Explore hard disk partition (2000/07/26)
The hard disk partition is the topic that often talks frequently during the operating system installation. For some simple applications, hard disk partitions are not an obstacle, but for some complex applications, they cannot understand some of the details of the hard disk partition mechanism. This article will explore the basic principles and applications of hard disk partitions deeply. First, the general concept of the partition is a partition, which is partitioned on the hard disk to be used as a separate storage area, which is divided into main partition and expand partition. The primary partition is used to store the boot record of the operating system (in the first sector of the primary partition) and an operating system file; the expansion partition is generally used to store data and applications. A hard disk can be divided into 1-4 partitions, up to 4 primary partitions. If there is an expansion partition, you can have up to 3 primary partitions. Generally there is only one expansion partition that can be divided into multiple logical drives. We must explicitly establish the primary partition, but do not have to explicitly establish expansion partitions. When we establish the first non-main partition logic drive, we have implicitly built an expansion partition. When we increase the logical drive, it is to add a logical drive to the expansion partition. Second, the problem is proposed that a DOS and Windows operating system have been installed on a PC, which share a primary partition, and another logical drive D, now preparing to install the Unix operating system on the machine. Since the file system of the UNIX operating system is not compatible with DOS / Windows, unix the UNIX primary partition must be built on the hard disk on the existing DOS partition. Such a hard disk has multiple (here two) primary partitions, and we must provide a way to implement the selection boot of the operating system. Third, in-depth understanding of the partition. The characteristics of the primary partition and logical drive primary partition can only have one activity at any time, and when a primary partition is activated, other primary partitions on the same hard disk cannot be accessed. So the operating system in a primary partition cannot access files on other primary partitions on the same physical hard disk. The logical drive does not belong to an operating system, as long as its file system is compatible with the launched operating system, the operating system can access it. An important difference between the primary partition and logical drive is: Each logical drive assigns unique drive name (drive letter), and sharing all the same drive name on the same hard disk, because at a certain moment can only have one primary partition It is activity. This means that one of the primary partitions that can only be used to access the active driven name. 2. When the drive name is assigned, the operating system on the active partition will perform a process called a drive image that assigns the drive name to the primary partition and the logical drive. All primary partitions are first mapped, while the logical drive is specified by subsequent letters. For example, suppose the file system of the operating system of the hard disk activity partition is compatible with all logical drive file systems, but if the logical drive file system is not compatible with the file system of the launched operating system, the logical drive will be ignored. If your PC has two hard drives, each hard disk can be divided into 1-4 partitions, which can have their respective primary partitions and expansion partitions. If the file system is compatible, the operating system will allocate the drive name as above. Fourth, understand the hard disk bootstrap 1. Hard Disk Structure Overview The 0 head 0 cylinder of the hard disk is called the main guiding sector, which does not belong to any partition. The main boot sector is placed on the main boot record, which is mainly composed of boot programs and partition tables, which is created by low-level formatting programs (generally completed by the manufacturer).
The partition table contains information about each partition, such as the start of the partition and end the magnetic head number, the track number, sector number, and partitions are active partitions. When the partition is not established, the partition table is empty. The main boot program mainly completes the hard disk bootstrap. The partition is done by the partitioning program of each operating system, and the partition program fills in partition information to the partition table. Any partition must use the formatted command of the corresponding operating system to format it. The first sector of each partition is the guiding sector of the corresponding operating system, and there is a boot record. 2. After the hard disk starts, the process system is self-inspection, cured 19 interrupt reset hard drives in the ROM, read the main boot record to memory, check the partition table, find the unique activity partition, and according to the partition table information to the first fan of the active partition The area reading is recorded, and the control is given to the boot program of the boot record, and the bootloader completes the loading of the operating system. 3. Control the startup method of the operating system 1: Since the partition table format is transparent to the partition programs of each operating system, the partition program of any operating system can be used to specify the active partition, and the computer can switch to another main partition. Operating system. Method 2: From the hard disk launch process. We can see that after the 19th interrupt reads the first sector of the active partition into the memory, the control is handed over to it. With this kind of characteristics, we can create a special primary partition and set it to active. It is not a boot record that is stored in the first sector, but a program that provides an operating system selection, then it To read the boot record of your selected operating system into the memory and execute the boot program. Such a program is called a boot management program that can be provided by an operating system or a third-party software developer. What needs to be pointed out is that when we started Windows 95/98, pressing the Select interface of F8 is not provided by the boot management program, but the Windows writes to the first sector boot program to control this operation at the time of installation. The program is provided by the system startup. V. Solution to the problem through the above discussion, we can easily solve the problems that the article began in the article. 1. Backup Data must be reduced by the extended partition due to the hard disk, so the D disk data must be backed up (note that our assumption: there is only one primary partition and a logical partition). 2. Establish a UNIX partition with UNIX system disk launch system, run the partition program, establish a UNIX primary partition, format the installation of the operating system. Establish a logical drive for UNIX to store data and applications. 3. Establish a logical drive for DOS / Windows to start the system, run the DOS partition program, add a logical drive to store DOS / Windows data and applications. This way we can make DOS / Windows and UNIX shares a hard drive. We can use any way to say in the "Startup" of the Control System to select Start DOS / Windows and UNIX. If you want to use the second method, you must install the boot management program. Computer virus disk storage structure February 4, 2001 Chaos Angels
For computer viruses, different types of viruses are different from the storage structure on the disk. 1. The overall division of disk space After formatting, the magnetic disk includes: the main boot record area (only hard drives), boot record area, file allocation table (FAT), directory area, and data area. The information used in the main boot record area and the boot record area is stored in the DOS system startup. File Allocation Table (FAT) is a table that reflects the status of the current disk sector. Each DOS disk contains two identical FAT tables, which are FAT1 and FAT2, and FAT2 is a backup table. FAT is managed with the directory. The current file directory and its size, storage time and other information are stored on the directory area. The file content data corresponding to the data area storage and file names. (1) Overall division of floppy space When using DOS's external command Format formats a floppy disk, not only the disk is divided into several tracks, and each track is divided into several sectors, and the divided sector is divided into five regions. They are the boot record area, file allocation table 1, file allocation table 2, root directory area, and data area. For the floppy disk, there is only one boot area, the boot area is 0 sides 0 to 1 sector in the disk, and its role is responsible for loading the system two implies files IO.sys and MSDOS.sys in the system startup, and provides DOS. A disk I / O parameter table necessary for disk read and write. File Allocation Table (FAT) is a registration form for the sectors of all files on the disk, which is not important, once destroyed, will not be able to find the contents of the file. Even those who are proficient in DOS, fix the FAT table damaged disk file, is also not easy, the overhead is very large. For this purpose, when the disk area is divided, two identical file allocation tables are retained. The root directory area is a directory registration form that records all files on the disk. Mainly records the file name, expansion name, file properties, file length, file establishment date, settling time, and other important information. (2) The overall division of the hard disk space is different for different types, different media disks, and the format of DOS division disks is different. For hard drives, since the storage space is relatively large, in order to allow multiple operating systems to share the hard disk space, and hope to start the system from the disk, DOS is divided into the main boot record area and multiple system partitions. .
For the allocation of the hard disk space consists of two parts: the first part is the first sector of the entire hard disk. This sector is called the main boot program sector of the hard disk, which consists of two parts, one is the main boot program, The second is the partition information table. The primary boot program is a program that is first executed when the hard disk is started, and it is loaded into the executive partition (active partition) boot program to further boot the system. The partition information form registers each partition boot indicator, the operating system indicator, and the position of the partition occupies the position of the hard disk space; the second part is each system partition. Each system partition is a region provided to each operating system. Each region can only store an operating system, and the system in this area has its own boot record, file allocation table, file directory area, and data area. If the entire hard disk is used by DOS, the hard disk is on the hard disk, from the main boot program and partition information table, partition boot program, file allocation table, file root directory area, and file data area.
The hard disk main guiding sector is very special, it is not within the jurisdiction of DOS. So use DOS's very resident orders Format, FDisk, and Debug can't touch it. The hard disk cannot be started when the sector is corrupted. With Format, FDisk can't fix it. DEBUG's L command and W command cannot be used for the main boot sector. Only by borrowing INT 13h or low formatting partition under Debug. 2. The system-type virus disk storage structural system type virus refers to a start-up sector that is specifically infectious to the operating system, which mainly refers to a virus infected by the hard disk main guides and DOS boot sectors. The storage structure of the system-type virus on the disk is such that the virus program is divided into two parts, and the first portion is stored in the disk boot sector, and the second portion stores other sectors in the disk. When the virus program is infected with a disk, you first find a blank cluster on the disk according to the FAT table (if the second part of the virus program occupies several clusters, you need to find a continuous blank cluster), then put the second part of the virus program And the contents of the magnetic disk original guiding sector are written to the blank cluster, followed by writing the first portion of the virus program into the disk guiding sector. However, due to the different disk, the position of the blank cluster occupied by the second part of the virus program is different, and when the virus program is invading the system, it must put all the programs into memory, and the morally put it in the system is disk boot. The virus program in the sector, the segment program is loaded with the second portion into the memory, so that the first part must know the cluster number or logical sector number of the cluster of its second portion. To this end, when the virus program is infected with a disk, it is necessary to write its first portion to the disk guide sector, but also the cluster number of the virus program second part (or the logical sector number of the first sector of the cluster). A logical sector number of the first sector of the second portion is stored at the offset address 01f9 of the disk. In addition, due to the DOS allocation disk space, each cluster of the assignment must be associated with a file, but the cluster of the system-type virus program does not have a corresponding file name, which is written in a direct disk. Acquired so that the clusters they occupy may be assigned to the newly established disk file by DOS, which is overwritten. In order to avoid such a situation, the virus program immediately registers the contents of these clusters in FAT in FAT after writing its second part to the blank cluster, and after this treatment, DOS is These clusters will not be assigned to other newly established files. 3. File Virus Disk Storage Structure File Virus refers to an executable file in a special infection system, that is, an extension called .com, .exe. For file type viruses, the virus program attached to the head, tail, middle or "idle" part of the infected document, and the virus program does not stand blank clusters on the disk. That is, the disk space occupied by the virus program depends on the disk space occupied by its host program. However, there must be increased disk space occupied by the host program after the invasion of the virus. Most file viruses belong to the so-called shell virus, what is the file case? It is simply a hierarchy of computer software. For example, Computer Software Computer has prepared an educational software. After design and debugging, the function of software itself has been perfect, and it can be provided to the user as a stand-alone disk file. However, in order to improve the product of the product, the company decides to add a beautiful cover for the software, and the designer can add a program that displays the cover based on the completed software. Usually we call the software itself is the kernel, and the additional display cover program is called a housing, load operational relationship.
