China DOS Union

Sender: ohg2001 (戒指～～铁杆～～DDK), Board: WinDDK
Title: Hard disk partition table and file allocation table formats (reposted from Baiyun Huanghe)
Posting site: BBS Shuimu Tsinghua Station (Thu Mar 29 05:51:56 2001)

Sender: aol (色拉油), Board: WinDrvProgram
Title: Hard disk partition table and file allocation table formats
Posting site: Wuhan Baiyun Huanghe Station (Wednesday, March 28, 2001 21:36:15), forwarded

Hard disk partition table and file allocation table formats
Hard disk partition table and file allocation table
A hard disk can only be used after physical formatting, partitioning, and logical formatting. When partitioning,
FDISK will
create a 64-byte partition table at cylinder 0, head 0, sector 1 of the hard disk. In front of the partition table is the master boot record (
MRB)
, and behind it is the two-byte valid signature 55H, AAH, (H means hexadecimal). This sector is called the master boot
sector
, and is also the place viruses most like to attack. It consists of the master boot record + partition table + valid signature.
The partition table is very important for system bootstrapping. It specifies important information such as how many partitions the system has; each partition's starting and ending
sectors,
size, and whether it is an active partition. The partition table consists of 4 entries, each entry being 16
bytes.
The meaning of each byte is as shown in Table 1 below:
Table 1
——————————————————————————————
——————————————————————————————
Byte 0 Whether it is an active partition; if yes, 80H, otherwise 00H
Byte 1 Starting head number of this partition
Byte 2 Starting sector number of this partition (low 6 bits) and starting cylinder number
(high 2 bits)
Byte 3 Low 8 bits of the starting cylinder number of this partition
Byte 4 System flag. 00H means this partition is unused; 06H means higher-version
DOS system; 05H extended DOS partition; 65H means Netwear
partition
Byte 5 Ending head number of this partition
Byte 6 Ending sector number of this partition (low 6 bits) and ending cylinder number
(high 2 bits)
Byte 7 Low 8 bits of the ending cylinder number of this partition
Bytes 8~11 Relative sector number, the starting relative logical sector number of this partition,
high byte later, low byte first
Bytes 12~15 Number of sectors used by this partition, high byte later, low byte first
——————————————————————————————
Note:
1. The partition table has four entries, meaning a hard disk can contain at most four partitions.
2. Each surface of a disk head is called a head. A floppy disk has only two heads, while hard disks often have many.
Tracks of the same radius on each head are collectively called a cylinder.
3. High byte later, low byte first is a way of storing numbers; it should be adjusted when read out.
For example, the two bytes 12H, 34H should be adjusted to 3412H.
File allocation table
After a disk is Format'ed, in the several sectors after its logical sector 0 (that is, the BOOT sector), there exists
an
important data table—the file allocation table (FAT). There are two copies of the file allocation table; how many sectors it occupies depends on the disk
type
and size. As the name implies, the file allocation table is used to indicate the allocation information of disk files. It does not represent information for the
boot sector
or file directory, nor does it actually store file contents.
We know that a disk is made up of sectors one by one, and several sectors make up a cluster. File access is
by cluster,
even if the file has only 1 byte. Each cluster has a corresponding entry in the file allocation table; the cluster number
is the entry number. Each entry occupies 1.5 bytes (when disk space is below 10MB) or 2 bytes (when disk
space is above 1
0MB). For convenience, the entries mentioned below all refer to 2-byte ones.
The file allocation table structure is as in 2 (H means hexadecimal)
Note:
Do not mistakenly think that the number in an entry represents the current cluster number; it should be the cluster number of the file's next cluster.
. High byte later, low byte first is a way of storing numbers; it should be adjusted when read out. For example,
the two bytes
12H, 34H should be adjusted to 3412H.
The file allocation table, working together with the file directory (FDT), can uniformly manage the files on the entire disk. It tells
the system
which clusters on the disk are bad or already in use, which clusters can be used, and stores the cluster numbers used by each file
. It is the
file's “chief dispatcher.”
When DOS writes a file, it first checks in the file directory whether there is an identical filename. If not, it uses one
file directory
entry, then sequentially checks the clusters corresponding to each entry in the FAT, while also writing that cluster number into bytes 26-27 of the file directory
entry.
If the file length is more than one cluster, it continues looking backward for usable clusters. After finding one, it writes its
cluster number into
the previously found entry, continuing like this until the file ends. In the entry for the last cluster it fills in FFF8H, forming
a one-way
linked list.
When DOS deletes a file, it only changes byte 0 of that file's entry in the file directory table to E5H, indicating this entry has been
deleted,
and clears to 0 the entries for the clusters occupied by that file in the file allocation table, releasing the space. The file's
contents
are still on the disk and have not truly been deleted. This is why recovery-deletion tools such as undelete.exe, unerase.exe can work.
The file allocation table has a very important position in the system. Users had best not modify it, to avoid serious
consequences
from mistaken operations.
Table 2
——————————————————————————————————
——————————————————————————————————
Byte 0 Table header, indicates disk type.
FFH double-sided floppy disk, 8 sectors per track
FEH single-sided floppy disk, 8 sectors per track
FDH double-sided floppy disk, 9 sectors per track
FCCH single-sided floppy disk, 9 sectors per track
FC8H hard disk
Bytes 1~2 (entry no. 1) Indicates the status of the first cluster. Since the first cluster is occupied by the system, these two bytes
are FFFFH
Bytes 3~4 (entry no. 2) Indicates the status of the second cluster. If it is FFFH, it means this cluster is bad and DOS has marked
it unusable; 0000H means this cluster is empty and can be used; FFF8H indicates
that this cluster is the last cluster of a file; other numbers indicate the file's
next cluster number. Note high byte later, low byte first.
Bytes 5~6 (entry no. 3) Indicates the status of the third cluster, same as above.
Appendix table:
Partition table parameter Offset Meaning
1BEH Whether bootable (80: bootable)
1BFH--1C1H Starting address of the partition (side, sector, head)
1C2H DOS partition flag (01 is a DOS partition)
1C3H--1C5H Ending address of the partition

1C6H--1c9H Partition relative sector count
1CAH--1CDH Practical sector count of the partition
--

--
-Goodbye
-the person I loved
-From now on, I will walk alone with DDK


※ Source: ·BBS Shuimu Tsinghua Station smth.org·

(This article was copied using the S-Term article copy script)
==================================================

Fantastic!

Good article, many thanks!

Good article, many thanks!

Thanks, copied and received.

First of all, thank you very much here to the OP for giving us a good article, but I do have a bit of an issue with how seriously the OP handled it. I don't even know whether the OP has already read this article, or only skimmed it roughly. What was posted over was not edited much at all, and the formatting is quite messy. Also, if the OP is fairly familiar with this too, I hope you can also add some of your own views on top of this article, as well as supplement it with some things~~~