中国DOS联盟

This is an embedded text diagram made by myself for everyone's reference. (Because originally I didn't know if your website could upload pictures, so I posted it on Rising)

(The note is not to advocate this recovery method to everyone)
The purpose of this "manual recovery (only relying on debug) is to master the disk data structure through this practice.
If you want to rely on software, there are many! For example, easyrecovery, finaldata and norton utility's unerase (DOS), etc.

But when you accidentally empty files or important data in the recycle bin and there is no special software at hand but you need to recover urgently immediately. In this case of extreme urgency and no help, you can only rely on the familiarity with the internal disk data structure of the computer to directly uncover its mysterious veil and retrieve the treasures that originally belong to you hidden in the primeval forest.

It seems that the original poster has really put in a lot of effort! Worth praising!
But putting such things in the "Teaching Room" is a bit too highbrow. It's better to put them in the Q&A Room.
Seeing that there are tutorials and help all over the Teaching Room, I'm quite helpless...
Is there no one who can come up with a set of authoritative works to save precious time, space and human resources?

qzwqzw is too kind, it's just basic knowledge about disks! I found that many friends don't understand the disk data structure when solving certain problems, so they don't know why some methods of editing disk data work. So I spent three days and three nights (sleep when tired, work when okay!) to make this illustration, hoping it will help everyone.

Strong! Strong!! Strong!!!
Top! Top!! Top!!!

Brother gotomsdos, can you tell us about the basic knowledge of disks, such as the addresses of the master boot sector, operating system boot sector, file allocation table in memory and hard disk, and their meanings, preferably explained with DEBUG commands?

The building owner's writing is really great. But, can the building owner give us a detailed explanation of the specific address?
I have always been very confused about how to find the address.
For example, in the position of 102E:000B in Figure 1, the number of bytes per sector is 0200h,
And in the position of 102E:000B in Figure 2, it is 0022h.
Figure 1 says that 102E:000D indicates that there are 4 sectors per cluster, but why does the value disappear in Figure 2?
Basically, the values in the meaningful positions marked in the figures are different between Figure 1 and Figure 2.
Then how does the building owner find and edit the address??
What are the characteristics of these specific addresses?
Also, can you tell us some default addresses of the memory?
It would be even better if you can also talk about some common port numbers for communicating with hardware.

Except for the building owner, if any expert who sees an injustice is also able to come forward to give some guidance, then I would kneel and thank here.
Thank you deeply again!

Hello everyone! Thanks for your support!
I haven't been here for a long time! I've been busy learning to make FLASH animations, web pages...
Everyone has a spirit of research on disk knowledge! I'm very happy!
However, to comprehensively explain the basic knowledge of the disk, that is, the master boot sector, the operating system boot sector, the file allocation table, etc., and their addresses in memory and the hard disk, etc. It's a pity that I don't have so much time! But if you have any questions, if I have time and ability, I will try my best to answer them.

SagInvoker: You said
"For example, in Figure 1, the value at position 102E:000B is 0200h
And in Figure 2, the value at position 102E:000B is 0022h,
In Figure 1, 102E:000D indicates that each cluster has 4 sectors, but in Figure 2, the value is gone
Basically, the values at the meaningful positions marked in the figures in Figure 1 and Figure 2 are all different"
Answer:
We need to clarify the two concepts of "original data on the hard disk" and "data loaded into memory".
We can't see the data on the hard disk. Only when we load it into memory and display it in memory can we see it. Even if you double-click the file name in WINDOWS, the file on the hard disk is immediately displayed, which is also to first get it into memory and then output it from memory to the screen. But there can be memory without a hard disk, but there can't be a hard disk without memory. Memory is internal memory, and the hard disk, floppy disk and optical drive are external memory (referred to as external storage). The data of external storage must be input to memory first before entering the system.
Well, we need to load the hard disk data (generally files, but there are also data that are not files, such as the boot sector (including the master boot and system boot)) into memory first. (Here, it's loading the system boot sector). 102E:0000 is the memory address. 102E is the default, and this 0000 (random in my post) can be set randomly. You can also input the hard disk data to any four-digit number, such as 1234, 4321... But the default is 0100. If you type d in DEBUG and press Enter, it will display 100 bytes (hexadecimal) from 0100.
So, since 102E:000B is randomly set, the data at position 102E:000B can't be the same. It's just like the story of "carving a mark on the boat to find the sword". The sword falls into the water and doesn't change, but the boat changes. You can't find the sword by carving a mark on the boat.

"Can you tell us some default addresses of memory?"
Answer:
Do you mean memory or CPU registers? Maybe it refers to CPU registers? There are AX, BX, CX, DX, etc....
The above-mentioned 102E seems to be the default address of CS.
The port numbers for hardware communication are not directly related to this question.
It's necessary to understand the basic commands of DEBUG. You can search the forum to find out, and study them carefully. Actually, it's not difficult. Even I, who study liberal arts, can learn a little, which shows that as long as you study carefully, it's actually not difficult!
Hope everyone makes progress!