TechMint: Managing_Data_and

Showing posts with label Managing_Data_and_Software. Show all posts

Managing Data and Software

Introduction

Before looking into data and software management, let us find out what is disturbing Mr. Croft of Croft Constructions. He and his employees seem to be having problems using computers in their office. The problems are related to managing data and software. Here are the problems as described by them.

Croft: On Thursday, I employed Sally, and decided to put her to work on the computer immediately. As Betty was using one of the machines, I asked her to use the other. This machine did not have MS Word. So I took out the original diskettes and began to load MS Word. To my dismay, I found that the diskettes were corrupted. I called up my software dealer and got another copy the next day. This meant a day wasted for Sally.

Betty: Mr. Croft wanted a list of clients based in New York. I had been updating the database file on both machines and could not remember which machine I had worked on last. As a result, I had to manually check the files. A waste of time and effort. Further, Mr. Croft does not want information about his clients falling into unauthorized hands. I keep files containing client information only on floppy disks, which means unloading and loading the diskettes each time I want to update the files,

Sally: As I was typing a letter for Mr. Croft, I found the message, Your PC is now STONED!', displayed on the screen. As I did not know what it was, I ignored it. Later Mr. Croft discovered that it was a virus. We had to do a major cleaning operation to get rid of the infection.

The above situation highlights some common problems of data and software maintenance. These problems can be easily rectified by maintaining multiple copies of data and software, hiding files containing confidential information and protecting files from viruses. These and related issues will form the contents of this session.

Master and Working Copies of Data and Software

Smallville High School had a file containing the names and marks of its students. While working with the diskette, the Principal accidentally deleted all the files. The results of the students could not be given on time.

The above mentioned problem would not have arisen if the Principal had additional copies of the same set of files.

Consider another situation. Suppose you open a file which contains a letter. To make modifications to it, you will open it, modify it and save the modified letter in the same file. If the power fails when you are saving the file, there is a chance that the data will get damaged. A damaged file is called a corrupted file in computer jargon. Now you will have to write the letter again, unless you had made a copy of the letter earlier. An additional copy of a file is called a backup.

Most computer users keep two or three copies of the same file. The original copy of data/software is called the master copy and the duplicates you make are called working copies. Most users use only the working copy so that the original is always available for emergencies. For example, the master copy will be useful if your hard disk crashes (a hard disk is said to have crashed if all the data and software stored in it cannot be accessed) and your working copy gets corrupted. Or, take the case when you are using your data after a long time. If the duplicate is corrupted, either due to bad storage or maintenance problems, you can always use the master.

Backing up is the process of archiving data and software. Since the amount of data to be backed up is usually very large (sometimes in excess of 500 MB), backups are typically taken on storage mediums like CD-ROM, cartridge tapes and M-0 disks. Most operating systems provide facility for backing up data and software.

Windows NT provides a utility for backing up and restoring files from tape drives. Windows NT Backup is a graphical tool for protecting data from accidental loss or hardware or media failures. NT Backup makes it easy to use a tape drive to backup and restore important files on the system.

Managing Floppy Disks

Adequate care has to be taken of floppy disks or they might get corrupted. Maintenance of floppy disks involves two major functions:

Identification of Data and Software

In contrast to the hard disk, where you store a large quantity of data in well-organized directories, a floppy typically stores specific software or data. The number of floppies you might have to maintain often runs into hundreds, or even thousands. Labeling floppy disks appropriately is the easiest method of identifying data and software.

Paper Labels

Paper labels are used with floppy disk for external identification. As soon as you save any data on a diskette, you should use the label to indicate the contents of the diskette.

Software Labels

Apart from the external labels, software labels, also known as volume labels can be assigned to diskettes. You can assign a character label to the disk to indicate its contents.

While you are formatting a diskette, you can assign a volume label. The DOS command LABEL may also be used for this purpose. It accepts a name from the keyboard and stores it as the volume label. For example, to label the diskette in drive A use the command:

LABEL A:

When a diskette is formatted, the volume label gets erased and you can assign a new one.

Security - Write-protecting Floppy Disks

Protection of data and software is vital, since unauthorized users tend to destroy valuable data and software. Since data and software is going to be stored on floppy disks or hard disks, protecting the floppy disks or hard disks ensures data security to a great extent.

Write-protecting Floppy Disks

You would often create files which have to be used extensively but do not require modification or deletion. These may be data files you are using only for reporting, and not for processing. Or, they may be programs, which you would like to save from being overwritten or accidentally erased.

One way is to make the whole floppy write-protected. In other words, no writing operation can take place on the disk. Data can only be read. In a microdisk, the write-protect tab is a small sticker that has to be stuck onto the floppy disk. In a microdisk, the write-protect tab on the diskette has to be pushed down to enable protection.

Write Protection on a 3½ Disk

Handling Floppy Disks

Floppy disks need special care and handling, as they can get exposed to dirt, heat, and other environmental hazards. Such exposures tend to corrupt the floppy disks. The integrity of the data and software stored is lost. That is why each floppy disk is enclosed in its own protective cover. It also comes with a paper jacket. Some of the things you should observe while handling diskettes are:

Store diskettes in their boxes.
Hold a diskette always by the corner and write on labels with a felt-tipped pen (a pencil or ball-point pen can damage the disk if you press too hard).
Do not place heavy objects on top of diskettes.
Do not touch the exposed parts of the disk or bend it.

Microdisks have rigid plastic covers with metal shields that protect the disk from dirt and fingerprints. When you insert the disk into the disk drive, the computer automatically moves this shield aside to read the disk.

Whichever type of diskette you are using, it is important to store it in a safe place, away from dust, moisture, magnetism, and extreme temperatures.

File Access

On a PC, if you have files containing confidential information, you can prevent others from accessing them by denying access to the relevant files or to the machine itself.

You can prevent access to files in one of the following ways:

Giving passwords and permissions to the computer system
Hiding the files

Some software packages enable you to give passwords for the files you create. The file can be accessed only on supplying the password.

Windows NT provides a multi-layered security architecture. The Security Subsystem of Windows NT is responsible for maintaining security and access-restrictions in the system. The security model provides for discretionary access control so that the owner of a resource (file or folder) can specify which users or groups can access the resources and what type of access they are allowed (such as read, write, and delete). Windows NT also allows the users of the system to specify file access permissions for individual files. The Reference Monitor provides services for validating access to objects, checking user privileges, and generating audit messages.

You can hide files using the DOS ATTRIB command. When you hide a file, the filename will not be displayed in the directory listing. No person can display the file unless the name of the file is known. The file cannot be deleted or copied. The command for hiding one or more files is:

ATTRIB +H <filename>

This hides the specified file(s) from users. The -H option unhides the specified file(s). Figure shows the DIR command before and after hiding the file using the ATTRIB command.

Hiding Files Using the ATTRIB Command

If you want people to read your files but are concerned about them being modified, then you can make individual files read-only. A file is said to be read-only if you are able to examine the contents, but not change them. The command to use is:

ATTRIB +R <filename>

The <filename> can contain wildcard characters to make multiple files read-only. Once a file has been made read-only, it cannot be modified or deleted. An attempt to delete it returns an error message 'Access denied'. Once you have made the required files read-only, your system is secure.

However, if you wish to modify it, you will need to remove its read-only status. This is also done with the ATTRIB utility, with the -R option.

Machine Access

There are two ways of locking a machine. One is to install a mechanical lock that has to be opened by a key. Most of the PCs come with this lock.

Under Windows NT, the Logon Process and the Security Subsystem jointly ensure access restrictions and protection from unauthorized access. The Windows NT Logon Process provides for mandatory logon to identify users. Each user must have an account and must supply a password to access that account. The logon name and password provided by the user is authenticated by the Security subsystem. After successful authentication, whenever the user accesses an object, the Security Reference Monitor ensures that the user has permission to access the object.

Protecting Data and Software from Viruses

On May 14, 1988, most computers attached to the Israel University had their hard disks corrupted. It was reported that nearly 115,000 disks were corrupted on that day. Later on, it was found to be a virus that was programmed to change the system areas of all accessible hard disks. This virus was named the Jerusalem Black Hole virus.

In another incident, people purchasing BASIC programs suddenly found that characters on the screen started bouncing up and down. This was attributed to a virus known as the Italian Ping-Pong virus.

These are just two of the numerous news items related to computer viruses, which you have probably read. One of the buzzwords in the field of computers today is virus. A virus is an actively infectious computer program that places copies of itself into other applications and programs. It also infects data files and documents. The reason why a virus attaches itself to an executable program is that, in order to perform its destructive action, it has to get executed. Thus, it remains dormant until you run the application or program to which it is attached. Viruses, which infect document files, load the virus code into the RAM whenever the document is read.

Typically, on running the program to which a virus is attached, the virus infects all portions of memory and then infects other files on your disks (diskettes and hard disks). So the next person using the same diskette on a different computer spreads the virus to the new system.

The reason why viruses cause so much fear is that they destroy valuable data and programs, which could mean that you loose months of work.

When PCs have been connected together to form a network, the damage can be worse. This is because the virus program spreads from one PC to another, thus infecting all the workstations (the computers that form part of the network).

Effects of Viruses

The effect of a virus can sometimes be very destructive, involving large amounts of data. Different viruses have different effects. Some of these effects are listed below:

Corrupting files
Increasing file sizes
Interference with the display on the VDU
Formatting the hard disk, thus destroying data
Marking good sectors as bad
Destroying contents of some sectors at random
Slowing down the system
Scrambling file names by manipulating the directory contents; the data is all there, but the user is unable to access it
Changing all filenames to a single name.

Viruses are triggered off in various ways. For example, some viruses are triggered off by the date, such as the Jerusalem-B virus which waits for Friday the 13th, when it deletes the program files you execute without your permission. Other viruses are triggered by booting a system, such as the PC Stone virus, that occasionally displays the message 'Your PC is now STONED!' as your computer starts, and causes data loss on, both, the hard disk and floppy disks. The Raindrop virus waits till a .COM file is executed and then starts pushing the characters to the bottom of your screen. Hence, no proper display is possible till the virus is eradicated.

Types of Viruses

There are two main types of viruses. They are:

These two types may be detectable or non-detectable. Non-detectable viruses are called Stealth Viruses.

File Virus

A file virus attacks executable program files (files with extension .COM and .EXE). It may replace a portion of the original file with its own code, thus destroying the file, or it may attach itself to the file and yet allow the file to be executed. Examples of file viruses are Raindrop and Jerusalem-B.

Once an infected file is executed, the virus finds itself in the main or internal memory. It continues to exist in the memory even after the file has completed execution. When another file is executed, the virus attaches itself to this file and writes the modified file onto the disk, thus causing one more file to become infected. Some viruses infect a file only once, while others infect a file each time it is executed. The virus continues to infect files till the machine is switched off or re-booted.

How Boot-sector/Partition-table Virus damages your Computer

When an operating system is installed from a floppy disk, the first sector in the outermost track of the floppy contains a short program called the bootstrap loader. This program does the job of loading the operating system into the computer's memory when the computer is switched on. In a hard disk, the first sector contains a program called the master boot program, which does the same job of locating and loading the operating system into the computer's memory. This activity is called booting.

A boot sector virus substitutes itself for the bootstrap loader, and a partition-table virus substitutes itself for the master boot program. These viruses get loaded every time you switch on the system. Once the virus is loaded into RAM, it goes about infecting all files on the disk. Also, to simulate normal processing, the virus program transfers control to the original bootstrap loader so that booting can take place.

The virus infects other diskettes in the following manner. Whenever a diskette is accessed, the virus first checks whether the diskette is infected. If it is already infected, the requested disk access is performed and control is returned to the user. If the diskette is not infected, the virus moves the original boot record of the diskette to some other safe sector and copies its own code onto the boot sector, thus infecting this diskette. It then proceeds with the requested disk access. Some examples of boot-sector/partition-table viruses are C Brain, PC Stone and Birthday Joshi.

Stealth Virus

Stealth viruses are those written in a way so as to avoid detection by standard anti-virus software. A particular virus may be a file virus and a stealth virus, or a boot-sector virus and a stealth virus. The techniques used to avoid detection are self-encryption (where the virus converts its code into some sort of program code), and alteration of disk directory data. One example of a stealth virus is the Whale virus. This is, both, a file infector and a stealth virus. This virus infects .EXE files and adds 9216 bytes to each file size. The virus then subtracts 9216 bytes from this file's entry in the directory to give the impression that no change has taken place.

Virus Detection and Cleaning

Your machine first contracts a virus from an infected diskette. It then passes the infection to other diskettes. When those diskettes are used on other machines, they also get infected. In a networking environment, your workstation can get infected when you interact with other machines on the network.

Viruses are normally identified by the standard messages they use, such as 'Your PC is now Stoned' or 'Welcome to the Dungeon'. If they do not use messages, they can be detected by their signature, i.e. a series of bytes unique to a virus. The detection of viruses is normally carried out by standard software.

Virus Attack Symptoms

You look out for the following symptoms, which may indicate a possible virus attack, viz.

Programs take a long time to load.
Accessing the disk takes a long time.
Strange or irrelevant error messages or screen displays appear.
Files disappear; strange files may appear.
Executable files change in size.
Drive lights come on without reason.

Anti-virus Programs

Cleaning a disk of file viruses involves deleting the virus code from the infected file, while cleaning a disk of boot-sector/partition-table viruses involves deleting the virus code from the respective sectors and copying the boot programs back to their original space.

Although all this seems easy, the actual process is very complicated, and sometimes drastic measures have to be adopted to delete viruses, such as deleting infected files or formatting disks.

Anti-virus programs are mainly of two types:

Scanners
Antidotes

Scanners scan the hard disk or floppy disk and detect many viruses; for example, the program VirusScan by McAfee Associates. These programs normally check for a known number of viruses. Figure 2.5 shows the starting screen of McAfee virus scanner for Windows NT.

The scanner checks all the files on the disk that you specify for viruses and reports if it finds any. Then you can either delete the infected file or let McAfee clean the file. The scanning process is shown in Figure.

The Starting Screen of McAfee Virus Scanner

Antidotes destroy viruses which they are programmed to detect. Examples are CPAV from Central Point and Norton Anti-Virus from Symantec Corp and McAfee.

McAfee Virus Scanner in Operation

Some virus scanners reside in the computer's memory and check for the entry of a virus after every I/O operation. On detection of a virus, a warning is displayed and all further operations are suspended.

Examples are Smartdog and UTRes.

However, these days most anti-virus software perform scanning as well as eradication of viruses. A typical example of this category is Norton Anti-virus.

Virus Preventior

Viruses spread when infected floppy disks are transported from one computer to another. It is always better to prevent virus attacks than cure infected disks. Here are a few precautions you should observe to prevent virus attacks.

Make sure that the system is always booted from the hard disk or a virus-free, write-protected system diskette.
Take frequent backups of all your files; in case of a virus attack, you can always replace your data.
Buy software from authorized selling agents; unauthorized software, besides being illegal, has a higher chance of having a virus.
Use write-protect tabs on floppy disks that do not need data to be written onto them.
Avoid updating the date of your system to match a date on which viruses tend to attack, like Friday the 13th.
Do not lend your program disks, as they may come back infected; if you have to give them, make a copy and check for viruses or format the disk when it is returned.
Do not let anyone use your system; if this is not possible, do not allow others to use their own diskettes.
Never run unknown programs before making sure that they have no virus.
Do not copy game-programs from other users who work on different computer systems. Since games are the most frequently distributed type of software, they are frequently infected with viruses.

Worms and Trojan Horses

Whenever viruses are discussed, both Trojan Horses and Worms are discussed in the same context. A Worm is a program that duplicates itself without attaching its code to other programs. Worms normally exist on networks rather than single machines. A Worm creates a number of copies of itself, all running simultaneously, and thus slowing down the system. An example of a Worm is the US Internet Worm, which was injected into the Internet network. This program multiplied uncontrollably, eating up the available memory space of all the infected computers on the network until they could no longer function.

Bulletin boards on networks are the most common source of viruses. In a network, most users wishing to share software, place such software in a place called the bulletin board along with messages for other users. Sometimes virus programmers place infected programs onto the bulletin board and, as a result, the network gets infected. Network users should only access bulletin boards, but not download software from them to their workstations without checking the software for infection.

A Trojan Horse is a supposedly useful program, which encourages you to run it. But its real purpose is to damage files on your system, or to plant a virus or a worm. An example of a Trojan horse is Egabtr, (pronounced as eggbeater). Egabtr is an acronym for enhanced graphics adaptor beater. It is supposed to enhance the images on your screen, but it actually destroys data and programs on disks.

Another Trojan Horse called Stars, is a program to display visual effects on the screen. It does that but, at the same time, locates files containing the network users' passwords and destroys them.

Note: The anti-virus programs for Win NT are different from those for the Windows95 machines. These programs differ in construction as well as usage.