|
19951001
高级用户
流落街头
积分 570
发帖 272
注册 2005-10-17
来自 北京
状态 离线
|
『楼 主』:
哪位朋友知道磁盘的卷标在磁盘的什么位置？
使用 LLM 解释/回答一下
哪位朋友知道磁盘的卷标在磁盘的什么位置？ 哪个扇区？在扇区内的位置？
Which friend knows where the volume label of the disk is? Which sector? The position within the sector?
|
|
 2006-11-15 02:15 |
|
|
x2wei
初级用户
积分 44
发帖 17
注册 2006-4-24
状态 离线
|
『第 2 楼』:
aaa
使用 LLM 解释/回答一下
Originally posted by 19951001 at 2006-11-15 02:15:
哪位朋友知道磁盘的卷标在磁盘的什么位置？ 哪个扇区？在扇区内的位置？
记得至少用dos格式化的磁盘是放在目录项的第一个好像,当一个目录项存放的。
还有一种好像是存放在逻辑盘的引导扇区的0x47开始的11个字节中。
你可以用个工具把磁盘的主引导区、逻辑引导区、目录表调出来看看嘛。
下个winimage来看看
Originally posted by 19951001 at 2006-11-15 02:15:
Which friend knows where the volume label of the disk is located? Which sector? The position within the sector?
I remember that at least the disk formatted with DOS is placed in the first directory entry, as stored in a directory entry.
There is also another way that it seems to be stored in 11 bytes starting from 0x47 in the logical disk's boot sector.
You can use a tool to extract the disk's master boot record, logical boot sector, and directory table to take a look.
Download a winimage to have a look
|
|
|
2006-11-15 04:34 |
|
|
zhgwbzhd
高级用户
积分 506
发帖 187
注册 2005-12-4
状态 离线
|
『第 3 楼』:
使用 LLM 解释/回答一下
就在每一个分区的第一扇区，那里的具体位置，记不清除了。
Just at the first sector of each partition, the specific location there, I can't remember clearly.
|
|
|
2006-11-15 05:35 |
|
|
spoton
初级用户
积分 54
发帖 25
注册 2006-10-31
来自 疯人院
状态 离线
|
|
|
2006-11-15 06:26 |
|
|
darkradx
高级用户
积分 972
发帖 420
注册 2004-5-16
状态 离线
|
『第 5 楼』:
使用 LLM 解释/回答一下
卷标就在根目录区, attribute=08h
The volume label is in the root directory area, attribute = 08h
|
平生进退如飙风 |
|
|
2006-11-15 11:30 |
|
|
19951001
高级用户
流落街头
积分 570
发帖 272
注册 2005-10-17
来自 北京
状态 离线
|
『第 6 楼』:
使用 LLM 解释/回答一下
我的C盘是 NTFS 分区，卷标为 12345678910，第一个扇区内容如下：
Disk C Absolute Sector 0 [0x0]
00000000000: EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 δRÉNTFS ☻.
00000000010: 00 00 00 00 00 F8 00 00 3F 00 FF 00 3F 00 00 00 ° ? . ?
00000000020: 00 00 00 00 80 00 80 00 FD 25 9C 00 00 00 00 00 Ç Ç ²%£
00000000030: 04 00 00 00 00 00 00 00 5F C2 09 00 00 00 00 00 ♦ _┬.
00000000040: F6 00 00 00 01 00 00 00 8D 0E AF 2C 24 AF 2C C6 ÷ ☺ ì♫»,$»,╞
00000000050: 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB B8 C0 07 ·3└Ä╨╝ |√╕└.
00000000060: 8E D8 E8 16 00 B8 00 0D 8E C0 33 DB C6 06 0E 00 Ä╪Φ▬ ╕ .Ä└3█╞♠♫
00000000070: 10 E8 53 00 68 00 0D 68 6A 02 CB 8A 16 24 00 B4 ►ΦS h .hj☻╦è▬$ ┤
00000000080: 08 CD 13 73 05 B9 FF FF 8A F1 66 0F B6 C6 40 66 .═‼s♣╣..è±f☼╢╞@f
00000000090: 0F B6 D1 80 E2 3F F7 E2 86 CD C0 ED 06 41 66 0F ☼╢╤ÇΓ?≈Γå═└φ♠Af☼
000000000A0: B7 C9 66 F7 E1 66 A3 20 00 C3 B4 41 BB AA 55 8A ╖╔f≈ßfú ├┤A╗¬Uè
000000000B0: 16 24 00 CD 13 72 0F 81 FB 55 AA 75 09 F6 C1 01 ▬$ ═‼r☼ü√U¬u.÷┴☺
000000000C0: 74 04 FE 06 14 00 C3 66 60 1E 06 66 A1 10 00 66 t♦■♠¶ ├f`▲♠fí► f
000000000D0: 03 06 1C 00 66 3B 06 20 00 0F 82 3A 00 1E 66 6A ♥♠∟ f;♠ ☼é: ▲fj
000000000E0: 00 66 50 06 53 66 68 10 00 01 00 80 3E 14 00 00 fP♠Sfh► ☺ Ç>¶
000000000F0: 0F 85 0C 00 E8 B3 FF 80 3E 14 00 00 0F 84 61 00 ☼à♀ Φ│.Ç>¶ ☼äa
00000000100: B4 42 8A 16 24 00 16 1F 8B F4 CD 13 66 58 5B 07 ┤Bè▬$ ▬▼ï⌠═‼fX[.
00000000110: 66 58 66 58 1F EB 2D 66 33 D2 66 0F B7 0E 18 00 fXfX▼δ-f3╥f☼╖♫↑
00000000120: 66 F7 F1 FE C2 8A CA 66 8B D0 66 C1 EA 10 F7 36 f≈±■┬è╩fï╨f┴Ω►≈6
00000000130: 1A 00 86 D6 8A 16 24 00 8A E8 C0 E4 06 0A CC B8 → å╓è▬$ èΦ└Σ♠.╠╕
00000000140: 01 02 CD 13 0F 82 19 00 8C C0 05 20 00 8E C0 66 ☺☻═‼☼é↓ î└♣ Ä└f
00000000150: FF 06 10 00 FF 0E 0E 00 0F 85 6F FF 07 1F 66 61 .♠► .♫♫ ☼ào..▼fa
00000000160: C3 A0 F8 01 E8 09 00 A0 FB 01 E8 03 00 FB EB FE ├á°☺Φ. á√☺Φ♥ √δ■
00000000170: B4 01 8B F0 AC 3C 00 74 09 B4 0E BB 07 00 CD 10 ┤☺ï≡¼< t.┤♫╗. ═►
00000000180: EB F2 C3 0D 0A 41 20 64 69 73 6B 20 72 65 61 64 δ≥├..A disk read
00000000190: 20 65 72 72 6F 72 20 6F 63 63 75 72 72 65 64 00 error occurred
000000001A0: 0D 0A 4E 54 4C 44 52 20 69 73 20 6D 69 73 73 69 ..NTLDR is missi
000000001B0: 6E 67 00 0D 0A 4E 54 4C 44 52 20 69 73 20 63 6F ng ..NTLDR is co
000000001C0: 6D 70 72 65 73 73 65 64 00 0D 0A 50 72 65 73 73 mpressed ..Press
000000001D0: 20 43 74 72 6C 2B 41 6C 74 2B 44 65 6C 20 74 6F Ctrl+Alt+Del to
000000001E0: 20 72 65 73 74 61 72 74 0D 0A 00 00 00 00 00 00 restart..
000000001F0: 00 00 00 00 00 00 00 00 83 A0 B3 C9 00 00 55 AA âá│╔ U¬
请问高手，卷标应该在什么位置？
My C drive is an NTFS partition with the volume label 12345678910. The content of the first sector is as follows:
Disk C Absolute Sector 0
00000000000: EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 δRÉNTFS ☻.
00000000010: 00 00 00 00 00 F8 00 00 3F 00 FF 00 3F 00 00 00 ° ? . ?
00000000020: 00 00 00 00 80 00 80 00 FD 25 9C 00 00 00 00 00 Ç Ç ²%£
00000000030: 04 00 00 00 00 00 00 00 5F C2 09 00 00 00 00 00 ♦ _┬.
00000000040: F6 00 00 00 01 00 00 00 8D 0E AF 2C 24 AF 2C C6 ÷ ☺ ì♫»,$»,╞
00000000050: 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB B8 C0 07 ·3└Ä╨╝ |√╕└.
00000000060: 8E D8 E8 16 00 B8 00 0D 8E C0 33 DB C6 06 0E 00 Ä╪Φ▬ ╕ .Ä└3█╞♠♫
00000000070: 10 E8 53 00 68 00 0D 68 6A 02 CB 8A 16 24 00 B4 ►ΦS h .hj☻╦è▬$ ┤
00000000080: 08 CD 13 73 05 B9 FF FF 8A F1 66 0F B6 C6 40 66 .═‼s♣╣..è±f☼╢╞@f
00000000090: 0F B6 D1 80 E2 3F F7 E2 86 CD C0 ED 06 41 66 0F ☼╢╤ÇΓ?≈Γå═└φ♠Af☼
000000000A0: B7 C9 66 F7 E1 66 A3 20 00 C3 B4 41 BB AA 55 8A ╖╔f≈ßfú ├┤A╗¬Uè
000000000B0: 16 24 00 CD 13 72 0F 81 FB 55 AA 75 09 F6 C1 01 ▬$ ═‼r☼ü√U¬u.÷┴☺
000000000C0: 74 04 FE 06 14 00 C3 66 60 1E 06 66 A1 10 00 66 t♦■♠¶ ├f`▲♠fí► f
000000000D0: 03 06 1C 00 66 3B 06 20 00 0F 82 3A 00 1E 66 6A ♥♠∟ f;♠ ☼é: ▲fj
000000000E0: 00 66 50 06 53 66 68 10 00 01 00 80 3E 14 00 00 fP♠Sfh► ☺ Ç>¶
000000000F0: 0F 85 0C 00 E8 B3 FF 80 3E 14 00 00 0F 84 61 00 ☼à♀ Φ│.Ç>¶ ☼äa
00000000100: B4 42 8A 16 24 00 16 1F 8B F4 CD 13 66 58 5B 07 ┤Bè▬$ ▬▼ï⌠═‼fX
|
|
|
2006-11-15 23:58 |
|
|
DOS95
初级用户
积分 112
发帖 49
注册 2006-9-23
状态 离线
|
『第 7 楼』:
使用 LLM 解释/回答一下
卷标是一种比怪古怪的文件，所以放在文件目录表，就是 FDT，不一定是第一项，只要文件描述说某个文件在卷标就行。记住，文件目录表/文件分配表/引导扇区是完全不同的概念。
Volume label is a rather odd file, so it is placed in the file directory table, which is FDT. It is not necessarily the first item. As long as the file description says that a certain file is in the volume label. Remember, the file directory table/file allocation table/boot sector are completely different concepts.
|
|
|
2006-11-16 00:14 |
|
|
Michael
钻石会员
积分 10046
发帖 3039
注册 2002-11-11
状态 离线
|
『第 8 楼』:
使用 LLM 解释/回答一下
卷标是文件，在根目录区，除据有系统，隐藏属性外，还据有卷标属性。
Volume label is a file, located in the root directory area. In addition to having system and hidden attributes, it also has the volume label attribute.
|
简单就是美 |
|
|
2006-11-16 01:53 |
|
|
spoton
初级用户
积分 54
发帖 25
注册 2006-10-31
来自 疯人院
状态 离线
|
|
|
2006-11-16 02:16 |
|
|
19951001
高级用户
流落街头
积分 570
发帖 272
注册 2005-10-17
来自 北京
状态 离线
|
『第 10 楼』:
使用 LLM 解释/回答一下
Originally posted by spoton at 2006-11-16 02:16:
偶又搞错了！ 以为是volume serial number应该是 volume label
http://en.wikipedia.org/wiki/File_Allocation_Table
ntfs 格式可以叁考 ntfs-linux 。
Last edited b ...
按照上面的资料，对于 FAT32 分区的卷标应该在引导区的 0x47 开始的11个字节：
图ddd.gif
我在 FAT32 的 C 盘，将卷标改为 12345678910， 显示后 0x47 位置为 NO NAME 我有点搞不明白,图 dd.gif
Last edited by 19951001 on 2006-11-16 at 05:59 AM ]
Originally posted by spoton at 2006-11-16 02:16:
I made a mistake again! I thought the volume serial number should be the volume label
http://en.wikipedia.org/wiki/File_Allocation_Table
For NTFS format, you can refer to ntfs-linux.
Last edited b ...
According to the above information, for the volume label of a FAT32 partition, it should be in the 11 bytes starting from 0x47 in the boot sector:
Figure ddd.gif
I changed the volume label of the C drive in FAT32 to 12345678910, but after display, the 0x47 position is NO NAME. I'm a bit confused, Figure dd.gif
Last edited by 19951001 on 2006-11-16 at 05:59 AM ]
附件
1:  ddd.GIF (2006-11-16 05:58, 15.49 KiB, 下载附件所需积分 1 点
,下载次数： 1)
附件
2: dd.GIF (2006-11-16 05:59, 32.96 KiB, 下载附件所需积分 1 点
,下载次数： 2)
|
|
|
2006-11-16 05:58 |
|
|
spoton
初级用户
积分 54
发帖 25
注册 2006-10-31
来自 疯人院
状态 离线
|
『第 11 楼』:
使用 LLM 解释/回答一下
不过偶找了一下硬盘，BPB中的Volume ID是空的而不是 NONAME。 也许此 volume id 非volume id 也。
看来还是在dir找
我的硬盘 512 bytes per sectors。 前面的BPB说 reserved 了 32 sectors後有2 个FAT，
每个fat 2662 sectors
Directory 在 (32 reserved sectors + 2662 sectors per fat * 2 ) * 512 bytes 偏移
果然有看到
Last edited by spoton on 2006-11-16 at 08:05 AM ]
But I found the hard disk. The Volume ID in BPB is empty instead of NONAME. Maybe this volume id is not the volume id.
It seems still to find in dir
My hard disk has 512 bytes per sector. The previous BPB said that after 32 reserved sectors there are 2 FATs,
each FAT has 2662 sectors
The Directory is at the offset of (32 reserved sectors + 2662 sectors per FAT * 2 ) * 512 bytes
Sure enough, I saw it
Last edited by spoton on 2006-11-16 at 08:05 AM ]
|
|
|
2006-11-16 07:52 |
|
|
19951001
高级用户
流落街头
积分 570
发帖 272
注册 2005-10-17
来自 北京
状态 离线
|
『第 12 楼』:
使用 LLM 解释/回答一下
Originally posted by spoton at 2006-11-16 07:52:
不过偶找了一下硬盘，BPB中的Volume ID是空的而不是 NONAME。 也许此 volume id 非volume id 也。
看来还是在dir找
我的硬盘 512 bytes per sectors。 前面的BPB ...
谢谢！按照你的方法我找到 Fat32 磁盘中的卷标。
但 NTFS 分区的卷标我还不知道怎么找？能否告知。
Originally posted by spoton at 2006-11-16 07:52:
But I found that the Volume ID in the BPB of the hard disk is empty instead of NONAME. Maybe this volume id is not the volume id.
It seems that I still need to look in the dir
My hard disk has 512 bytes per sectors. The previous BPB...
Thank you! According to your method, I found the volume label in the Fat32 disk.
But I still don't know how to find the volume label of the NTFS partition? Can you tell me.
|
|
|
2006-11-18 06:00 |
|
|
19951001
高级用户
流落街头
积分 570
发帖 272
注册 2005-10-17
来自 北京
状态 离线
|
『第 13 楼』:
使用 LLM 解释/回答一下
有没有高手回答一下 NTFS 的卷标在磁盘的什么位置？
Is there any expert to answer where the volume label of NTFS is located on the disk?
|
|
|
2006-11-23 23:26 |
|
|
chenall
银牌会员
积分 1276
发帖 469
注册 2002-12-23
来自 福建泉州
状态 离线
|
『第 14 楼』:
使用 LLM 解释/回答一下
使用WINHEX,或许可以帮助你.
可以试试,将某个NTFS分区的卷标改为比如ABCDEFGH.
然后用WINHEX打开这个分区,里面有一个$Volume点击后,在下方就可以看到该分区的卷标了.用英文的可以直接看到,中文的好像会显示乱码.
具体在WINHEX中的位置是
Offset 0C0000D90 (这里有显示attr 0x60(attr hdr))
Last edited by chenall on 2006-11-26 at 03:36 AM ]
Using WINHEX might help you. You can try changing the volume label of a certain NTFS partition to something like ABCDEFGH. Then open this partition with WINHEX, there is a $Volume, and you can see the volume label of this partition below. For English ones, you can see it directly, while for Chinese ones, it seems to display garbled characters. The specific position in WINHEX is Offset 0C0000D90 (here it shows attr 0x60(attr hdr))
Last edited by chenall on 2006-11-26 at 03:36 AM ]
|
QQ:366840202
http://chenall.net |
|
|
2006-11-26 03:34 |
|
|
19951001
高级用户
流落街头
积分 570
发帖 272
注册 2005-10-17
来自 北京
状态 离线
|
『第 15 楼』:
使用 LLM 解释/回答一下
Originally posted by chenall at 2006-11-26 03:34:
使用WINHEX,或许可以帮助你.
可以试试,将某个NTFS分区的卷标改为比如ABCDEFGH.
然后用WINHEX打开这个分区,里面有一个$Volume点击后,在下方就可以看到该分 ...
thanks，我试一下。
Originally posted by chenall at 2006-11-20 03:34:
Using WINHEX, maybe it can help you.
You can try changing the volume label of a certain NTFS partition to something like ABCDEFGH.
Then open this partition with WINHEX, there is a $Volume, click it, and you can see the relevant content below the partition...
thanks, I'll give it a try.
|
|
|
2006-11-27 22:40 |
|
