YanoSecYou close an editor, but its saved document remains in a folder. Closing running work and deleting a saved file are different actions. Knowing the difference helps you explain what a computer is doing.
A file is a named collection of data stored by the computer. A data file can hold a document or picture. A program contains instructions; an executable file contains a program the OS can load to run. Both are files, but they serve different purposes.
A process is one running instance of a program, with its own working state and resources. PID means process identifier: a number the OS uses to distinguish that process from others on the same system at that time. The name tells you which program is listed; the PID tells you which running instance is listed.
Before you begin
- Recommended first
- Where practice is allowed, Hardware a security lesson will mention
- Estimated time
- 15 min reading, 15 min activity. Setup and optional practice may take longer.
- Where you work
- Use a desktop or mobile browser with paper or a text editor for notes. No installation, account, terminal or paid service is needed. The cards describe fictional computers. Allow another 10–15 minutes if you choose the optional challenge.
- Without a lab
- Read the cards on this page and write your predictions on paper or in a text editor. Downloads contain the same text and are optional. Use the activity steps to explain your reasoning before comparing it with the expected result. Answer checking needs JavaScript and a secure browser context (HTTPS or a local preview). Saving progress also needs usable browser storage.
After this lesson you can:
- Distinguish a data file, a program file and a running process.
- Count running instances from different process identifiers.
- Explain what ending one stated process changes.
01Example
These fictional rows show one stored editor program and two running instances. They are reading cards, not command output. Compare the PIDs before counting.
Saved files: editor (program); notes.txt (document)
Running processes:
PID 101 editor
PID 202 editor
Two different PIDs identify two listed editor processes.
If only PID 101 ends, PID 202 continues in this case.
Neither saved file is deleted by that stated action.02A file is not its running work
An editor process can read journal.txt, let you change its text in memory, and save new file contents. Ending that process stops its running work. It does not by itself delete the stored program or document. Unsaved text may be lost unless the application has saved it or provides recovery.
Do not count processes by windows. Some applications use several processes for one window; others reuse a running process when another window opens. Here, use the listed PIDs. A PID can change or be reused after a process ends, so a number alone is not a permanent program identity.
One saved program, two fictional running instancesModel. A teaching model drawn by hand. It shows the idea, not real tool output.
Read the full explanation below.
Fictional reading cards; not command output. No program is launched.
Saved files
Original running rows
Original count: 2
Modeled result
Remaining count: 2
editor is a saved file; selecting it does not launch anything.
Unsaved work may be lost unless saved or recovered. Its contents and recovery are unknown.
Editor stores instructions; both listed running instances refer to it. No launch occurs.
Follow the explanation
- Editor stores instructions; both listed running instances refer to it. No launch occurs.
- PID 101 identifies one of two listed editor instances.
- PID 202 is independently identified; saved files are not additional running instances.
- Only PID 101 ends in the model; PID 202 and both saved files remain.
- Unsaved work may be lost unless saved or recovered; contents and recovery remain unknown.
Complete reading-card model
| Record | Original | After modeled end of PID 101 |
|---|---|---|
| Saved editor | Stored program | Unchanged |
| Saved notes.txt | Stored document | Unchanged |
| PID 101 → editor | Running | Ended in model |
| PID 202 → editor | Running | Running |
Two original running rows; one remains after the model action. A window count need not equal a process count. A PID may be reused later. These cards do not establish unsaved contents or recovery.
03Try the file and process cards
Start with the Activity rows. The Separate question case provides different evidence for the final check.
Files and running processes
Fictional rows; these are not output from an inspected computer.
Activity saved files:
editor program file containing instructions
journal.txt data file containing saved text
Activity running processes:
PID 411 editor
PID 512 editor
PID 620 clock
Classify the saved files and the running rows.
Count the editor instances by their different PIDs.
Predict what ending only PID 411 changes in this case.
Assume the other process continues and no saved file is deleted.
Do not end any real processes for this activity.
Separate question case:
PID 301 worker
PID 302 worker
PID 303 worker
PID 450 monitor
How many running worker instances are listed?
Answer format: one digit.
- Make three columns: stored instructions, stored data and running instances. Place the editor program file, journal.txt and each Activity PID row into the appropriate column.
- Count only the Activity editor rows with different PIDs. Expected: two editor instances. The clock row is another process; the stored editor file is not a third running editor.
- Predict what ending only PID 411 changes under the card's assumptions. Expected: that instance ends; PID 512 continues and journal.txt remains saved. Write why this does not tell you whether either editor had unsaved work.
- Name one claim the rows cannot establish, such as whether an unfamiliar process is harmful. A name and PID identify a listed instance; they do not establish its origin or behavior.
- Finish with your note. Do not end real processes to try the prediction; this activity changes no files or running programs.
04Optional challenge
Imagine that two editor processes contain different unsaved drafts. Write what you would check before closing either one and what would show that a save succeeded. Then suppose the editor offers crash recovery. Explain why the possibility of recovery is different from confirming that a document has been saved.
05Fresh cases for the checks
Use these fictional cases for the checks below. They have different inputs from the worked examples. Read them here or make notes; no installation or external service is needed.
Files card A: three entries on a fictional computerOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Entry P: a saved file named painter contains instructions that the OS can load to run.
Entry Q: a saved file named colours.txt contains the learner's colour names.
Entry R: PID 681 is currently running painter with its own working state.
These entries describe different things even though P and R share a program name.
Files card B: an independent fixed inventoryOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Saved files: viewer (instructions); route.txt (saved text)
Running processes on this computer at the stated time:
PID 713 viewer
PID 716 viewer
PID 718 viewer
PID 724 viewer
PID 756 clock
Count from this inventory; no window count or live process list is supplied.
Files card C: predict the effect of ending one instanceOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Saved program file: brush
Saved data file: sketch.txt, containing outline
Running processes: PID 831 brush; PID 842 brush; PID 907 clock
PID 831 holds a new paragraph that has not been saved to sketch.txt.
Action: end only PID 831. No other process stops.
This action performs no file deletion or Save operation. No recovery feature is established.
Files card D: a separate replacement-instance caseOwned fixture. An original file made for this course. Follow the activity's instructions in your own lab.
Before: PID 911 scribe; PID 926 scribe; PID 940 clock
First, only PID 911 ends. The other listed processes keep running.
Next, a new instance of scribe starts with PID 958.
These events take place on the same fictional computer.
06Explain a process claim
Optional self-check: write two or three sentences explaining why a stored program file, a running instance and an unsaved draft need separate evidence. Then describe what you would check before closing an instance with work you want to keep.
Review your explanation: use PIDs to distinguish the current instances; separate ending running work from deleting a file; and look for evidence of a successful Save rather than assuming that closing or a possible recovery feature preserves the draft. This explanation is self-reviewed.
07Common mistakes
If you count one process because the names match, mark each different PID in the requested list. Each marked row is a separate listed instance.
If your device shows other PIDs, use the supplied card for this question. Live process counts vary and are not the evidence being assessed.
If an unfamiliar name seems suspicious, write what you observed and what remains unknown. Do not stop a process to test an unsupported guess about its purpose.
If the worksheet will not download, classify the inline rows in your notes. You need no process-list command to finish this lesson. Next, you will use these running-program ideas to describe who requests and supplies data.
References
- Microsoft: About Processes and Threads
The opening explanation describes process resources and identifiers. You do not need the later programming interfaces or thread details for this lesson.