Hard Disk First Sector is MBR (Master Boot Recorder), the content: Some EXE CODE, Identifiers, one with a maximum of 4 partitions, ending flags 0x55aa. The role of MBR is responsible for the loading of the BR. MBR is established (modify) when installing the system.
Partition table Entry.
Each entry16 byte, information inside: Whether Active, Starting Chs, Ending Chs, Relative Sector, Total Sector.Partition Type.
FAT16, 12 uses CHS, supporting up to 1024 C, 255H, 63sector. So the biggest space: 1024 * 255 * 63 * 512 = 8g
And FAT16 supports: Power (2,16) clusters, maximum 128s per cluster, each S512 byte. 4G.
And in FAT32, NTFS uses the Relative Sector, Total Sector.
The MBR's EXE CODE binding partition table can find the corresponding BR, load BR, and turn the control right. The role of BR is responsible for the parameters of the file system, load NTLDR or IO.SYS, and transfers to control.
BR in the content: JMP machine code, a 8byte character, BPB (Bios Parameter Block), EBPB, Execode.
Layout in FAT16:
Block1 block2 block3 ..... blockn ........ blockm ........
Br FAT Table 1 FAT Table 2 FDT (File Directory Table)
BR accounts for a block, fat1, fat2, then FDT, and finally a general file (data). Like the two FAT tables, Table 2 is the backup of Table 1. (This strategy is used in FAT32 to back up the BR). FDT accounts for 32block, and its content is 32byte's entry. So in the root directory in FAT16, 512 files are stored. When you use a long name, the number of files put less is less.
Layout in FAT32:
Block1 ... block6 .... blocki ..... blockn ........ blockm ........
BR FAT Table 1 FAT Table 2 FDT (File Directory Table)
BR accounted for a few blocks (but when you see it, you have a content), Block6 is a backup of BR. Keep a number of blocks behind. Then FAT1, FAT2, then FDT, and finally the general file (data). Like the two FAT tables, Table 2 is the backup of Table 1. (This strategy is used in FAT32 to back up the BR). There is no limit to FDT.
The content in the FAT table (as an example of FAT32): The data unit of each table is a pointer, 32bit, pointing to a cluster number. Mean: The next cluster number of the current cluster is the data of the unit. Example: Content 2 Content 5 Content 7 Content 9 Content 8
Cluster number 1 cluster number 2 cluster 3 cluster number 4 clustered number 5
Cluster number one position: The start address of the FAT table, the position of cluster number 2, and the FAT start address 1 data size. Several clusters have a special meaning, 0 is not used, 0xfffffffff is end (it seems to be a few), that is, no next cluster number. There is a representation of bad cluster. and many more. Each file has a cluster chain that makes a cluster chain by finding its initial cluster number in the catalog, then finding the rest cluster number to the FAT table. Each cluster can only belong to a certain position of a file, so the general cluster number except the special cluster number in the FAT table may not appear, or only once.
Introduction to parameters in BPB: Sector size, root directory cluster number, location of the FAT table, the number of FAT tables, where the boot is backed up, the size of the FAT table, hidden sector. Hide Sector's instructions, because the physics sector and this partition, the physical sector is truly exist, and the logical partition starts from a physical sector, in front of its sector, to hide the sector, The calculation logic sector is physically located in the physical disk.
With BPB, you can find a document.
How to Parse A file: c: /wpj/wpj.txt.
Reference: MSDN a few articles: File System, Startup Disk.
Tools used: EasyRecovry
Not finished.
