Which friend knows where the volume label of the disk is located? - China DOS Union Forum

Which friend knows where the volume label of the disk is? Which sector? The position within the sector?

Originally posted by 19951001 at 2006-11-15 02:15:
Which friend knows where the volume label of the disk is located? Which sector? The position within the sector?

I remember that at least the disk formatted with DOS is placed in the first directory entry, as stored in a directory entry.
There is also another way that it seems to be stored in 11 bytes starting from 0x47 in the logical disk's boot sector.

You can use a tool to extract the disk's master boot record, logical boot sector, and directory table to take a look.
Download a winimage to have a look

Just at the first sector of each partition, the specific location there, I can't remember clearly.

keyword: BIOS Parameter Block
http://www.geocities.com/thestarman3/asm/mbr/MSWIN41.htm

Excuse me! Mistook the volume label as the serial number

[ Last edited by spoton on 2006-11-16 at 02:30 AM ]

The volume label is in the root directory area, attribute = 08h

My C drive is an NTFS partition with the volume label 12345678910. The content of the first sector is as follows:

Disk C Absolute Sector 0 [0x0]
00000000000: EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 δRÉNTFS ☻.
00000000010: 00 00 00 00 00 F8 00 00 3F 00 FF 00 3F 00 00 00 ° ? . ?
00000000020: 00 00 00 00 80 00 80 00 FD 25 9C 00 00 00 00 00 Ç Ç ²%£
00000000030: 04 00 00 00 00 00 00 00 5F C2 09 00 00 00 00 00 ♦ _┬.
00000000040: F6 00 00 00 01 00 00 00 8D 0E AF 2C 24 AF 2C C6 ÷ ☺ ì♫»,$»,╞
00000000050: 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB B8 C0 07 ·3└Ä╨╝ |√╕└.
00000000060: 8E D8 E8 16 00 B8 00 0D 8E C0 33 DB C6 06 0E 00 Ä╪Φ▬ ╕ .Ä└3█╞♠♫
00000000070: 10 E8 53 00 68 00 0D 68 6A 02 CB 8A 16 24 00 B4 ►ΦS h .hj☻╦è▬$ ┤
00000000080: 08 CD 13 73 05 B9 FF FF 8A F1 66 0F B6 C6 40 66 .═‼s♣╣..è±f☼╢╞@f
00000000090: 0F B6 D1 80 E2 3F F7 E2 86 CD C0 ED 06 41 66 0F ☼╢╤ÇΓ?≈Γå═└φ♠Af☼
000000000A0: B7 C9 66 F7 E1 66 A3 20 00 C3 B4 41 BB AA 55 8A ╖╔f≈ßfú ├┤A╗¬Uè
000000000B0: 16 24 00 CD 13 72 0F 81 FB 55 AA 75 09 F6 C1 01 ▬$ ═‼r☼ü√U¬u.÷┴☺
000000000C0: 74 04 FE 06 14 00 C3 66 60 1E 06 66 A1 10 00 66 t♦■♠¶ ├f`▲♠fí► f
000000000D0: 03 06 1C 00 66 3B 06 20 00 0F 82 3A 00 1E 66 6A ♥♠∟ f;♠ ☼é: ▲fj
000000000E0: 00 66 50 06 53 66 68 10 00 01 00 80 3E 14 00 00 fP♠Sfh► ☺ Ç>¶
000000000F0: 0F 85 0C 00 E8 B3 FF 80 3E 14 00 00 0F 84 61 00 ☼à♀ Φ│.Ç>¶ ☼äa
00000000100: B4 42 8A 16 24 00 16 1F 8B F4 CD 13 66 58 5B 07 ┤Bè▬$ ▬▼ï⌠═‼fX[.
00000000110: 66 58 66 58 1F EB 2D 66 33 D2 66 0F B7 0E 18 00 fXfX▼δ-f3╥f☼╖♫↑
00000000120: 66 F7 F1 FE C2 8A CA 66 8B D0 66 C1 EA 10 F7 36 f≈±■┬è╩fï╨f┴Ω►≈6
00000000130: 1A 00 86 D6 8A 16 24 00 8A E8 C0 E4 06 0A CC B8 → å╓è▬$ èΦ└Σ♠.╠╕
00000000140: 01 02 CD 13 0F 82 19 00 8C C0 05 20 00 8E C0 66 ☺☻═‼☼é↓ î└♣ Ä└f
00000000150: FF 06 10 00 FF 0E 0E 00 0F 85 6F FF 07 1F 66 61 .♠► .♫♫ ☼ào..▼fa
00000000160: C3 A0 F8 01 E8 09 00 A0 FB 01 E8 03 00 FB EB FE ├á°☺Φ. á√☺Φ♥ √δ■
00000000170: B4 01 8B F0 AC 3C 00 74 09 B4 0E BB 07 00 CD 10 ┤☺ï≡¼< t.┤♫╗. ═►
00000000180: EB F2 C3 0D 0A 41 20 64 69 73 6B 20 72 65 61 64 δ≥├..A disk read
00000000190: 20 65 72 72 6F 72 20 6F 63 63 75 72 72 65 64 00 error occurred
000000001A0: 0D 0A 4E 54 4C 44 52 20 69 73 20 6D 69 73 73 69 ..NTLDR is missi
000000001B0: 6E 67 00 0D 0A 4E 54 4C 44 52 20 69 73 20 63 6F ng ..NTLDR is co
000000001C0: 6D 70 72 65 73 73 65 64 00 0D 0A 50 72 65 73 73 mpressed ..Press
000000001D0: 20 43 74 72 6C 2B 41 6C 74 2B 44 65 6C 20 74 6F Ctrl+Alt+Del to
000000001E0: 20 72 65 73 74 61 72 74 0D 0A 00 00 00 00 00 00 restart..
000000001F0: 00 00 00 00 00 00 00 00 83 A0 B3 C9 00 00 55 AA âá│╔ U¬

Dear expert, where should the volume label be located?

Volume label is a rather odd file, so it is placed in the file directory table, which is FDT. It is not necessarily the first item. As long as the file description says that a certain file is in the volume label. Remember, the file directory table/file allocation table/boot sector are completely different concepts.

Volume label is a file, located in the root directory area. In addition to having system and hidden attributes, it also has the volume label attribute.

I made a mistake again! Thought it was volume serial number, but it should be volume label

http://en.wikipedia.org/wiki/File_Allocation_Table

NTFS format can refer to ntfs-linux.

[ Last edited by spoton on 2006-11-16 at 02:25 AM ]

Originally posted by spoton at 2006-11-16 02:16:
I made a mistake again! I thought the volume serial number should be the volume label

http://en.wikipedia.org/wiki/File_Allocation_Table

For NTFS format, you can refer to ntfs-linux.

[ Last edited b ...

According to the above information, for the volume label of a FAT32 partition, it should be in the 11 bytes starting from 0x47 in the boot sector:
Figure ddd.gif

I changed the volume label of the C drive in FAT32 to 12345678910, but after display, the 0x47 position is NO NAME. I'm a bit confused, Figure dd.gif

[ Last edited by 19951001 on 2006-11-16 at 05:59 AM ]

But I found the hard disk. The Volume ID in BPB is empty instead of NONAME. Maybe this volume id is not the volume id.

It seems still to find in dir
My hard disk has 512 bytes per sector. The previous BPB said that after 32 reserved sectors there are 2 FATs,
each FAT has 2662 sectors

The Directory is at the offset of (32 reserved sectors + 2662 sectors per FAT * 2 ) * 512 bytes
Sure enough, I saw it

[ Last edited by spoton on 2006-11-16 at 08:05 AM ]

Originally posted by spoton at 2006-11-16 07:52:
But I found that the Volume ID in the BPB of the hard disk is empty instead of NONAME. Maybe this volume id is not the volume id.

It seems that I still need to look in the dir
My hard disk has 512 bytes per sectors. The previous BPB...

Thank you! According to your method, I found the volume label in the Fat32 disk.
But I still don't know how to find the volume label of the NTFS partition? Can you tell me.

Is there any expert to answer where the volume label of NTFS is located on the disk?

Using WINHEX might help you. You can try changing the volume label of a certain NTFS partition to something like ABCDEFGH. Then open this partition with WINHEX, there is a $Volume, and you can see the volume label of this partition below. For English ones, you can see it directly, while for Chinese ones, it seems to display garbled characters. The specific position in WINHEX is Offset 0C0000D90 (here it shows attr 0x60(attr hdr))

[ Last edited by chenall on 2006-11-26 at 03:36 AM ]

Originally posted by chenall at 2006-11-20 03:34:
Using WINHEX, maybe it can help you.
You can try changing the volume label of a certain NTFS partition to something like ABCDEFGH.
Then open this partition with WINHEX, there is a $Volume, click it, and you can see the relevant content below the partition...

thanks, I'll give it a try.

Floor1　19951001	Posted 2006-11-15 02:15
高级用户　Posts 272　Credits 570　From 北京
Which friend knows where the volume label of the disk is? Which sector? The position within the sector?

Floor2　x2wei	Posted 2006-11-15 04:34
初级用户　Posts 17　Credits 44
Originally posted by 19951001 at 2006-11-15 02:15: Which friend knows where the volume label of the disk is located? Which sector? The position within the sector? I remember that at least the disk formatted with DOS is placed in the first directory entry, as stored in a directory entry. There is also another way that it seems to be stored in 11 bytes starting from 0x47 in the logical disk's boot sector. You can use a tool to extract the disk's master boot record, logical boot sector, and directory table to take a look. Download a winimage to have a look

Floor3　zhgwbzhd	Posted 2006-11-15 05:35
高级用户　Posts 187　Credits 506
Just at the first sector of each partition, the specific location there, I can't remember clearly.

Floor4　spoton	Posted 2006-11-15 06:26
初级用户　Posts 25　Credits 54　From 疯人院
keyword: BIOS Parameter Block http://www.geocities.com/thestarman3/asm/mbr/MSWIN41.htm Excuse me! Mistook the volume label as the serial number [ Last edited by spoton on 2006-11-16 at 02:30 AM ]

Floor5　darkradx	Posted 2006-11-15 11:30
高级用户　Posts 420　Credits 972
The volume label is in the root directory area, attribute = 08h

Floor6　19951001	Posted 2006-11-15 23:58
高级用户　Posts 272　Credits 570　From 北京
My C drive is an NTFS partition with the volume label 12345678910. The content of the first sector is as follows: Disk C Absolute Sector 0 [0x0] 00000000000: EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00 δRÉNTFS ☻. 00000000010: 00 00 00 00 00 F8 00 00 3F 00 FF 00 3F 00 00 00 ° ? . ? 00000000020: 00 00 00 00 80 00 80 00 FD 25 9C 00 00 00 00 00 Ç Ç ²%£ 00000000030: 04 00 00 00 00 00 00 00 5F C2 09 00 00 00 00 00 ♦ _┬. 00000000040: F6 00 00 00 01 00 00 00 8D 0E AF 2C 24 AF 2C C6 ÷ ☺ ì♫»,$»,╞ 00000000050: 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB B8 C0 07 ·3└Ä╨╝ \|√╕└. 00000000060: 8E D8 E8 16 00 B8 00 0D 8E C0 33 DB C6 06 0E 00 Ä╪Φ▬ ╕ .Ä└3█╞♠♫ 00000000070: 10 E8 53 00 68 00 0D 68 6A 02 CB 8A 16 24 00 B4 ►ΦS h .hj☻╦è▬$ ┤ 00000000080: 08 CD 13 73 05 B9 FF FF 8A F1 66 0F B6 C6 40 66 .═‼s♣╣..è±f☼╢╞@f 00000000090: 0F B6 D1 80 E2 3F F7 E2 86 CD C0 ED 06 41 66 0F ☼╢╤ÇΓ?≈Γå═└φ♠Af☼ 000000000A0: B7 C9 66 F7 E1 66 A3 20 00 C3 B4 41 BB AA 55 8A ╖╔f≈ßfú ├┤A╗¬Uè 000000000B0: 16 24 00 CD 13 72 0F 81 FB 55 AA 75 09 F6 C1 01 ▬$ ═‼r☼ü√U¬u.÷┴☺ 000000000C0: 74 04 FE 06 14 00 C3 66 60 1E 06 66 A1 10 00 66 t♦■♠¶ ├f`▲♠fí► f 000000000D0: 03 06 1C 00 66 3B 06 20 00 0F 82 3A 00 1E 66 6A ♥♠∟ f;♠ ☼é: ▲fj 000000000E0: 00 66 50 06 53 66 68 10 00 01 00 80 3E 14 00 00 fP♠Sfh► ☺ Ç>¶ 000000000F0: 0F 85 0C 00 E8 B3 FF 80 3E 14 00 00 0F 84 61 00 ☼à♀ Φ│.Ç>¶ ☼äa 00000000100: B4 42 8A 16 24 00 16 1F 8B F4 CD 13 66 58 5B 07 ┤Bè▬$ ▬▼ï⌠═‼fX[. 00000000110: 66 58 66 58 1F EB 2D 66 33 D2 66 0F B7 0E 18 00 fXfX▼δ-f3╥f☼╖♫↑ 00000000120: 66 F7 F1 FE C2 8A CA 66 8B D0 66 C1 EA 10 F7 36 f≈±■┬è╩fï╨f┴Ω►≈6 00000000130: 1A 00 86 D6 8A 16 24 00 8A E8 C0 E4 06 0A CC B8 → å╓è▬$ èΦ└Σ♠.╠╕ 00000000140: 01 02 CD 13 0F 82 19 00 8C C0 05 20 00 8E C0 66 ☺☻═‼☼é↓ î└♣ Ä└f 00000000150: FF 06 10 00 FF 0E 0E 00 0F 85 6F FF 07 1F 66 61 .♠► .♫♫ ☼ào..▼fa 00000000160: C3 A0 F8 01 E8 09 00 A0 FB 01 E8 03 00 FB EB FE ├á°☺Φ. á√☺Φ♥ √δ■ 00000000170: B4 01 8B F0 AC 3C 00 74 09 B4 0E BB 07 00 CD 10 ┤☺ï≡¼< t.┤♫╗. ═► 00000000180: EB F2 C3 0D 0A 41 20 64 69 73 6B 20 72 65 61 64 δ≥├..A disk read 00000000190: 20 65 72 72 6F 72 20 6F 63 63 75 72 72 65 64 00 error occurred 000000001A0: 0D 0A 4E 54 4C 44 52 20 69 73 20 6D 69 73 73 69 ..NTLDR is missi 000000001B0: 6E 67 00 0D 0A 4E 54 4C 44 52 20 69 73 20 63 6F ng ..NTLDR is co 000000001C0: 6D 70 72 65 73 73 65 64 00 0D 0A 50 72 65 73 73 mpressed ..Press 000000001D0: 20 43 74 72 6C 2B 41 6C 74 2B 44 65 6C 20 74 6F Ctrl+Alt+Del to 000000001E0: 20 72 65 73 74 61 72 74 0D 0A 00 00 00 00 00 00 restart.. 000000001F0: 00 00 00 00 00 00 00 00 83 A0 B3 C9 00 00 55 AA âá│╔ U¬ Dear expert, where should the volume label be located?

Floor7　DOS95	Posted 2006-11-16 00:14
初级用户　Posts 49　Credits 112
Volume label is a rather odd file, so it is placed in the file directory table, which is FDT. It is not necessarily the first item. As long as the file description says that a certain file is in the volume label. Remember, the file directory table/file allocation table/boot sector are completely different concepts.

Floor8　Michael	Posted 2006-11-16 01:53
钻石会员　Posts 3,040　Credits 10,051
Volume label is a file, located in the root directory area. In addition to having system and hidden attributes, it also has the volume label attribute.

Floor9　spoton	Posted 2006-11-16 02:16
初级用户　Posts 25　Credits 54　From 疯人院
I made a mistake again! Thought it was volume serial number, but it should be volume label http://en.wikipedia.org/wiki/File_Allocation_Table NTFS format can refer to ntfs-linux. [ Last edited by spoton on 2006-11-16 at 02:25 AM ]

Floor10　19951001	Posted 2006-11-16 05:58
高级用户　Posts 272　Credits 570　From 北京
Originally posted by spoton at 2006-11-16 02:16: I made a mistake again! I thought the volume serial number should be the volume label http://en.wikipedia.org/wiki/File_Allocation_Table For NTFS format, you can refer to ntfs-linux. [ Last edited b ... According to the above information, for the volume label of a FAT32 partition, it should be in the 11 bytes starting from 0x47 in the boot sector: Figure ddd.gif I changed the volume label of the C drive in FAT32 to 12345678910, but after display, the 0x47 position is NO NAME. I'm a bit confused, Figure dd.gif [ Last edited by 19951001 on 2006-11-16 at 05:59 AM ] Attachments ddd.GIF (15.49 KiB) dd.GIF (32.96 KiB)

Floor11　spoton	Posted 2006-11-16 07:52
初级用户　Posts 25　Credits 54　From 疯人院
But I found the hard disk. The Volume ID in BPB is empty instead of NONAME. Maybe this volume id is not the volume id. It seems still to find in dir My hard disk has 512 bytes per sector. The previous BPB said that after 32 reserved sectors there are 2 FATs, each FAT has 2662 sectors The Directory is at the offset of (32 reserved sectors + 2662 sectors per FAT * 2 ) * 512 bytes Sure enough, I saw it [ Last edited by spoton on 2006-11-16 at 08:05 AM ]

Floor12　19951001	Posted 2006-11-18 06:00
高级用户　Posts 272　Credits 570　From 北京
Originally posted by spoton at 2006-11-16 07:52: But I found that the Volume ID in the BPB of the hard disk is empty instead of NONAME. Maybe this volume id is not the volume id. It seems that I still need to look in the dir My hard disk has 512 bytes per sectors. The previous BPB... Thank you! According to your method, I found the volume label in the Fat32 disk. But I still don't know how to find the volume label of the NTFS partition? Can you tell me.

Floor13　19951001	Posted 2006-11-23 23:26
高级用户　Posts 272　Credits 570　From 北京
Is there any expert to answer where the volume label of NTFS is located on the disk?

Floor14　chenall	Posted 2006-11-26 03:34
银牌会员　Posts 469　Credits 1,276　From 福建泉州
Using WINHEX might help you. You can try changing the volume label of a certain NTFS partition to something like ABCDEFGH. Then open this partition with WINHEX, there is a $Volume, and you can see the volume label of this partition below. For English ones, you can see it directly, while for Chinese ones, it seems to display garbled characters. The specific position in WINHEX is Offset 0C0000D90 (here it shows attr 0x60(attr hdr)) [ Last edited by chenall on 2006-11-26 at 03:36 AM ]

Floor15　19951001	Posted 2006-11-27 22:40
高级用户　Posts 272　Credits 570　From 北京
Originally posted by chenall at 2006-11-20 03:34: Using WINHEX, maybe it can help you. You can try changing the volume label of a certain NTFS partition to something like ABCDEFGH. Then open this partition with WINHEX, there is a $Volume, click it, and you can see the relevant content below the partition... thanks, I'll give it a try.