Computer-related learning FAT32 system

The original intention of this blog is through questions to help master the computer knowledge

1. According to the following Screenshot Winhex answer questions.

(1) figure what file system hard drive using?

• By observing the obvious is NTFS

(2) the master boot sector MBR footprint size is how many bytes? In which the starting offset disk partition table DPT is how much? The total length of the DPT account how many bytes?

• MBR master boot sector is located in the first sector of the disk, i.e., sector 0, mainly by the boot code, partition table, marks the end of three parts, accounting for a total of 512 bytes.
• A sector number of bytes is possible 128 × 2n (n = 0,1,2,3 ...). In most cases, taking n = 2, i.e., the size of a sector is 512 bytes. Total 512byte main boot record, the MBR boot program accounted wherein the first 446 bytes of the subsequent 64 bytes DPT (partition table), the last two bytes of "55 AA" is the effective partition end mark.
• Partition table (DPT): located in the main boot partition, starting at offset 64 bytes 01BEH to the hard disk partition table offset 01FDH divided into four small end portion, information representing a small portion of each partition, accounting for 16 bytes (the are constant, regardless of the figure, the specific content may continue Baidu)

2.2. An existing U disk, U disk has been formatted as FAT32 file system, software tools by Winhex view that the U disk operating system boot sector DBR is located at sector 0, please answer the following questions.

FIG ① BPB parameter table information block portion


of FIG ② DATA root directory data area
(1) according to FIG. ①BPB parameter table module information section, respectively, the number of bytes to write each sector of samples U disk, each sector FAT table occupies number area, FAT1 sector number of the start sector, FAT2 start sector number and sector number of the sector area starting DATA.

• The number of bytes per sector: bytes per sector:512(observation image)
• Number of sectors occupied by each FAT table: sectors per fat :7697(observation images)
• FAT1 sector number of the start sector:
  FAT1 = DBR start sector number of a sector (sector 0 stem that known) + Retention number (i.e., in FIG sectors resreved sectors:990) = 990
  a DBR sector number may be derived by calculation
• FAT2 sector number of the start sector:
  FAT2 start sector number of sectors = FAT1 + FAT table number of sectors = 990 + 7697 = 8687
• DATA area starting sector number:
  sector number area starting DATA = FAT2 + FAT table number of sectors = 8687 + 7697 = 16384

(2) DATA root portion of the data area directory entries as shown in FIG. ②, there is shown a file has been deleted, the file directory entry is found, the test and analysis of the file creation date, write a detailed steps ( Annex: Winhex Little-Endian byte order employed; and 2 bytes according to the creation date, the recording bits 0-4, "day", record 5-8 "month", 9 ~ 15 records "on").
Little-endian mode: is the high byte stored in high memory address of the lower byte data is stored in the lower memory address, this data storage mode and the low address bits right effectively combined, high portion of the right to a high value, low weight low address part .
A total of 32 bytes, each byte following meanings FIG.

0008388608 80000 hex
analyzed offset is 0E 0Fthe time 3B 83offset amount 11 12is the date of 6F 4E
the small end so the time 83 3B, the date is 4E 6Fconverted into binary date Case
4E6F binary is 100111001101111, is calculated as shown below

(3 ) after analysis, the deleted file is a .rar archive, if you want to restore the deleted file, how would you operate.

• For example, No. 8224 in the 2nd sector of the cluster, the data in the No.3 cluster, a cluster if there are two sectors that data in sector No. 8226
• E5 is marked for deletion
• Find the appropriate data area, the entire cluster are saved as a copy out, with rar extension
  3. thinking: Given a U disk (FAT32 system) root directory of the original file, whether the data area of the root directory of the file the first byte directory entry "E5" character and the other by hand into it repaired? If only the "E5" can be changed to restore it?
• No, when you delete files from the disk is the entry of the 0 byte file directory table of the file instead E5H, this table has been deleted, and each cluster in the file allocation table to the file occupies entry is cleared, and free up space.
  4. The figure below this short filename directory entry corresponding to the file, there is no content?
  
  No content, because there is no storage of cluster data, and size 0