Disk storage structure of all kinds of computer viruses

For the storage structure of computer viruses, different types of viruses, the storage structure on the disk is different.

1. Overall partition of disk space the formatted disk includes the master Boot Record area (only the hard disk), the boot record area, the file allocation table (FAT), the directory area, and the data area. The primary boot record area and the boot record area contain the information used by the DOS system to boot.

A file allocation table (FAT) is a table that reflects the current disk sector usage. Each DOS disk contains two identical fat tables, i.e. FAT1 and FAT2,FAT2 are a backup table. Fat is managed with the directory for the disk data area. The directory area holds information such as the existing file directory on the disk and its Da Hio storage time. The data area stores the file content data corresponding to the file name.

(1) Overall partition of floppy disk space when you format a floppy disk by using the external command format of DOS, not only the disk is divided into several tracks, each track is divided into several sectors, and at the same time dividing the sector into five regions, they are the boot record area, file allocation table 1, file allocation table 2, The root area and the data area.

For a floppy disk with only one boot area, the boot zone is 0 0 1 sectors of the disk, which is responsible for loading the system's two hidden files Io.sys and Msdos.sys into memory at system startup, and provides a table of disk I/O parameters necessary for DOS to read and write to disk. The file allocation table (FAT table) is a registration form that reflects the respective sectors of all the files on the disk, which is important and will not be able to find the contents of the file once it is corrupted. Even for people who are proficient in DOS, it is not easy and expensive to fix a damaged disk file on a fat table. This system retains two identical file allocation tables when partitioning the disk area. The root area is a catalog registration form that records all the files on the disk. It mainly records the file name, extension, file attributes, file length, file creation date, build time, and other important information.

(2) The overall partition of hard disk space for different types of disks, different media, DOS partition disk format is different. For hard disk, because of its large storage space, in order to allow multiple operating systems to share hard disk space, and want to be able to boot from the disk system, DOS in the format of the hard disk, the hard drive divided into the main boot record area and multiple system partitions.

The allocation of hard disk space consists of two parts: the first part is the first sector of the whole hard disk, which is called the main boot program sector of the hard disk, which consists of two parts, one is the main boot program and the other is the partition information table. The primary bootstrapper is the first program that is executed when the hard disk is started, and it loads the boot program from the active partition (active partition) to further boot the system. The Partition information table registers each partition boot indicator, operating system indicator, and the location of the partition that occupies the hard disk space and its length, and the second part is the individual system partitions. Each system partition is an area that is provided to each operating system, and only one operating system is available in each zone, and the system in the zone has its own boot record, file allocation table area, file directory area, and data area. If the entire hard disk to DOS use, the information on the hard disk from 5 parts that is the 1th sector of the main bootstrapper and partition information table, partition bootstrapper, file allocation table area, file root area, file data area.

The hard drive main boot sector is very special, it is not within the DOS jurisdiction. So in DOS, the very presence command format, FDISK, and debug can't touch it. The hard drive does not start when the sector is damaged. You can't fix it with format or FDISK. Neither the Debug L command nor the W command can be used in the primary boot sector. It can only be repaired by borrowing INT13h or low-level formatting under Debug.