Components

The PSU is in charge of providing electrical charge to all of the components of the computer, especially the motherboard.It has various cables with different types of connectors that'll go on different components

A computer needs to be at all times under optimal temperature at, because all the components generate heat, a cooling system is required to maintain a moderate temperature so that the computer doesn't overheat.

The motherboard is the heart of a computer, it has attached all of the components and runs. These processing and storage components are connected by bus interfaces implemented on the motherboard. The instructions and data are stored using transistors and capacitors and transmitted between components over the bus using electrical signals.Motherboard Form Factors are:ATXMicro-ATXSFFMini-ITX

Such as the CPU socket.There are only two CPU manufacturers: Intel and AMD.Intel uses the LGA socketAMD uses the PGA socket

Like the RAM slots and adapter card slots.Adapter connector slots:PCI, PCIe

Like as powering the motherboard itself and where components obtain their power like the fans and disk drives.Storage Connectors are:SATA, eSATAM.2Power Connectors are:Front panelP19-pin USBAudio headers

Boot optionsBoot passwords and secure bootTrusted Platform Module (TPM)

Input/Output Ports examples:HDMIDVISATAUSBRJ-45 NetworkAudio PortsThunderboltLightning

Power cables that go directly into the motherboard are:20 or 24-pin connector

The central processing unit (CPU), or simply the processor, executes program instruction code. When a software program runs (whether it be system firmware, an operating system, antivirus utility, or word-processing application), it is assembled into instructions utilizing the fundamental instruction set of the CPU platform and loaded into system memory. The CPU then performs the following basic operations on each instruction:The control unit fetches the next instruction in sequence from system memory to the pipeline.The control unit decodes each instruction in turn and either executes it itself or passes it to the arithmetic logic unit (ALU) or floating-point unit (FPU) for execution.The result of the executed instruction is written back to a register, to cache, or to system memory.A register is a temporary storage area available to the different units within the CPU working at the same clock speed as the CPU.Cache is a small block of memory that works at the speed of the CPU or close to it, depending on the cache level. Cache enhances performance by storing instructions and data that the CPU is using regularly.There exist different architectures like:x86 (32 bits)x64 (64 bits)ARM (mobile devices)

CPU architecture that exposes two or more logical processors to the OS, delivering performance benefits similar to multicore and multi socket to threaded applications.

The component that is in charge of providing a signal to the monitor or projector.Many motherboards contain an embedded video card, but often they are not powerful enough.Most commonly a video card will contain a GPU capability and graphics memory alongside video ports such as HDMI, Displayport, and Thunderbolt.

If there is not enough system RAM, the memory space can be extended by using disk storage. This is referred to as a pagefile or swap space. The total amount of addressable memory (system RAM plus swap space) is referred to as virtual memory or virtual RAM . With virtual memory, the OS assigns memory locations to processes in 4 kilobyte chunks called pages. The memory controller moves inactive pages of memory to the swap space to free up physical RAM and retrieves pages from the swap space to physical RAM when required by process execution. An excessive amount of such paging activity will slow the computer down because disk transfer rates are slower than RAM transfer rates.Types of RAM:DDR3DDR4DDR5Each DDR generation sets an upper limit on the maximum possible capacity. DDR for desktop system memory is packaged in a form factor called dual inline memory module (DIMM). The notches (keys) on the module’s edge connector identify the DDR generation (DDR3/DDR4/DDR5) and prevent it from being inserted into an incompatible slot or inserted the wrong way around. DDR DIMMs typically feature heat sinks, due to the use of high clock speeds.Modules:SODIMMECC RAM

SSD or HDD.Removable storage devices:Flash drivesSDCD

RAID 0 (Striping without parity) is when data is spread across two disks, this is not fault-tolerant.RAID 1 (Mirroring) is when data is replicated between two disks, this is more fault-tolerant as if one disk fails the other has the exact data.RAID 5 (Striping with Distributed Parity) is similar to RAID 0 however, the three disks share a parity so if one disk fails it will allow to reconstruct of data from the parity.RAID 10 (Stripe of mirrors) is when you combine RAID 1 but with more disks as at least four disks are required as two arrays are mirrored between two disks, so it provides the best fault-tolerance.

The component in charge of providing an audio signal to a speaker or headphones. They contain audio jack ports to connect both in and out signal

Although the motherboard already has an Ethernet port, additional ports may be needed. The NIC provides just that.

For more details, visit the Troubleshooting Mind Map

Gather Information from the UserThe first report of a problem will typically come from a user or another technician, and this person will be one of the best sources of information if you can ask the right questions. Before you begin examining settings in Windows or taking the PC apart, spend some time gathering information from the user about the problem. Ensure you ask the user to describe all the circumstances and symptoms. Some good questions to ask include:What are the exact error messages appearing on the screen or coming from the speaker?Is anyone else experiencing the same problem?How long has the problem been occurring?What changes have been made recently to the system? Were these changes initiated by you or via another support request?The latest change to a system is very often the cause of the problem. If something worked previously, then excepting mechanical failures, it is likely that the problem has arisen because of some user-initiated change or some environmental or infrastructure change. If something has never worked, a different approach is required.Has anything been tried to solve the problem?Perform BackupsConsider the importance of data stored on the local computer when you open a support case. Check when a backup was last made. If a backup has not been made, perform one before changing the system configuration, if possible.

Conduct ResearchYou cannot always rely on the user to describe the problem accurately or comprehensively. You may need to use research techniques to identify or clarify symptoms and possible causes. One of the most useful troubleshooting skills is being able to perform research to find information quickly. Learn to use web and database search tools so that you can locate information that is relevant and useful. Identify different knowledge sources available to you. When you research a problem, be aware of both internal documentation and information and external support resources, such as vendor support or forums.Make a physical inspection—look and listen. You may be able to see or hear a fault (scorched motherboard, "sick"-sounding disk drive, no fan noise, and so on).If the symptoms of the problem are no longer apparent, a basic technique is to reproduce the problem—that is, repeat the exact circumstances that produced the failure or error. Some problems are intermittent, though, which means that they cannot be repeated reliably. Issues that are transitory or difficult to reproduce are often the hardest to troubleshoot.Check the system documentation, installation and event logs, and diagnostic tools for useful information.Consult other technicians who might have worked on the system recently or might be working now on some related issue. Consider that environmental or infrastructure changes might have been instigated by a different group within the company. Perhaps you are responsible for application support and the network infrastructure group has made some changes without issuing proper notice.Consult vendor documentation and use web search and forum resources to see if the issue is well-known and has an existing fix.Question the ObviousAs you identify symptoms and diagnose causes, take care not to overlook the obvious—sometimes seemingly intractable problems are caused by the simplest things. Diagnosis requires both attention to detail and a willingness to be systematic.One way to consider a computer problem systematically is to step through what should happen, either by performing the steps yourself or by observing the user. Hopefully, this will identify the exact point at which there is a failure or error.If this approach does not work, break the troubleshooting process into compartments or categories, such as power, hardware components, drivers/firmware, software, network, and user actions. If you can isolate your investigation to a particular subsystem by eliminating "non-causes," you can troubleshoot the problem more quickly. For example, when troubleshooting a PC, you might work as follows:Decide whether the problem is hardware or software related (Hardware).Decide which hardware subsystem is affected (Disk).Decide whether the problem is in the disk unit or connectors and cabling (Connectors).Test your theory.

If you cannot solve a problem yourself, it is better to escalate it than to waste a lot of time trying to come up with an answer. Formal escalation routes depend on the type of support service you are operating and the terms of any warranties or service contracts that apply. Some generic escalation routes include:Senior technical and administrative staff, subject matter experts (SMEs), and developers/programmers within your company.Suppliers and manufacturers via warranty and support contracts and helplines or web contact portals.Other support contractors/consultants, websites, and social media.Choosing whether to escalate a problem is complex because you must balance the need to resolve a problem in a timely fashion against the possibility of incurring additional costs or adding to the burdens/priorities that senior staff are already coping with. You should be guided by policies and practices in the company you work for. When you escalate a problem, make sure that what you have found out or attempted so far is documented. After that, describe the problem clearly to whoever is taking over or providing you with assistance.

There are typically three generic approaches to resolving an IT problem:Repair—You need to determine whether the cost of repair makes this the best option.Replace—Often more expensive and may be time-consuming if a part is not available. There may also be an opportunity to upgrade the part or software.Workaround—Not all problems are critical. If neither repair nor replacement is cost-effective, it may be best either to find a workaround or just to document the issue and move on.Establish a Plan of ActionWhen you determined the best solution, you must devise a plan of action to put the solution in place. You have to assess the resources, time, and cost required. Another consideration is potential impacts on the rest of the system that your plan of action may have. A typical example is applying a software patch, which might fix a given problem but cause other programs not to work.An effective change and configuration management system will help you to understand how different systems are interconnected. You must seek the proper authorization for your plan and conduct all remedial activities within the constraints of corporate policies and procedures.Implement the SolutionIf you do not have authorization to implement a solution, you will need to escalate the problem to more senior personnel. If applying the solution is disruptive to the wider network or business, you also need to consider the most appropriate time to schedule the reconfiguration work and plan how to notify other network users.When you make a change to the system as part of implementing a solution, test after each change. If the change does not fix the problem, reverse it, and then try something else. If you make a series of changes without recording what you have done, you could find yourself in a tricky position.Refer to Vendor InstructionsIf you are completing troubleshooting steps under instruction from another technician—the vendor's support service, for instance—make sure you properly understand the steps you are being asked to take, especially if it requires disassembly of a component or reconfiguration of software that you are not familiar with.

Implement Preventive MeasuresTo fully solve a problem, you should implement preventive measures. This means eliminating any factors that could cause the problem to reoccur. For example, if the power cable on a PC blows a fuse, you should not only replace the fuse, but also check to see if there are any power problems in the building that may have caused the fuse to blow in the first place. If a computer is infected with a virus, ensure that the antivirus software is updating itself regularly and users are trained to avoid malware risks.Document Findings, Actions, and OutcomesMost troubleshooting takes place within the context of a ticket system. This shows who is responsible for any particular problem and what its status is. This gives you the opportunity to add a complete description of the problem and its solution (findings, actions, and outcomes).This is very useful for future troubleshooting, as problems fitting into the same category can be reviewed to see if the same solution applies. Troubleshooting steps can be gathered into a "Knowledge Base" or Frequently Asked Questions (FAQ) of support articles. It also helps to analyze IT infrastructure by gathering statistics on what types of problems occur and how frequently.The other value of a log is that it demonstrates what the support department is doing to help the business. This is particularly important for third-party support companies, who need to prove the value achieved in service contracts. When you complete a problem log, remember that people other than you may come to rely on it. Also, logs may be presented to customers as proof of troubleshooting activity. Write clearly and concisely, checking for spelling and grammar errors.

Standards developed as the IEEE 802.3 series describing media types, access methods, data rates, and distance limitations at OSI layers 1 and 2 using xBASE-y designations.

Network dedicated to provisioning storage resources, typically consisting of storage devices and servers connected to switches via host bus adapters.A SAN is isolated from the main network. It is only accessed by servers, not by client PCs and laptops. SAN clients are servers running databases or applications. Provisioning a shared storage pool as a SAN is more flexible and reliable than using local disks on each server machine. SANs use connectivity technologies such as Fiber Channel and Internet SCSI (iSCSI).

A local area network (LAN) is a group of computers connected by cabling and one or more network switches that are all installed at a single geographical location. A LAN might span a single floor in a building, a whole building, or multiple nearby buildings (a campus). Any network where the nodes are within about 1 or 2 km (or about 1 mile) of one another can be thought of as "local." LAN cabling and devices are typically owned and managed by the organization that uses the network.

Can be used to mean a specific network type covering an area equivalent to a city or other municipality. It could mean a company with multiple connected networks within the same metropolitan area—so, larger than a LAN but smaller than a WAN.

Network scope that spans a large geographical area, incorporating more than one site and often a mix of different media types and protocols plus the use of public telecommunications networks.

Network scope and type that uses wireless radio communications based on some variant of the 802.11 (Wi-Fi) standard series.

Has a small core (8–10 microns) and is designed to carry a long wavelength (1,310 or 1,550 nm) infrared signal, generated by a high-power, highly coherent laser diode. Single-mode cables support data rates up to 10 Gbps or better and cable runs of many kilometers, depending on the quality of the cable and optics.

Has a larger core (62.5 or 50 microns) and is designed to carry a shorter wavelength infrared light (850 nm or 1,300 nm). MMF uses less expensive and less coherent LEDs or vertical cavity surface emitting lasers (VCSELs) and consequently is less expensive to deploy than SMF. However, MMF does not support such high signaling speeds or long distances as single-mode and so is more suitable for LANs than WANs.

Not all switches support PoE.If so, there are power injectors that will make it possible.

Feature of Wi-Fi 6 allowing an access point to serve multiple client stations simultaneously.

Use of spatial multiplexing to allow a wireless access point to support multiple client stations simultaneously.

Retains some sort of copper wiring to the customer premises while extending the fiber link from the point of presence to a communications cabinet servicing multiple subscribers.

Is run all the way to the customer’s building. This full fiber connection type is implemented as a passive optical network (PON)

Standard for cellular radio communications and data transfer. GSM phones use a SIM card to identify the subscriber and network provider. 4G and later data standards are developed for GSM.

Method of multiplexing a communications channel using a code to key the modulation of a particular signal. CDMA is associated with Sprint and Verizon cellular phone networks.

Facilitated by an ISP

10.0.0.0 to 10.255.255.255

172.16.0.0 to 172.31.255.255

192.168.0.0 to 192.168.255.255

Each guest OS requires more memory than the host OS, for example if one Windows machine requires 2GB of RAM, then at least 4GB are required for it to be able to run both the host and guest OS, and it can add up quickly if more VM's are running.

Although VM's run on image files, they require a lot of storage, especially if snapshots are wanting to be created so that you can roll back to a specific settings in a particular session. However, in large enterprises, this usually isn't an issue as SAN's are available to use.

Computing environment where multiple independent operating systems can be installed to a single hardware platform and run simultaneously.

Refers to any solution designed to run on "ordinary" desktops or workstations. Each user will be interacting with the virtualization host directly. Desktop virtual platforms, usually based on some sort of guest OS hypervisor, are typically used for testing and development

An environment where safe testing and development can occur as the host OS and the VM cannot communicate to each other, making malware impenetrable to the host OS.

Some applications are no longer supported in later OS versions, this allows the possibility for those programs to still execute by running on a VM an older OS version.

This allows for testing and development for applications to run on different OS's, this feature allows you to test that in one single machine.

This means running a server role machine as a VM, since servers use for about 10% of hardware resources, this allows for up to 9 programs to be running on a single server with the same performance.

This is where applications are running on a server and streamed to a client OS, as this allows for clients to always have the latest version.

Computing architecture where on-demand resources provisioned with the attributes of high availability, scalability, and elasticity are billed to customers on the basis of metered utilization.

Feature of cloud service models that allows customers to track and pay for precise compute, storage, and network resource units.

Provides the network and physical resources to the client, such as servers, load balancers, SAN's, etc.

Provides in between IaaS and SaaS, meaning it provisions application and database services. A typical PaaS solution would deploy servers and storage network infrastructure (as per IaaS) but also provide a multi-tier web application/database platform on top.

Provides fully developed applications, rather than paying for a number of licenses, you can obtain the software running on the cloud servers and paying as you go.

The service guarantees that it'll run at high performance for the most part and experiences very little downtime.

The cost for maintaining more users is linear, meaning that if the number of users double, then the cost would also double.

USBThunderboltHDMIEthernetUSB-CAudio JackLightning

Use good quality and clean paper.Insert the paper in the correct orientation and do not overload the input tray

Wipe exterior dustUse Isopropanol alcohol to clean rollers, however, you need to be very gentle with themFollow manufacturer's instructions

A Microsoft Management Console (MMC) contains one or more snap-ins that are used to modify advanced settings for a subsystem, such as disks or users. The principal consoles available via Administrative Tools are:Computer Management (compmgmt.msc)—The default management console with multiple snap-ins to schedule tasks and configure local users and groups, disks, services, devices, and so on.Defragment and Optimize Drives (dfrgui.exe)—Maintain disk performance by optimizing file storage patterns.Disk Cleanup (cleanmgr.exe)—Regain disk capacity by deleting unwanted files.Event Viewer (eventvwr.msc)—Review system, security, and application logs.Local Security Policy (secpol.msc)—View and edit the security settings.Resource Monitor (resmon.exe) and Performance Monitoring (perfmon.msc)—View and log performance statistics.Registry Editor (regedit.exe)—Make manual edits to the database of Windows configuration settings.Services console (services.msc)—Start, stop, and pause processes running in the background.Task Scheduler (taskschd.msc)—Run software and scripts according to calendar or event triggers.

Power-saving mode where power to all compatible components except system memory is cut. Note that systems on standby still consume some electricity.

Power-saving state where the contents of memory are saved to hard disk (hiberfil.sys) and the computer is powered off. Restarting the computer restores the desktop.

The New Technology File System (NTFS) is a proprietary file system developed by Microsoft for use with Windows. It provides a 64-bit addressing scheme, allowing for very large volumes and file sizes. In theory, the maximum volume size is 16 Exabytes, but actual implementations of NTFS are limited to between 137 GB and 256 Terabytes, depending on the version of Windows and the allocation unit size. The key NTFS features are:Journaling—When data is written to an NTFS volume, it is re-read, verified, and logged. In the event of a problem, the sector concerned is marked as bad and the data relocated. Journaling makes recovery after power outages and crashes faster and more reliable.Snapshots—This allows the Volume Shadow Copy Service to make read-only copies of files at given points in time even if the file is locked by another process. This file version history allows users to revert changes more easily and also supports backup operations.Security—Features such as file permissions and ownership, file access audit trails, quota management, and encrypting file system (EFS) allow administrators to ensure only authorized users can read/modify file data.POSIX Compliance—To support UNIX/Linux compatibility, Microsoft engineered NTFS to support case-sensitive naming, hard links, and other key features required by UNIX/Linux applications. Although the file system is case-sensitive capable and preserves case, Windows does not insist upon case-sensitive naming.Indexing—The Indexing Service creates a catalog of file and folder locations and properties, speeding up searches.Dynamic Disks—This disk management feature allows space on multiple physical disks to be combined into volumes.

The FAT file system is a very early type named for its method of organization—the file allocation table. The FAT provides links from one allocation unit to another. FAT32 is a variant of FAT that uses a 32-bit allocation table, nominally supporting volumes up to 2 TB. The maximum file size is 4 GB minus 1 byte.FAT32 does not support any of the reliability or security features of NTFS. It is typically used to format the system partition (the one that holds the boot loader). It is also useful when formatting removable drives and memory cards intended for multiple operating systems and devices.

64-bit version of FAT designed for use with removable hard drives and flash media. Like NTFS, exFAT supports large volumes (128 petabytes) and file sizes (16 exabytes). There is also support for access permissions but not encryption.

Potential for someone or something to exploit a vulnerability and breach security. A threat may be intentional or unintentional.

It's the likelihood and impact (or consequence) of a threat actor exercising a vulnerability.

Weakness that could be accidentally triggered or intentionally exploited to cause a security breach.

Vulnerability in software that is unpatched by the developer or an attack that exploits such a vulnerability.

Malicious code inserted into an executable file image. The malicious code is executed when the file is run and can deliver a payload, such as attempting to infect other files.

These infect the boot sector code or partition table on a disk drive. When the disk is attached to a computer, the virus attempts to hijack the bootloader process to load itself into memory.

Malicious software program hidden within an innocuous-seeming piece of software. Usually, the Trojan is used to try to compromise the security of the target computer.This is malware concealed within an installer package for software that appears to be legitimate. The malware will be installed alongside the program and execute with the same privileges. It might be able to add itself to startup locations so that it always runs when the computer starts or the user signs in. This is referred to as persistence.

Type of malware that replicates between processes in system memory and can spread over client/server network connections.These replicate between processes in system memory rather than infecting an executable file stored on disk. Worms can also exploit vulnerable client/server software to spread between hosts in a network.

Exploit techniques that use the host's scripting environment to create malicious processes. This refers to malicious code that uses the host’s scripting environment, such as Windows PowerShell or PDF JavaScript, to create new malicious processes in memory. As it may be disguised as script instructions or a document file rather than an executable image file, this type of malware can be harder to detect.

Mechanism for gaining access to a computer that bypasses or subverts the normal method of authentication.

Software that records information about a PC and its users, often installed without the user's consent.

Class of malware that modifies system files, often at the kernel level, to conceal its presence

Malware that tries to extort money from the victim by blocking normal operation of a computer and/or encrypting the victim’s files and demanding payment.

The chain starts with a full backup and then runs incremental jobs that select only new files and files modified since the previous job. An incremental job has the lowest time and storage requirement. However, this type of chain has the most recovery complexity as it can involve two or more jobs, each of which might be stored on different media.

It means that the chain starts with a full backup and then runs differential jobs that select new files and files modified since the original full job. A differential chain has moderate time and storage requirements and slightly less recovery complexity than incremental as it requires a maximum of two jobs (the full backup plus the differential job).

Job type that combines incremental backup jobs to synthesize a full backup job. Synthetic full backups have the advantage of being easy to restore from while also being easy on bandwidth across the network as only changes are transmitted.The chain starts with an initial full backup as normal and subsequently makes a series of incremental backups.When the next full backup is scheduled, the backup software makes one more incremental backup. It then synthesizes a new full backup from the previous full and incremental backups.

Identify the scope of the incident and the host systems and/or removable drives that are likely to contain evidence. If appropriate, these systems should be isolated from the network.Document the scene of the incident using photographs and ideally video and audio. Investigators must record every action they take in identifying, collecting, and handling evidence.If possible, gather any available evidence from a system that is still powered on, using live forensic tools to capture the contents of cache, system memory, and the file system. If live forensic tools are not available, it might be appropriate to video record evidence from the screen.If appropriate, disable encryption or a screen lock and then power off each device.Use a forensic tool to make image copies of fixed disk(s) and any removable disks. A forensic imaging tool uses a write blocker to ensure that no changes occur to the source disk during the imaging process.Make a cryptographic hash of each source disk and its forensic image. This can be used to prove that the digital evidence collected has not been modified subsequent to its collection.Collect physical devices using tamper-evident bags and a chain-of-custody form, and transport to secure storage.