Disk Storage Structure and file recovery experiment (FAT file system)

Disk Storage Structure and file recovery experiment (FAT file system)

Lab location: A2-412, Main Building

1. Laboratory name: Main Building laboratory A2-412

Ii. Experiment Project name: disk storage structure and file recovery experiment

Iii. lab hours: 6 hours

Iv. Experiment Principles:

Display and analyze the structure of the boot sector, file allocation table, and directory table using the basic assembler in the Debug environment;

Use WINHEX to restore the specified file (deleted file.

V. Purpose:

1) understand the storage image of the file system on the disk and its position and role in system security;

2) understand the file directory structure and access methods;

3) master the techniques and programming methods for accessing the disk and file structure using the basic assembler of the system, and lay the foundation for data recovery.

Vi. experiment content:

1) In DEGUB, use the Assembly command to read the MBS Boot Sector, record and analyze the description structure.

2) In DEGUB, use the Assembly command to read the DBS Boot Sector, record and analyze the description structure.

3) In DEGUB, use the Assembly command to read FAT and FDT, record and analyze the description structure.

4) generate a simple text file (*. txt file), combine the FAT and FDT information, and use assembly commands to find and read the file on the hard disk, record and describe the search process.

5) Delete the generated text file, view the file storage status of the file in FAT and FDT, and the content of the file in the corresponding sector in the Data zone, and describe the principle of file deletion.

6) Use WINHEX to perform file restoration exercises.

 

VII. Experimental Equipment (devices and components ):

One PC microcomputer (with at least one FAT format disk partition), VMware Workstation6.0 Virtual Machine Software, DOS7.0, WINHEX software.

8. Experiment steps:

Task 1. Read the MBS Boot Sector

1. In DEGUB, use the Assembly command to read the MBS Boot Sector.

2. analyze and describe the MBS structure, byte meaning, and specific values based on the displayed information.

 

Task 2. Read DBS Boot Sector and disk parameter block BPB

1. In DEGUB, use the Assembly command to read the DBS Boot Sector.

2. analyze and describe the structure of the boot sector based on the display information.

3. Describe the BPB structure of the disk parameter blocks and their meanings and specific values based on the displayed information.

 

Task 3. Read the FAT table

1. Generate a simple text file (*. txt file) and take "long file name ".

2. In DEGUB, use the Assembly command to read the FAT table.

3. Describe the function and format of FAT based on the display information.

 

Task 4. Search for files

1. Search for the text file (*. txt file) generated by Task 3 based on FDT.

2. Calculate the FDT position based on the information in BPB.

3. Compile the code to display the FDT.

4. Determine the first cluster number of the file based on the FDT information, and calculate the start sector position of the target file based on the formula.

5. write code to read the corresponding slice of the file and view the file content stored by the slice.

 

Task 5. Principle of File Deletion

1. Delete the generated text file

2. view the FDT file and check the changes in the status of the deleted file in the FDT file.

3. view the FAT and check the changes in the deleted file's status information in the FAT.

4. view the content of the deleted file in the Data Partition and understand the principle of file deletion.

Task 6. File recovery

1. Use WINHEX to perform file restoration exercises on a FAT16 (32) disk.

 

IX. experiment data and result analysis:

Task 1: Read the MBS Boot Sector

1. Provide the complete DEBUG command, record the content of the MBS Boot Sector read (copy screen output), and analyze and describe the structure.

The above is all the code and mbs content, 1000-11b7 is the boot program, 11b8-11bb is the disk signature, 11bc-11bd is 0 by default, 11be-11fd is the partition table, four table items, each 16 bytes. In this example, there is only one partition, and the first word is 80, which indicates the primary active partition. The last two bytes are the ending mark.

2. Calculate the current disk space.

The current disk space is the reserved sector (including MBR) plus the size of all partitions. Here, the reserved sector is 3f. The partition size is measured in the last 4 bytes (11ca-11cd), that is, 03bf85, A total of 0200 bfc4 * bytes.

Task 2: Read the DBS Boot Sector

1. Write the complete DEBUG command, record the DBS Boot Sector content read (copy screen output), and analyze and describe its structure.

The above Code and all dbr content, 1000-1001 is the jump command, 1002 is nop, 1003-100a is the OEM code, 100b-103d is bpb, 103e-11fd is the boot program, and the last two bytes are the end mark.

2. Describe and calculate the structure of the disk parameter block BPB and Its Meanings and specific values.

0200 bytes per sector (100b-100c), 4 sectors per cluster (100d), 1 (100e-100f), 2 (1010 FAT ), the maximum number of directory items in the root directory is 0200 (1011-1012), the total number of sectors is 0 (1013-1014), the media descriptor f8 (1015), and the number of sectors per FAT is 0f0 (1016-1018 ), 3f (1018-1019), 4 (101a-101b), 3f (101c-101f), and 3bf85 (1020-1023 ), BIOS drive number 80 (1024), 1025 unused, extended boot flag 29 (1026), volume serial number 2f2f1ceb (1027-102a), volume label serial (102b-1035), file system type fat16 (1036-103d ).

Task 3: Read the FAT table

Compile the complete DEBUG command, record the FAT table content read (copy screen output), and describe the function and format of FAT.

The code and fat1. Each fat item occupies 2 bytes: 0 indicates the media type, f8 indicates the hard disk, 1 indicates the dirty mark, and 2 does not have 2 bytes as 1fat item: fff7 indicates the bad cluster, ffff indicates the last cluster of a file, 00 indicates the available cluster, and others indicate the cluster number of the next cluster of a file.

For more details, please continue to read the highlights on the next page:

1 2 3 Next Page