Disk Structure Analysis DAT2343 Disk Structure Analysis Project 3 © Alan T. Pinck / Algonquin College; 2003

Project 3 Requirements See the complete requirements for this project under the Projects area for this course in Blackboard Determine specific structure information from an non-standard formatted diskette using DEBUG to analyze the boot sector. Locate a deleted file in a deleted directory by tracing through directory entries.

DEBUG Sector Level Read DEBUG Command: Lmmmm d s n where mmmm is the (offset) memory address to where the sector(s) are to be copied d is the disk drive number (0=A: 1=B: …) s is the disk sector number (0 is the boot sector n is the number of sectors to read

Critical Boot Sector Entries 000B-C : bytes per sector 000D : sectors per allocation unit (file cluster) 0010h : number of copies of the FAT 0011-12h : number of root directory entries (20h bytes per entry) 0016-17h : number of sectors per copy of FAT 0018-19h : number of sectors per track 001A-1Bh : number of tracks per cylinder (number of read/write heads)

Directory Entry Components For “normal” 8.3 named files: bytes 0-7 : primary file name bytes 8-0A : extension byte 0B : attribute (see next slide) bytes 1A-1B : starting cluster bytes 1C-1F : file size (in bytes)

Directory Entries: Attributes The attribute byte, within a file’s directory entry provides the following information (reading the bits from right to left): bit 0 : Read Only (if on) bit 1 : Hidden (if on) bit 2 : System (if on) bit 3 : Volume Label, not a real file (if on) bit 4 : Subdirectory (if on) bit 5 : Archive needed (if on) Note the special value of the attribute byte for long/extended file names (next slide)

Directory Entries: Long File Names Long/Extended file names are stored in directory entries, but with a quite different format than “normal” file entries; the Attribute field for these extended file name entries is always 0F(hex) a value which would not make sense if interpreted normally. Extended file names are always followed by a “normal” (8.3) form for the same file and it is this 8.3 form which should be used for file analysis.

Directory Entries: Deleted Files When a file is deleted, the first byte of the file name in the directory entry(ies) for this file is changed to a special code: E5(hex) and its FAT table entries are zeroed (indicating that the space is “free”). No other changes are made and, provided nothing else is changed on the disk, the file can be recovered (except for the first character of its name), since its first cluster number still points to a sector of the disk which contains the contents of the (deleted) file.

End of Lecture