China DOS Union

Which friend knows where the volume label of the disk is? Which sector? The position within the sector?

Originally posted by 19951001 at 2006-11-15 02:15:
Which friend knows where the volume label of the disk is located? Which sector? The position within the sector?

I remember that at least the disk formatted with DOS is placed in the first directory entry, as stored in a directory entry.
There is also another way that it seems to be stored in 11 bytes starting from 0x47 in the logical disk's boot sector.

You can use a tool to extract the disk's master boot record, logical boot sector, and directory table to take a look.
Download a winimage to have a look

Just at the first sector of each partition, the specific location there, I can't remember clearly.

The volume label is in the root directory area, attribute = 08h

My C drive is an NTFS partition with the volume label 12345678910. The content of the first sector is as follows:


Disk C Absolute Sector 0 [0x0]
00000000000: EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 δRÉNTFS ☻.
00000000010: 00 00 00 00 00 F8 00 00 3F 00 FF 00 3F 00 00 00 ° ? . ?
00000000020: 00 00 00 00 80 00 80 00 FD 25 9C 00 00 00 00 00 Ç Ç ²%£
00000000030: 04 00 00 00 00 00 00 00 5F C2 09 00 00 00 00 00 ♦ _┬.
00000000040: F6 00 00 00 01 00 00 00 8D 0E AF 2C 24 AF 2C C6 ÷ ☺ ì♫»,$»,╞
00000000050: 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB B8 C0 07 ·3└Ä╨╝ |√╕└.
00000000060: 8E D8 E8 16 00 B8 00 0D 8E C0 33 DB C6 06 0E 00 Ä╪Φ▬ ╕ .Ä└3█╞♠♫
00000000070: 10 E8 53 00 68 00 0D 68 6A 02 CB 8A 16 24 00 B4 ►ΦS h .hj☻╦è▬$ ┤
00000000080: 08 CD 13 73 05 B9 FF FF 8A F1 66 0F B6 C6 40 66 .═‼s♣╣..è±f☼╢╞@f
00000000090: 0F B6 D1 80 E2 3F F7 E2 86 CD C0 ED 06 41 66 0F ☼╢╤ÇΓ?≈Γå═└φ♠Af☼
000000000A0: B7 C9 66 F7 E1 66 A3 20 00 C3 B4 41 BB AA 55 8A ╖╔f≈ßfú ├┤A╗¬Uè
000000000B0: 16 24 00 CD 13 72 0F 81 FB 55 AA 75 09 F6 C1 01 ▬$ ═‼r☼ü√U¬u.÷┴☺
000000000C0: 74 04 FE 06 14 00 C3 66 60 1E 06 66 A1 10 00 66 t♦■♠¶ ├f`▲♠fí► f
000000000D0: 03 06 1C 00 66 3B 06 20 00 0F 82 3A 00 1E 66 6A ♥♠∟ f;♠ ☼é: ▲fj
000000000E0: 00 66 50 06 53 66 68 10 00 01 00 80 3E 14 00 00 fP♠Sfh► ☺ Ç>¶
000000000F0: 0F 85 0C 00 E8 B3 FF 80 3E 14 00 00 0F 84 61 00 ☼à♀ Φ│.Ç>¶ ☼äa
00000000100: B4 42 8A 16 24 00 16 1F 8B F4 CD 13 66 58 5B 07 ┤Bè▬$ ▬▼ï⌠═‼fX[.
00000000110: 66 58 66 58 1F EB 2D 66 33 D2 66 0F B7 0E 18 00 fXfX▼δ-f3╥f☼╖♫↑
00000000120: 66 F7 F1 FE C2 8A CA 66 8B D0 66 C1 EA 10 F7 36 f≈±■┬è╩fï╨f┴Ω►≈6
00000000130: 1A 00 86 D6 8A 16 24 00 8A E8 C0 E4 06 0A CC B8 → å╓è▬$ èΦ└Σ♠.╠╕
00000000140: 01 02 CD 13 0F 82 19 00 8C C0 05 20 00 8E C0 66 ☺☻═‼☼é↓ î└♣ Ä└f
00000000150: FF 06 10 00 FF 0E 0E 00 0F 85 6F FF 07 1F 66 61 .♠► .♫♫ ☼ào..▼fa
00000000160: C3 A0 F8 01 E8 09 00 A0 FB 01 E8 03 00 FB EB FE ├á°☺Φ. á√☺Φ♥ √δ■
00000000170: B4 01 8B F0 AC 3C 00 74 09 B4 0E BB 07 00 CD 10 ┤☺ï≡¼< t.┤♫╗. ═►
00000000180: EB F2 C3 0D 0A 41 20 64 69 73 6B 20 72 65 61 64 δ≥├..A disk read
00000000190: 20 65 72 72 6F 72 20 6F 63 63 75 72 72 65 64 00 error occurred
000000001A0: 0D 0A 4E 54 4C 44 52 20 69 73 20 6D 69 73 73 69 ..NTLDR is missi
000000001B0: 6E 67 00 0D 0A 4E 54 4C 44 52 20 69 73 20 63 6F ng ..NTLDR is co
000000001C0: 6D 70 72 65 73 73 65 64 00 0D 0A 50 72 65 73 73 mpressed ..Press
000000001D0: 20 43 74 72 6C 2B 41 6C 74 2B 44 65 6C 20 74 6F Ctrl+Alt+Del to
000000001E0: 20 72 65 73 74 61 72 74 0D 0A 00 00 00 00 00 00 restart..
000000001F0: 00 00 00 00 00 00 00 00 83 A0 B3 C9 00 00 55 AA âá│╔ U¬

Dear expert, where should the volume label be located?

Volume label is a rather odd file, so it is placed in the file directory table, which is FDT. It is not necessarily the first item. As long as the file description says that a certain file is in the volume label. Remember, the file directory table/file allocation table/boot sector are completely different concepts.

Volume label is a file, located in the root directory area. In addition to having system and hidden attributes, it also has the volume label attribute.

I made a mistake again! Thought it was volume serial number, but it should be volume label

http://en.wikipedia.org/wiki/File_Allocation_Table

NTFS format can refer to ntfs-linux.

[ Last edited by spoton on 2006-11-16 at 02:25 AM ]

But I found the hard disk. The Volume ID in BPB is empty instead of NONAME. Maybe this volume id is not the volume id.

It seems still to find in dir
My hard disk has 512 bytes per sector. The previous BPB said that after 32 reserved sectors there are 2 FATs,
each FAT has 2662 sectors

The Directory is at the offset of (32 reserved sectors + 2662 sectors per FAT * 2 ) * 512 bytes
Sure enough, I saw it

[ Last edited by spoton on 2006-11-16 at 08:05 AM ]

Originally posted by spoton at 2006-11-16 07:52:
But I found that the Volume ID in the BPB of the hard disk is empty instead of NONAME. Maybe this volume id is not the volume id.



It seems that I still need to look in the dir
My hard disk has 512 bytes per sectors. The previous BPB...

Thank you! According to your method, I found the volume label in the Fat32 disk.
But I still don't know how to find the volume label of the NTFS partition? Can you tell me.

Is there any expert to answer where the volume label of NTFS is located on the disk?

Using WINHEX might help you. You can try changing the volume label of a certain NTFS partition to something like ABCDEFGH. Then open this partition with WINHEX, there is a $Volume, and you can see the volume label of this partition below. For English ones, you can see it directly, while for Chinese ones, it seems to display garbled characters. The specific position in WINHEX is Offset 0C0000D90 (here it shows attr 0x60(attr hdr))

[ Last edited by chenall on 2006-11-26 at 03:36 AM ]

Originally posted by chenall at 2006-11-20 03:34:
Using WINHEX, maybe it can help you.
You can try changing the volume label of a certain NTFS partition to something like ABCDEFGH.
Then open this partition with WINHEX, there is a $Volume, click it, and you can see the relevant content below the partition...

thanks, I'll give it a try.