Parse the DBR operating system boot Record data

To understand the file system, you have to be familiar with DBR, let's parse the data in the DBR.

Dos Boot Record (DBR) operating system boot records are established by the operating system's formatter, and when a file system driver operates on any disk volume, this part of the information is read and used as a file system parameter on this disk volume. It contains effective bootloader, manufacturer logo, BPB data block and so on.

1. So how do you get DBR? It is located in the first sector of a partition. The address of a partition can be obtained from the partition table entry for the first partition of the disk.

Specifically, refer to http://blog.csdn.net/liyun123gx/article/details/38420665

2. Analyze This sector data

Here's a DBR message.

(Note that the data is stored in a small-ended format)

0x11~0x02:3 bytes, jump instruction. Jump to the boot program at the back of the DBR. A bootstrapper is a program used to load a real operating system.

0x03~0xa:8 bytes, OEM string. In this case, the MSDOC5.0

0x0b~0x0c:2 bytes, the number of bytes per sector. This example is 0x0200,512

0X0D 1 bytes, number of sectors per cluster. This example is 0x8

0x0e~0x0f:2 bytes, preserving the number of sectors. This example is 0x0026

0x10:1 bytes, the number of fat tables. This example is 0x02

0x11~0x12:2 bytes, the maximum number of directory entries that the root directory can hold. FAT12 and FAT16 typically do not use this value for 512,fat32, which is 0. In this case, it is FAT32, so it is 0.

0x13~0x14:2 bytes, the total number of sectors. It is stored at less than 32MB, and is stored at more than 32MB using an offset of 4 bytes at the 0x20~-x23 byte. In this case, the disk is more than 7G, so it is 0.

0x15:1 bytes, description of the media. In this example, 0xf8 represents the local hard disk.

0x16~0x17:2 bytes, the number of sectors per fat table. Similarly, FAT32 is not used, for 0.

0x18~0x19:2 bytes, the number of sectors per track. This example is 0x3f,63

0x1a~0x1b:2 bytes, number of heads. This example is 0xff,255

0x1c~0x1f:4 bytes, the number of sectors that have been used before partitioning. This example is 0X xx 3f,63

0x20~0x23:4 bytes, number of file system sectors. This example is 0x00 EA 58 78,15358072

0x24~0x27:4 bytes, the number of sectors per fat table. This example is 0x00 3 a 79,14969

0x28~0x29:2 a byte, a token.

0x2a~0x2b:2 bytes, version number.

0x2c~0x2f:4 bytes, root cluster number, 2. (Although the root directory can be stored anywhere in the data area under the FAT32 file system, it usually starts with cluster 2nd)

0x30~0x31:2 bytes, fsinfo (file System Information Sector) sector code, 1. This sector provides information about the total number of empty clusters and the next available cluster for the operating system.

0x32~0x33:2 bytes, the location of the backup boot sector, 6. The backup boot sector is always located in the 6th sector of the file system.

0x34~0x3f:12 bytes, not used.

0x40~0x40:1 bytes, BIOS INT 13H device number, 0x80.

0x41~0x41:1 bytes, not used.

0x42~0x42:1 bytes, extending the boot flag. 0x29

0x43~0x46:1 bytes, volume serial number. is usually a random value.

0x47~0x51:11 Bytes, volume label (ASCII code), if you set up a file system when the label is specified, it will be saved here. In this case, the no NAME

0x52~0x59:8 bytes, ASCII code in File system format, FAT32.

0x5a~0x1fd:410 bytes, not used. There is no clear purpose for this section.

0X1FE~0X1FF: Signature Sign "AA".

3.FAINFO Information Sector

The Fainfo is typically located in the 1th sector of the filesystem, which is the next sector of the DBR.

Here's a look at the structure of Fsinfo

0x00~0x03:4 a byte, extending the boot Flag "52526141".

0x04~0x1e3:480 bytes, unused, all 0.

0x1e4~0x1e7:4 bytes, fsinfo signature "72724161".

0x1e8~0x1eb:4 bytes, file system empty cluster number, 41207688 (0x00 6D 88).

0x1ec~0x1ef:4 bytes, the next available cluster number, 663 (0x00 00 02 97).

0x1f0~0x1fd:14 bytes, not used.

0x1fe~0x1ff:2 bytes, "A-AA" flag.

Note: Typically, the 2nd sector end of the file system is also set to the "AA" flag. Sector 6th will also have a boot sector backup, corresponding to the 7th sector should be a backup fsinfo information sector. Sector 8th can be seen as a backup of sector 2nd, with a "AA" sign at the end of the section.