per Cluster
Data recovery
The process of retrieving files from a drive that cannot be accessed from its operating system anymore.
Deleted file
A file is deleted in a FAT file system by overwriting the 1st character of its directory entry with 0xE5 and releasing the FAT entries of the clusters used. In NTFS, a file is deleted by marking its reference in the MFT as unused. Other file systems, such as EXT and HFS+, remove the allocation information, rendering a deleted file unrecoverable unless it can be recovered through a Journaled File System entry. Check the Deleted checkbox in the Recovery Tree if you want deleted files displayed.

APFS takes a different approach as it creates checkpoints at regular time intervals, preserving all information about deleted files, as long as this information has not been purged. After you click on an APFS file system, GetDataBack prompts you to include old (and possibly deleted) file system states.

Directory
In a FAT file system, a directory is a list of directory entries. In NTFS, a directory is a list of Index Entries. In EXT, a directory is a file containing filenames. HFS+ and APFS organize filenames as B-trees called Catalog
exFAT
Modified FAT32 supporting extents.
EXT
EXT is Linux's Extended File System. There are three variants EXT2, EXT3 (=EXT2 + Journaled FS), and EXT4 (=EXT3 + Extents).
Extents
An extent is a contiguous area of storage reserved for a file in a file system, represented as a range of block numbers. A file can consist of zero or more extents; one file fragment requires one extent. The direct benefit is in storing each range compactly as two numbers, instead of canonically storing every block number in the range. Also, the extent allocation results in less file fragmentation. APFS, HFS+, exFAT, EXT, and NTFS are all using extents to store file allocation. A FAT file system except for exFAT does not.
FAT File System
Name of a file system using a file allocation table. Introduced with DOS for floppies in 1977 and used in all Windows versions. There are FAT12, FAT16, and FAT32, as well as exFAT. The number refers to the length in bits of one FAT entry. So a FAT12 entry is 12 bits long, capable of addressing 2^12=4096 clusters, while FAT32 can, in theory, address 2^32=4294967296 clusters. exFAT is a modified FAT32, using a 32-bit FAT and extents to describe data allocation.
File Entry (MFT entry)
A file entry in NTFS is an entry in the MFT.
File System
The file system (such  as FAT or NTFS) is the scheme of how a file is stored on a disk. Do not confuse it with the operating system (such as Windows or Linux).
Hexadecimal
The hexadecimal system is based on the number 16, other than the decimal system, which is based on 10. The supplemental digits are A, B, C, D, E, and F. Example: hex AA = dec 170. (10*16 + 10*1).
HFS+
Hierarchical File System, introduced by Apple in 1998 replacing HFS, now replaced by APFS
Image File
An image file is a sector-by-sector copy of a drive. You can use it as a source for GetDataBack.
Imaging a Drive
See Cloning a Drive
Index Allocation
An index allocation is the outside value of the non-resident $A0 attribute, which contains a list of filenames establishing a directory.
Inode
An inode is a basic structure in EXT. It describes a file and its allocation.
LFN
NTFS uses attributes to store the LFN (long filename).
Logical Drive
Logical drives are drives like A:, B:, C:, etc. They are accessed using the corresponding operation system routines.
Media Descriptor
Flag byte in the boot record and the beginning of a FAT describing the kind of drive. Usually xF8 for hard drives.
MFT (Master File Table)
The MFT is a database containing information about every file or directory on an NTFS volume. An entry is called MFT entry or file entry.
MFT Entry
One 1024-bytes record from the MFT. NTFS file entry
MFT Number
The MFT number is the position of a file entry within the MFT.
Non-resident Attribute
see: NT Attributes
NTFS
File system introduced with Windows NT, used by all current Windows versions.
NT Attributes
The NT Attributes describe every aspect of a file in NTFS, such as filenames, time stamps, file sizes, data allocations and more:
Number Name Description
$10 Standard information contains time stamps and DOS attributes
$30 Filename contains the file's name for different namespaces (usually NT's native Unicode filename and DOS compatible DOS filename)
$80 Data if the entry represents a file, this attribute contains the file's data
$90 Index root if the entry is a directory, this attribute describes the root of a binary tree of directory entries
$A0 Index allocation if the entry is a directory, this attribute contains a list of filenames
NT Attributes can be resident or non-resident. Resident attributes are stored within the MFT entry, while non-resident attributes are store outside using run lists.
Partition
A partition is a contiguous region on a physical drive. The operating system usually interprets it as a logical drive or a volume.
Partition Entry
A partition entry describes the type, location, and size of a partition.
Partition Table
The MBR-style partition table is a list of partition entries located in sector 0 of a drive. If a drive contains "extended partitions", there is a linked list of several partition tables on the drive. Size is limited to 2 TB.
A GPT-style partition table is located in sector 1 and does not impose a size limit.
Physical Drive
 Physical drives are tangible media like hard drives and diskettes. They are accessed through low-level BIOS functions.
RAID
 Redundant Array of Inexpensive Disks. Set of drives.
Recovery Tree
Explorer-style view displaying all recovered files and directories. See Recovery Tree, Load and Save Recovery.
Resident Attribute
see: NT Attributes
Root Directory
In NTFS, the root directory is described by the index buffer of MFT entry #5. FAT describes the location and length of the root directory in its boot record. FAT32 and exFAT describe the first cluster of the root in their boot record. EXT defines inode #2 as root.
Run List
A run list is a list of clusters used for an NT Attribute. If the attributes are too large to fit into the MFT entry, some become non-resident, meaning the value part of the specific attribute moves outside of the entry. In this case, the run list describes the outside data. 
Scan
A scan is the process of examining every single sector of a drive. See Step1, Load and Save Recovery.
Sector
A sector is the smallest unit you can access on a drive. The size of a sector is usually 512 bytes. Multiple sectors are grouped into clusters. On drives that employ the 4K-sector-hack, the sector size is 4096 bytes, see Bytes per sector.
Sectors Per Cluster
This term describes the cluster size the file system is using. It is fundamental for translating a cluster number into a physical sector number.
Sophistication Level
The Sophistication Level is a unique feature of GetDataBack to balance the need to collect relevant information against the time it takes to do that. The concept allows for a measured approach to a drive. It is our goal to scan the "bad drive" for what is needed for the data recovery to work, while ignoring uninteresting or unpromising areas on the drive.
Superblock
A Superblock is a special sector describing the file system following this sector, especially in EXT and APFS. See Boot records
Virtual Image
Virtual Images are short text files describing the data to be loaded. Thus, you can "glue" together different data sources. That is especially helpful if you want to recover RAID arrays.
Volume
A Volume is a logical drive, usually defined by a partition on a physical drive
Volume Header
A Volume Header is a special sector describing the file system following this sector, especially in HFS+. See Boot records
<<    Introduction   [Select Drive  >  Select File System  >  Recovery Tree]    Settings    Menu    Support    Glossary    >>