Hard Disk Data Recovery tutorial

Hard Disk Data Recovery relies heavily on luck, and is not necessarily in proportion to the input time. Do not place too much hope on it.

Do not experiment with your own hard disk easily.

We recommend that you copy the data to another hard disk with a hard disk protection card for backup and repair the backup. (Cannot use ghost)

Introduction to hard drive data recovery

We can't use a hard disk when we buy it. You need to partition and format it before installing the operating system. The data of a complete hard disk should include five parts: MBR, DBR, fat, Dir, and data. Only the primary Boot Sector is unique, and the others increase with the increase in the number of partitions.

Primary Boot Sector

The primary Boot Sector is located in the 0 track 0 cylinder 1 Sector of the entire hard disk, including the hard disk primary Boot Record MBR (Main Boot Record) and Partition Table
DPT (Disk Partition Table ). The primary Boot Record is used to check whether the partition table is correct and which partition is the boot partition.ProgramAt the end, the Startup Program (that is, the operating system boot sector) of the partition is transferred to the memory for execution. As for the partition table, many people know that the start mark is 80 h or H, and the end mark is 55aah, Which is 64 bytes in total and is located at the end of the local slice. It is worth mentioning that MBR is generated by a partition program (such as DoS fdisk.exe). This sector may be different for different operating systems. If you have this intention, you can write one by yourself, as long as it can complete the aforementioned task, which is also the reason for implementing multi-system startup: A lot of boot zone viruses occur because the primary Boot Record is easy to write ).

Operating System Boot Sector

Obr (OS Boot Record) is the operating system boot sector, usually located in the hard disk's 0 track 1 cylindrical 1 Sector (this is for DOS, systems that are started in Multi-boot mode are located in the first sector of the corresponding primary/extended partition), which is the first sector that the operating system can directly access, it also includes a Bootstrap program and a local partition parameter record table called BPB (BiOS parameter block. In fact, each logical partition has an obr. Its parameters vary depending on the partition size and operating system category. The main task of the Bootstrap program is to determine whether the first two files in the root directory of the partition are operating system boot files (such as msdos or Win9x/me Io originating from msdos. sys and msdos. sys ). If so, read the first file into the memory and grant control to the file. The BPB parameter block records the starting sector, ending sector, file storage format, hard disk media descriptor, root directory size, fat number, and allocation unit (Allocation unit, also called a cluster) of the current partition).

Obr is generated by an advanced formatter (for example, DOS format.com ).

File Allocation Table

Fat (File Allocation Table) is a file allocation table in the DOS/Win9x system. For data security, fat generally performs two backups, and the second fat is the first fat backup, the size of the fat area is determined by the size of the partition and the size of the file allocation unit. There have always been many options for the fat format. Microsoft's DOS and Windows use the fat12, fat16, and FAT32 formats we are familiar with, but there is no other format of fat, such as Windows NT, OS/2, Unix/Linux, and Novell all have their own file management methods.

Directory Area

DIR is short for directory, which is the root directory. After the second fat table, Dir cannot locate the file on the disk only when it is fat, fat must also work with dir to locate the file accurately. Dir records the Starting Unit (this is the most important) of each file (directory) and the attributes of the file. When locating the file location, the operating system can know the specific location and size of the file on the disk based on the starting unit in the Dir and the fat table.

After the Dir area, it is the real data storage area, that is, the data area.

Data Zone

Although data occupies the vast majority of the hard disk space, it does not have the previous parts. For us, it can only be some boring binaryCode. Here, we usually refer to formatting programs (Advanced formatting, for example, the format program under DOS) without clearing data in the data area, only the fat table is overwritten. As for partition hard disks, only MBR and obr are modified. The data in most data areas is not changed, this is why many hard disk data can be repaired. But even so, if one of MBR/obr/fat/DIR is damaged, it is enough for the so-called DIY birds to be busy for a long time ...... Please note that if you organize disks frequently, the data in your data zone may be continuous, even if MBR/fat/DIR is all broken, we can also use the disk editing software (such as diskedit in DOS). As long as we find the initial storage location of a file, the file may be recovered (of course, this requires a premise, that is, you did not overwrite this file ......).

Hard Disk partitioning

We usually talk about three partition concepts: Primary partition, extended partition, and logical partition.

The primary partition is a relatively simple partition, usually located in the first area of the hard disk, forming a logical C disk. Other logical disks cannot be created in the primary partition.

The concept of extended partitions is complicated, which is also the main cause of confusion between partitions and logical disks. Since the hard disk only saves 64 bytes of storage space for the partition table, and the parameters of each partition occupy 16 bytes, the data in the master boot sector can store a total of 4 partitions. The operating system can only store data in four partitions. If a logical disk is a partition, the system can only store four logical disks. For specific applications, four logical disks cannot meet the actual needs. To create more logical disks for the operating system, the system introduces the concept of extended partitions.

The so-called extended partition is not actually a partition. It is just a pointer to the next partition. This pointer structure will form a one-way linked list. In this way, in addition to the primary partition, only the partition data called the extended partition needs to be stored in the primary Boot Sector, the data of this extended partition can be used to locate the starting position of the next partition (which is actually the next logical disk), and then all the partitions can be found. No matter how many logical disks are created in the system, you can find each Logical Disk one by one in the primary boot sector using the parameters of an extended partition.

Note that each partition after the primary partition is linked through a one-way linked list structure. Therefore, if a problem occurs in the one-way linked list, the Logical Disk may be lost.

Data Storage Principles

Since we want to recover data, of course, we can't help but mention the data storage principle. Here, we also want to introduce the problems related to data deletion and hard disk formatting ......

File Reading

The operating system reads the file information from the directory area (including the file name, suffix name, file size, modification date, and the cluster number of the first cluster of the file stored in the data area ), let's assume that the first cluster number is 0023.

The operating system reads the corresponding data from the 0023 cluster, and then finds the fat 0023 unit. If the content is a file end sign (ff), the file ends, otherwise, repeat the cluster number of the next cluster where the data is stored until the end of the file is reached.

File writing

When we want to save the file, the operating system first finds the relevant information such as the name, size, and Creation Time of the Empty Area written in the Dir area, and then finds the idle space in the data area to save the file, write the first cluster in the data area to the Dir area. The other actions are similar to the read actions above.

File Deletion

Deleting Win9x files is very simple, simply a small change is made only in the directory area. Changing the first character of the file in the directory area to E5 indicates that the file is deleted.

Appendix:
--------------------------------------------------------------------------------

A small description of fdisk and format

Similar to deleting a file, you can use fdisk to delete a partition and format the Logical Disk. (assume that the unconditional format parameter/u is not used during formatting) data is not directly deleted from the Data Partition. The former only changes the partition table, and the latter only modifies the fat table. Therefore, the deleted partitions and incorrectly formatted hard disks are completely possible to be restored ......

System Startup Process

Different Operating System Startup processes are different. Here we use the Win9x/DOS Startup Process as an example.

Phase 1: system power-on self-check post process. Post is the abbreviation of power on self test, that is, power-on self-check. The microcomputer executes the program at the memory ffff0h (here is a fixed Rom program ), checks system hardware (including memory.

Stage 2: Read partition records and boot records. After the computer detects that the hardware is normal and consistent with the CMOS settings, start the device from the corresponding device according to the CMOS settings (we assume that the disk is started here) and read the partition record of the hard disk (DPT) and the Master Boot Record (MBR ).

Stage 3: Read the DOS Boot Record. After the microcomputer correctly reads the partition record and the Master Guide record, if the master guide record and the partition table are correctly verified, execute the primary Boot Record and further read the DOS Boot Record (located in the first sector of each primary partition), and then execute the DOS Boot Record.

Stage 4: Load implicit system files. The implicit file IO of the DOS system. sys enters the memory and loads the basic file system fat. At this time, Starting Windows 9x... io. sys sets Ms. sys reads data into the memory and processes the system. dat and user. DAT file to load the disk compression program.

Stage 5: Real DOS mode configuration. After the system implicit file is loaded, the microcomputer will execute the system hidden file and execute the system configuration file (

Config. sys) to load various drivers defined in config. sys.

Stage 6: Call the command interpreter (command.com ). The system loads command management programs to coordinate and manage various operating commands of the system (the Internal commands such as Dir and copy we use are provided by command.com ).

Stage 7: Execute the batch processing file (autoexec. BAT ). The microcomputer will execute each command in the batch processing file step by step.

Stage 8: Load win.com. Win.com is responsible for executing various drivers and startup execution files in windows.

Hard Disk data recovery, three File Allocation Table

Fat is the file addressing format of DOS and Windows9x systems. It is located after DBR.

When interpreting the concept of a file allocation table, we need to talk about the concept of a cluster. Files occupy disk space. The basic unit is not a byte but a cluster. In general, each floppy disk cluster has one sector. The number of sectors in each cluster of the hard disk is related to the total capacity of the hard disk, which may be 4, 8, 16, 32, 64 ...... The data of the same file is not necessarily completely stored in a continuous area of the disk, but is often divided into several segments and stored like a chain. This storage method is called the chained storage of files. Because the hard disk stores the connection information (FAT) between segments, the operating system can always accurately locate and read each segment while reading files.

To achieve file chain storage, the hard disk must accurately record which clusters have been occupied by files, and specify the cluster number of the next cluster for each occupied cluster. For the last cluster of a file, you must specify that the cluster has no successor cluster. These are all stored in the fat table. There are many table items in the table, and each item records the information of a cluster. Because of the importance of fat for file management, fat has a backup to ensure security, that is, the same fat is created after the original fat. All items in the initial fat are marked as "not occupied", but if the disk is partially damaged, the formatting program will detect the damaged cluster, when the corresponding item is named "Bad cluster", the cluster will no longer be used when files are stored. The number of fat items is the same as the total number of clusters on the hard disk. The number of bytes occupied by each item must be consistent with the total number of clusters, because the number of clusters must be stored. There are multiple fat formats, the most common of which are fat16 and FAT32.

After a disk is formatted, an important data table-File Allocation (fat) exists in several sectors following its logical 0-sector (that is, the Boot Sector). The file allocation table is in duplicate, the size of the occupied sector depends on the disk type. As the name suggests, the file allocation table is used to indicate the air separation configuration information of the disk component. It does not represent the information of the file directory in the boot area or actually store the file content.

We know that a disk is composed of one slice, and several slice are combined into one cluster. File Access is based on a cluster, even if the file contains only one byte. Each cluster has corresponding table items in the file allocation table. The cluster number is the table item number, and each table item occupies 1.5 bytes (the disk space is less than 10 MB) or 2 bytes (the disk space is more than 10 MB ). For convenience, the table items mentioned later refer to two bytes.

The file allocation table structure is as follows: 1 (h indicates hexadecimal)

Table 1

0th-byte header, table disk type. FFH dual-sided floppy disk, each 8-sector Feh single-sided floppy disk, each 8-sector FDH dual-sided floppy disk, 9-sector fcch single-sided floppy disk per track, 9-sector fc8h hard disk per track

1st ~ 2 bytes (table entry 1) indicates the status of the first cluster. Because the first cluster is occupied by the system, the two bytes are ffffh.

3rd ~ 4-byte (Table item 2) indicates the status of the second cluster. If this cluster is bad in the fffh table, DOS has been marked as unavailable. 0000h indicates that the cluster is empty and can be used; the fff8h table cannot indicate that the cluster is the last cluster of the file. The remaining number indicates the next cluster number of the file. Note that the high byte is before the low byte.

5th ~ 6 bytes (table entry 3) indicates the status of the third cluster, as shown in the preceding figure.

Note:

Do not mistakenly think of the number in the table item as the current cluster number. Instead, it should be the cluster number of the next cluster in the file .. After the high byte is reached, the low byte is in front of the data storage method. You should adjust it when reading the data. For example, two bytes of 12 h and 34 h should be adjusted to 3412 H.

The file allocation table works with the file directory (FDT) to manage files on the entire disk in a unified manner. It tells the system disk which clusters are bad or used, which clusters can be used, and stores the cluster numbers used by each file. It is the "Chief scheduler" of the file ".

When writing a file in DOS, first check whether the same file name exists in the file directory. If no file name exists, use a file directory and table item. Then, check the cluster corresponding to each table item in fat, at the same time, write the cluster number to the 26-27 bytes of the table item in the file directory. If the file length is more than one cluster, continue searching for available clusters, after finding the cluster number, write it to the table item found last time until the end of the file. Fill in fff8h In the table item of the last cluster to form a one-way linked list.

When deleting a file, DOS only changes The 0th bytes of the table item in the file directory table to e5h. The table item has been deleted, in the file allocation table, clear the table items of the clusters occupied by the file to 0 and release the space. The reason why the undelete.exe, unerase.exe, and other types of restoration and deletion tools can work is still being deleted.

The position of a file allocation table in the system is very important. You are advised not to modify it to avoid serious consequences caused by misoperations.
Fat table Positioning
The main structure of Hard Disk partitioning:
(Cylinder cylindrical/track-side head-sector address? -? -?)
Primary Partition
Name address length (slice)
Main Boot Record 0-0-1 1
System sector (system secotrs) 0-0-2, 0-0-63 62
Boot Sector (BOOT) 0-1-1 1
In the fat16 system, this sector contains the BPB (BiOS parameter block) Table, which describes the Logical Disk structure and contains the number of hidden sectors (calculated from 0-1-1), the number of fat sectors, the number of fat copies, the total number of Hard Disk heads, and the maximum value of the root directory table.
In the FAT32 system, the offset of the BPB table is different from that of the fat16 table, but the table items are basically the same. The entire hidden sector is used as the description area of the Logical Disk.
Hidden sector (hidden secotrs ):
Fat16 0-1-1 1
FAT32 0-1-1 32
File Allocation Table ):
Fat16 0-1-2 varies according to the Logical Disk capacity
FAT32 0-1-33 varies according to the Logical Disk capacity
Note:
Each table item in fat16 consists of 2 bytes (16 bits). Generally, each table item points to a cluster containing 64 sectors, namely, 32 KB.
The maximum size of a logical disk is 2047 MB.
Each table item of FAT32 consists of 4 bytes (32 bits). Generally, each table item points to a cluster containing 8 sectors, that is, 4 K bytes.
The Logical Disk capacity is 512 MB at least.
For the C partition, at the 0c2h offset of MBR, fat16 is 06 h, and FAT32 is 0ch.
The calculation formula is as follows:
Length of each slice = 512 bytes
Total number of clusters = Logical Disk capacity/cluster capacity
Total number of clusters = fat table length (bytes)/length of each table item (bytes)-2
Fat table length = Logical Disk capacity/cluster capacity * length of each table item
The fat table starts with a media descriptor + a string of "occupied" signs:
Fat16 hard drive ---- F8 FF 7f
FAT32 hard disk ---- F8 FF 0f FF 0f
Each valid fat structure zone contains two identical copies: fat1 and fat2.
File directory table, also known as the root directory:
Followed by the next sector in fat2, with a length of 32 sectors (256 table items ). If long file names are supported
The value is 64 bytes. The first 32 bytes are long file links. The last 32 bytes are file attributes, including the file length.
Degree, start address, date, and time. If long file names are not supported, the attribute description of each table item is 32 bytes.
Data Area ):
It follows the next sector of the FDT until the end address of the Logical Disk.
Extended partitions
Name address length (slice)
Extend partition )? -Y-1 1
System secotrs )? -Y-2 ,? Y-63 62
Boot Sector )? -(Y + 1)-1 1
The subsequent items are the same as those in the primary partition ......

Read/write failures caused by fat tables

The Hard Disk File Allocation Table is huge and cannot be repaired manually. You can only rely on tools.
The fat table records the storage address of the hard disk data. Each file has a set of fat chains to specify the address of the cluster to store. Corruption of the fat table means the loss of file content. Fortunately, the DOS system provides two fat tables. If the current fat table is damaged, the second fat table can be replaced. However, because the length of the fat table of disks of different specifications and the address of the second fat table are not fixed, you must find the correct position in the fix, some tool software such as Nu has such repair functions and is very convenient to use. Debug can also be used to implement this operation, that is, use its m command to move the second fat table to the first table (this is not recommended ). If the second fat table is damaged, the hard disk cannot be restored to its original state, but the file data is still stored in the data area of the hard disk, you can use the chkdsk or Scandisk command to fix the issue *. chk file, which is the loss of the sector data of the fat chain. If it is a text file, you can extract the complete or part of the file content from it.

Fat table for allocation of floppy disk files

When running a program, you may sometimes see the File Allocation Table bad, drive a (Bad File Allocation Table) error information on the screen, resulting in the program cannot run properly.
We know that there are two file allocation tables on the disk: fat1 and fat2. Fat1 is used for daily work, and fat2 is used for backup. Therefore, the fat2 table can be patched when fat1 is damaged.
The specific method is: Run debug, read fat2 into the buffer, and overwrite fat1 in the disk with the fat2 data of the buffer.
For example, fix a 3-inch M floppy disk on drive.
Enter the debug environment in the DOS environment
At the "-" prompt, perform the following operations:
-L 100 0 0a 9
-W 100 0 1 9
-Q
The following table describes how to fix other types of floppy disks.
Starting and ending logic sector 5.25 "low password 5.25" high password 3.5 "low password 3.5" high Password
Boot Zone 0 0 0 0
Fat1 1-2 1-7 1-3 1-9
Fat2 3-4 8-0eh 4-6 0a-12h
For example, if we want to fix the fat of a 5.25 "high-density floppy disk, we need to change the above parameter:
-L 100 0 8 7
-W 100 0 1 7
-Q
● Hard disk data recovery, two-partition table calculation
Master Boot Record

The Master Boot Record is located at the physical beginning of a hard disk, editable using the disk editor. it consists of a master bootstrap loader code (446 bytes) and four subsequent, identically structured partition records. finally, the hexadecimal signature 55aa completes a valid Master Boot Record.

The primary Boot Record of the hard disk is on the hard disk's 0 head, 0 cylinder, and 1 sector.
The Master Boot Record consists of three parts:
(1) Main Bootstrap program;
(2) Four partition tables;
(3) Valid flag of the Master Guide record.

For details, see table 1.
[Table 1 primary Boot Record structure]

Bit inner capacity
0000 h-00d9h Master Boot Record code Zone
00dah-01bdh idle Zone
01beh-01cdh partition 1 structure information
01ceh-01ddh partition 2 structure information
01deh-01edh partition 3 structure information
01eeh-01fdh partition 4 structure information
01feh-01ffh 55 aah Master Guide with a logo

Note:
A. the Partition Table starts from 1beh offset. The partition table contains 64 bytes. The table can contain four partitions. Each sixteen bytes is a partition description, for the meanings of these 16 bytes, see table 2.
B, you must note: the second-level high level of the fan area number occupies the maximum two bytes of the cylinder number, that is, the cylinder number is 10 bits, and the fan area number is 6 bits.
The format of a partition record is as follows:

Offset size de script ion
0 8 bit a value of 80 designates an active partition.

1 8 bit partition start head
2 8 bit partition start sector (BITS 0-5)
3 8 bit partition start track (BITS 8, 9 in BITs 6, 7 of sector)
4 8 bit operating system indicator
5 8 bit partition end head
6 8 bit partition end sector (BITS 0-5)
7 8 bit partition End Track (BITS 8, 9 in BITs 6, 7 of sector)
8 32 bit sectors preceding Partition
C 32 bit length of partition in sectors

Operating system indicators: (hexadecimal, incomplete list)

00 empty partition-table entry
01 dos fat12
04 dos fat16 (up to 32 MB)
05 DOS 3.3 + extended partition
06 dos 3.31 + fat16 (over 32 MB)
07 OS/2 HPFs, Windows NT NTFS, advanced UNIX
08 OS/2 V1.0-1.3, AIX bootable partition, splitdrive
09 AIX Data Partition
0a OS/2 Boot manager
0b Windows 95 + FAT32
0C Windows 95 + FAT32 (using LBA-mode INT 13 extensions)
0e dos fat16 (over 32 MB, using INT 13 extensions)
0f extended partition (using INT 13 extensions)
17 hidden NTFS partition

1B hidden windows 95 FAT32 Partition
1c hidden windows 95 FAT32 partition (using LBA-mode INT 13 extensions)
1e hidden LBA vfat Partition
42 dynamic disk volume
50 ontrack Disk Manager, read-only Partition
51 ontrack Disk Manager, read/write Partition
81 Linux
82 Linux swap partition, Solaris (UNIX)
83 Linux native File System (ext2fs/xiafs)
85 Linux ext
86 fat16 volume/stripe set (Windows NT)
87 HPFs Fault-Tolerant mirrored partition, NTFS Volume/stripe set

Be Solaris boot Partition
C0 dr-dos/Novell Dos secured Partition
C6 shortupted fat16 volume/stripe set (Windows NT)
C7 synchronized upted NTFS Volume/stripe set
F2 DOS 3.3 + secondary Partition

[Table 2 partition structure information]
Description of offset Length
00 H 1 indicates the active partition indicator. If the value is 80 h, it indicates a portable partition (only one). If the value is 00h, it indicates other partitions.
Start head number of the 01 H 1 partition.
02 h 1 low 6 bits are the first slice of the shard, and the second bits are the first two bits of the shard.
The lower position of the starting cylindrical number starting from the partition of 03 H 1.
04 H 1 system identifier. If the value is 01h, it indicates a 12-bit fat format DOS partition. If the value is 04h, it indicates a 16-bit fat format DOS partition, if the value is 05h, it indicates the extended DOS partition. If the value is 06h, it indicates the DOS system.
05 h 1 partition termination No. 1
06 h 1 low 6 bits are the sector number of the end of the partition, and the first two bits are the first two bits of the end cylindrical number.
07 h 1 the low 8 bits of the ending cylindrical Number of the partition.
08 H 4 the number of sectors before the current partition, and the low byte is before.
0ch 4: the total number of sectors in the current partition, with the lowest byte in the front.

Important formula:
0 h is X, 0 h is Y. Cylinder = (x> 6) * 16 ^ 2 + Y;
Take my hard disk as an example:
There are nine available partitions and two unavailable partitions;
Two primary NTFS partitions, and the second is active;
Seven extened partitions. The fifth partition is NTFS and the other partition is fat32.
.
Primary partition table data: Location cylinder0, head 0, sector1
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
0 33 C0 8e D0 BC 00 7C FB 50 07 50 1f FC be 1B 7c
1 BF 1B 06 50 57 B9 E5 01 F3 A4 CB be 07 B1 04
2 38 2C 7C 09 75 15 83 C6 10 E2 F5 CD 18 8B 14 8b
3 EE 83 C6 10 49 74 16 38 2C 74 F6 be 10 07 4E AC
4 3C 00 74 fa BB 07 00 B4 0e CD 10 EB F2 89 46 25
5 96 8A 46 04 B4 06 3C 0e 74 11 B4 0b 3C 0C 74 05
6 3A C4 75 2B 40 C6 46 25 06 75 24 bb AA 55 50 B4
7 41 CD 13 58 72 16 81 FB 55 AA 75 10 F6 C1 01 74
8 0b 8A E0 88 56 24 C7 06 A1 06 EB 1E 88 66 04 BF
8 0a 00 B8 01 02 8B DC 33 C9 83 ff 05 7f 03 8B 4E
9 25 03 4E 02 CD 13 72 29 be 59 07 81 3E Fe 7d 55
A aa 74 5A 83 EF 05 7f da 85 F6 75 83 be 2E 07 EB
B 8A 98 91 52 99 03 46 08 13 56 0a E8 12 00 5A EB
C D5 4f 74 E4 33 C0 CD 13 EB B8 00 00 80 24 45 00
D 56 33 F6 56 52 50 06 53
1B 00 00
1c 01 46 07 Fe 7f 1E C6 28 11 00 99 31 35 00 80 00
1D 41 30 07 Fe 7f B2 30 85 4A 00 C3 1C 20 00 00 00
1e 41 B3 0f Fe FF F3 A1 6a 00 08 Fe F7 01 00 00
1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

Primary Partition Table Analysis:
master bootstrap loader code1_h-00d9h 33 C0 8e D0 BC 00 7C FB 50... Code of the Master Guide record, indicating that the Partition Table
01beh-01cdh partition 1 structure information multi (0) disk (0) RDISK (0) Partition (0) it is known that the Boot Sector partition is located at: the starting head is 0, the starting cylinder is 70D, and the starting sector is 1.
01ceh-01ddh partition 2 structure information multi (0) disk (0) RDISK (0) Partition (1) active partition indicator is 80 h, indicates that the partition is a custom partition. The OS/2 HPFs, Windows NT NTFS, and advanced UNIX systems are marked as 07. It is known that the Boot Sector partition is located at: the starting head is 0, the starting cylinder is 304d, and the starting sector is 1.
01deh-01edh partition 3 structure information extended partition system flag byte is 0f, meaning extended partition (using INT 13 extensions ). The description of extended partitions indicates that the next Partition Table is located at: the starting head is 0, the starting cylinder is 435d, and the starting sector is 1.
01eeh-01fdh partition 4 structure information partition description item data is not defined for 00h.
01feh-01ffh 55 aah valid indicator of the Master Guide record

Extended partition 1 partition table data: Location cylinder435d, head 0, sector1
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F
0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1B 00 00
1c 41 B3 0b Fe FF 08 3f 00 00 97 D5 53 00 00 00
1D C1 09 05 Fe FF D6 D5 53 00 D6 D5 53 00 00
1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

Extended Partition Table analysis:
01beh-01cdh partition 1 structure information multi (0) disk (0) RDISK (0) Partition (3) it is found that the partition is located at: the starting head is 1 Head, the starting cylinder is 435d, the START sector is 1 (the Partition Table occupies the head 0 ). System flag 0bh indicates Windows 95 + FAT32
01beh-01cdh partition 1 Structure Information System mark byte is 05 h, which indicates that it is an extended DOS partition. The next Partition Table is located: the start head is 0, the start cylinder is 777d, And the start sector is 1.
Partition Table entry #3 data is not defined for 00h.
Partition Table entry #4 data is not defined for 00h.

The same applies to other extended partitions.