Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.programming > #5416 > unrolled thread

fat32 and boot sector

Back to article view | Back to comp.programming

Contents

  fat32 and boot sector "Bill Cunningham" <nospam@nspam.invalid> - 2015-05-06 15:32 -0400
    Re: fat32 and boot sector Robert Wessel <robertwessel2@yahoo.com> - 2015-05-06 18:30 -0500
      Re: fat32 and boot sector "Bill Cunningham" <nospam@nspam.invalid> - 2015-05-06 20:01 -0400
        Re: fat32 and boot sector Robert Wessel <robertwessel2@yahoo.com> - 2015-05-06 20:07 -0500
          Re: fat32 and boot sector "Bill Cunningham" <nospam@nspam.invalid> - 2015-05-06 21:49 -0400
            Re: fat32 and boot sector Robert Wessel <robertwessel2@yahoo.com> - 2015-05-06 21:24 -0500
              Re: fat32 and boot sector "Bill Cunningham" <nospam@nspam.invalid> - 2015-05-06 23:41 -0400
                Re: fat32 and boot sector "Bill Cunningham" <nospam@nspam.invalid> - 2015-05-06 23:42 -0400
                Re: fat32 and boot sector Robert Wessel <robertwessel2@yahoo.com> - 2015-05-07 01:23 -0500
                  Re: fat32 and boot sector "Bill Cunningham" <nospam@nspam.invalid> - 2015-05-07 13:18 -0400
                    Re: fat32 and boot sector Robert Wessel <robertwessel2@yahoo.com> - 2015-05-09 00:01 -0500
    Re: fat32 and boot sector JJ <jj4public@vfemail.net> - 2015-05-08 00:26 +0700
      Re: fat32 and boot sector "Bill Cunningham" <nospam@nspam.invalid> - 2015-05-07 14:17 -0400
        Re: fat32 and boot sector JJ <jj4public@vfemail.net> - 2015-05-09 21:49 +0700
      Re: fat32 and boot sector Robert Wessel <robertwessel2@yahoo.com> - 2015-05-09 00:03 -0500
        Re: fat32 and boot sector JJ <jj4public@vfemail.net> - 2015-05-09 21:55 +0700
          Re: fat32 and boot sector Robert Wessel <robertwessel2@yahoo.com> - 2015-05-09 11:43 -0500
            Re: fat32 and boot sector JJ <jj4public@vfemail.net> - 2015-05-10 16:05 +0700

#5416 — fat32 and boot sector

    Where exactly on a fat32 partition is the vb record. It's 512 bytes just 
like the mbr. I need to examine this to find the root direcetory and 
subsequently the FAT itself. If I were using linux I'd just look at 
/dev/sda1 but it's not that convenient on win xp x64.

Bill

[toc] | [next] | [standalone]

#5417

On Wed, 6 May 2015 15:32:31 -0400, "Bill Cunningham"
<nospam@nspam.invalid> wrote:

>    Where exactly on a fat32 partition is the vb record. It's 512 bytes just 
>like the mbr. I need to examine this to find the root direcetory and 
>subsequently the FAT itself. If I were using linux I'd just look at 
>/dev/sda1 but it's not that convenient on win xp x64.


What's a vb record?  I've never heard of such a thing on a FAT volume.

On a FAT32 volume the entry at +44 (4 bytes) in the BPB points to the
first cluster of the root directory.  The first FAT starts after the
number of reserved sectors in the partition, as specified by +14 in
the BPB (2 bytes).  On a FAT32 volume that's almost always 32.

[toc] | [prev] | [next] | [standalone]

#5418

"Robert Wessel" <robertwessel2@yahoo.com> wrote in message 
news:fl7lkahegvmbj3lbqpplp20chr7t6k9q6k@4ax.com...
> On Wed, 6 May 2015 15:32:31 -0400, "Bill Cunningham"
> <nospam@nspam.invalid> wrote:
>
>>    Where exactly on a fat32 partition is the vb record. It's 512 bytes 
>> just
>>like the mbr. I need to examine this to find the root direcetory and
>>subsequently the FAT itself. If I were using linux I'd just look at
>>/dev/sda1 but it's not that convenient on win xp x64.
>
>
> What's a vb record?  I've never heard of such a thing on a FAT volume.

    Volume boot record. In other words the partition's boot sector. That 
includes the BPB. The boot sector should be the partition's first sector.

 > On a FAT32 volume the entry at +44 (4 bytes) in the BPB points to the
> first cluster of the root directory.  The first FAT starts after the
> number of reserved sectors in the partition, as specified by +14 in
> the BPB (2 bytes).  On a FAT32 volume that's almost always 32.

    I have read something about "cluster two" being a directory cluster and 
being IIRC the beginning of the FAT. The thing is unlike 12 and 16 the FAT 
has no set size or place the FAT docs tell me. I am assuming because I have 
not read otherwise 4096 Bytes is one cluster. Like with NTFS. My XP x64 says 
FAT32 cluster size is the "default". So is the beginning of the partition in 
the MBR's partition table?

Bill

[toc] | [prev] | [next] | [standalone]

#5419

On Wed, 6 May 2015 20:01:51 -0400, "Bill Cunningham"
<nospam@nspam.invalid> wrote:

>
>"Robert Wessel" <robertwessel2@yahoo.com> wrote in message 
>news:fl7lkahegvmbj3lbqpplp20chr7t6k9q6k@4ax.com...
>> On Wed, 6 May 2015 15:32:31 -0400, "Bill Cunningham"
>> <nospam@nspam.invalid> wrote:
>>
>>>    Where exactly on a fat32 partition is the vb record. It's 512 bytes 
>>> just
>>>like the mbr. I need to examine this to find the root direcetory and
>>>subsequently the FAT itself. If I were using linux I'd just look at
>>>/dev/sda1 but it's not that convenient on win xp x64.
>>
>>
>> What's a vb record?  I've never heard of such a thing on a FAT volume.
>
>    Volume boot record. In other words the partition's boot sector. That 
>includes the BPB. The boot sector should be the partition's first sector.


Yes, the BPB is the first sector of the partition.  Are you having
trouble finding that?  The partition table, which can have several
different formats, although only one is common on DOS/Windows
machines, will indicate the partition boundaries.


> > On a FAT32 volume the entry at +44 (4 bytes) in the BPB points to the
>> first cluster of the root directory.  The first FAT starts after the
>> number of reserved sectors in the partition, as specified by +14 in
>> the BPB (2 bytes).  On a FAT32 volume that's almost always 32.
>
>    I have read something about "cluster two" being a directory cluster and 
>being IIRC the beginning of the FAT. The thing is unlike 12 and 16 the FAT 
>has no set size or place the FAT docs tell me. I am assuming because I have 
>not read otherwise 4096 Bytes is one cluster. Like with NTFS. My XP x64 says 
>FAT32 cluster size is the "default". So is the beginning of the partition in 
>the MBR's partition table?


MS-DOS/Windows style FAT clusters are any where from 512 bytes to
64KB.  The size is defined in the BPB.  Cluster 2 is usually the first
data cluster on the volume, and *may* be where the root directory on a
FAT32 volume is located (it's encouraged to be at that location, but
it does not have to be).  The start of the root directory cluster
chain is in the BPB (again, only for FA+T32 volumes, FAT12/16 volumes
have the root directory in a more fixed location).

The determination of whether a FAT volume is FAT12, 16 or 32, is a
rather delicate thing, and things like cluster sizes, reserved areas,
and a number of other things are *not* fixed, and must be computed
from the BPB.  Take a look at:

http://download.microsoft.com/download/1/6/1/161ba512-40e2-4cc9-843a-923143f3456c/fatgen103.doc

[toc] | [prev] | [next] | [standalone]

#5420

    That's exactly what I'm reading. The mbr I can find. Were in the 
partition table is the location  of the beginning of the bootsector is where 
I have the trouble. There's a formula in that word doc that allows 
computation of where the main FAT is. Where the backup is idk.

Bill

[toc] | [prev] | [next] | [standalone]

#5421

On Wed, 6 May 2015 21:49:18 -0400, "Bill Cunningham"
<nospam@nspam.invalid> wrote:

>    That's exactly what I'm reading. The mbr I can find. Were in the 
>partition table is the location  of the beginning of the bootsector is where 
>I have the trouble. There's a formula in that word doc that allows 
>computation of where the main FAT is. Where the backup is idk.


The traditional MS scheme for partitioning is fairly well described
at:

http://en.wikipedia.org/wiki/Master_boot_record

As are overviews of several others.

Basically up to four primary partitions can exist, each with a 16-byte
entry, starting at 0x1be in the partition boot sector (MBR).  Usually
you can just look at the last eight bytes to find the first sector and
total size of each partition.  Other parts of each entry determine
whether it's active and bootable, and several other things.

[toc] | [prev] | [next] | [standalone]

#5422

"Robert Wessel" <robertwessel2@yahoo.com> wrote in message 
news:mfhlka5fkhj3n44vinhofdh77b4ikduudq@4ax.com...

> The traditional MS scheme for partitioning is fairly well described
> at:
>
> http://en.wikipedia.org/wiki/Master_boot_record
>
> As are overviews of several others.
>
> Basically up to four primary partitions can exist, each with a 16-byte
> entry, starting at 0x1be in the partition boot sector (MBR).  Usually
> you can just look at the last eight bytes to find the first sector and
> total size of each partition.  Other parts of each entry determine
> whether it's active and bootable, and several other things.

    I am looking at the last 4 bytes in little endian order and it makes a 
hex value. I translate that into decimal and it tells me a large value 
multiply that by 512 and I get number of sectors. That seems to be an LBA 
size which would begin with sector 0. The other stuff seems to be a pain to 
calculate it's old c/h/s values. Is that necessary to calculate in order to 
find beginning sector in LBA not physical geometry that not even right to 
find a sector for first sector of a partition that is the boot sector?

    That's what I want is each partition's boot sector on the filesystem.

Bill

[toc] | [prev] | [next] | [standalone]

#5423

I translate that into decimal and it tells me a large value
> multiply that by 512 and I get number of sectors.

    Oh not number of sectors but number of bytes in the partition.

Bill

[toc] | [prev] | [next] | [standalone]

#5424

On Wed, 6 May 2015 23:41:28 -0400, "Bill Cunningham"
<nospam@nspam.invalid> wrote:

>
>"Robert Wessel" <robertwessel2@yahoo.com> wrote in message 
>news:mfhlka5fkhj3n44vinhofdh77b4ikduudq@4ax.com...
>
>> The traditional MS scheme for partitioning is fairly well described
>> at:
>>
>> http://en.wikipedia.org/wiki/Master_boot_record
>>
>> As are overviews of several others.
>>
>> Basically up to four primary partitions can exist, each with a 16-byte
>> entry, starting at 0x1be in the partition boot sector (MBR).  Usually
>> you can just look at the last eight bytes to find the first sector and
>> total size of each partition.  Other parts of each entry determine
>> whether it's active and bootable, and several other things.
>
>    I am looking at the last 4 bytes in little endian order and it makes a 
>hex value. I translate that into decimal and it tells me a large value 
>multiply that by 512 and I get number of sectors. That seems to be an LBA 
>size which would begin with sector 0. The other stuff seems to be a pain to 
>calculate it's old c/h/s values. Is that necessary to calculate in order to 
>find beginning sector in LBA not physical geometry that not even right to 
>find a sector for first sector of a partition that is the boot sector?
>
>    That's what I want is each partition's boot sector on the filesystem.


The last eight bytes of the partition table entry are two 32 bit,
little endian numbers, representing the first sector number and the
number of sectors in the partition.  There's no need to multiple by
512, unless you want to get a byte count.

[toc] | [prev] | [next] | [standalone]

#5425

"Robert Wessel" <robertwessel2@yahoo.com> wrote in message 
news:t11mka5c13it483l7m2tpaap4rrunkp8a3@4ax.com...

> The last eight bytes of the partition table entry are two 32 bit,
> little endian numbers, representing the first sector number and the
> number of sectors in the partition.  There's no need to multiple by
> 512, unless you want to get a byte count.

    Is the partition data concerning C/H/S pertinent for any reason? Or is 
it safe to ignore?

Bill

[toc] | [prev] | [next] | [standalone]

#5429

On Thu, 7 May 2015 13:18:18 -0400, "Bill Cunningham"
<nospam@nspam.invalid> wrote:

>
>"Robert Wessel" <robertwessel2@yahoo.com> wrote in message 
>news:t11mka5c13it483l7m2tpaap4rrunkp8a3@4ax.com...
>
>> The last eight bytes of the partition table entry are two 32 bit,
>> little endian numbers, representing the first sector number and the
>> number of sectors in the partition.  There's no need to multiple by
>> 512, unless you want to get a byte count.
>
>    Is the partition data concerning C/H/S pertinent for any reason? Or is 
>it safe to ignore?


It would be ignorable in all cases if the starting sector number is
zero (that's not a valid number- sectors are numbered 1-63).  I'd also
be comfortable ignoring it if there is an actual (non-zero) LBA value
specified.  But a partition specified only as CHS is at least
possible, and something you could plausibly see on a older device
(although that device would have to be smaller than 8GB).  I'd suggest
at least detecting that conditiond failing gracefully.

[toc] | [prev] | [next] | [standalone]

#5426

On Wed, 6 May 2015 15:32:31 -0400, Bill Cunningham wrote:
>     Where exactly on a fat32 partition is the vb record. It's 512 bytes just 
> like the mbr. I need to examine this to find the root direcetory and 
> subsequently the FAT itself. If I were using linux I'd just look at 
> /dev/sda1 but it's not that convenient on win xp x64.
> 
> Bill

In Windows...

If you access the volume by opening the volume device (e.g. \\.\D:), the
first sector is the VBR. The number of VBR sectors depends on the file
system.

If you access the volume by opening the disk device (e.g.
\\.\PhysicalDrive0), the first sector is the MBR. To get a partition's VBR,
the sectors number specified in the MBR partition entry's Relative Sector
field (the 2nd last field) points to the start of the partition data - which
is the partition VBR.

[toc] | [prev] | [next] | [standalone]

#5427

"JJ" <jj4public@vfemail.net> wrote in message 
news:1j9h0bl34mc3n.1rpv7m4y7s3hq$.dlg@40tude.net...
> On Wed, 6 May 2015 15:32:31 -0400, Bill Cunningham wrote:
>>     Where exactly on a fat32 partition is the vb record. It's 512 bytes 
>> just
>> like the mbr. I need to examine this to find the root direcetory and
>> subsequently the FAT itself. If I were using linux I'd just look at
>> /dev/sda1 but it's not that convenient on win xp x64.
>>
>> Bill
>
> In Windows...
>
> If you access the volume by opening the volume device (e.g. \\.\D:), the
> first sector is the VBR. The number of VBR sectors depends on the file
> system.
>
> If you access the volume by opening the disk device (e.g.
> \\.\PhysicalDrive0), the first sector is the MBR. To get a partition's 
> VBR,
> the sectors number specified in the MBR partition entry's Relative Sector
> field (the 2nd last field) points to the start of the partition data - 
> which
> is the partition VBR.

    I do not see a field called that in the MBR on this page I am looking 
at:
http://en.wikipedia.org/wiki/Master_boot_record

    Does this involve dealing with the CHS values of the partitions? I've 
never really gotten into that. HSC is the order I believe the MBR reports 
this data.

Bill

[toc] | [prev] | [next] | [standalone]

#5431

On Thu, 7 May 2015 14:17:06 -0400, Bill Cunningham wrote:
> 
>     I do not see a field called that in the MBR on this page I am looking 
> at:
> http://en.wikipedia.org/wiki/Master_boot_record

That'll be the field at offset +8 of partition entry. It was labeled as
Relative Sector back in DOS era. For MBR, the sector number is relative to
the start of hard disk sector. For EPBR (the extended partition's boot
record - which stores logical partitions), the sector number is relative to
the start of the extended partition sector.

>     Does this involve dealing with the CHS values of the partitions? I've 
> never really gotten into that. HSC is the order I believe the MBR reports 
> this data.
> 
> Bill

For modern OSes, the CHS fields are for backward compatibility only, since
the cylinder field storage is only 10-bits (0-1023). However, the CHS value
must be properly assigned based on the partition alignment. If the partition
CHS address goes beyond cylinder 1023, only the lower 10-bits are stored.
This is important only if you're developing a partition manager software.
i.e. create/move a partition.

If you only need to access a partition contents, you don't need to take the
CHS field into account since the partition field +8 is the field that stores
the complete information regarding the start of a partition data.

When you open a disk or volume device, you'll be acessing it in flat
addressing (in byte unit), not in CHS. Seeking to offset 512 would move the
access pointer to sector 1, if the disk has 512 bytes per sector. For hard
disk with 2048 bytes per sector, sector 1 would be at offset 2048.

[toc] | [prev] | [next] | [standalone]

#5430

On Fri, 8 May 2015 00:26:52 +0700, JJ <jj4public@vfemail.net> wrote:

>On Wed, 6 May 2015 15:32:31 -0400, Bill Cunningham wrote:
>>     Where exactly on a fat32 partition is the vb record. It's 512 bytes just 
>> like the mbr. I need to examine this to find the root direcetory and 
>> subsequently the FAT itself. If I were using linux I'd just look at 
>> /dev/sda1 but it's not that convenient on win xp x64.
>> 
>> Bill
>
>In Windows...
>
>If you access the volume by opening the volume device (e.g. \\.\D:), the
>first sector is the VBR. The number of VBR sectors depends on the file
>system.
>
>If you access the volume by opening the disk device (e.g.
>\\.\PhysicalDrive0), the first sector is the MBR. To get a partition's VBR,
>the sectors number specified in the MBR partition entry's Relative Sector
>field (the 2nd last field) points to the start of the partition data - which
>is the partition VBR.


With the caution that you (approximately) can't get write access to a
mounted volume, and you probably will face some security roadblocks in
any case.

[toc] | [prev] | [next] | [standalone]

#5432

On Sat, 09 May 2015 00:03:10 -0500, Robert Wessel wrote:
> 
> With the caution that you (approximately) can't get write access to a
> mounted volume, and you probably will face some security roadblocks in
> any case.

I'm not entirely sure but AFAIK XP64 administrators have not been demoted
since there's no UAC feature yet. Under XP32, administrators can open a disk
or mounted volume with read+write access with proper sharing flags.

[toc] | [prev] | [next] | [standalone]

#5433

On Sat, 9 May 2015 21:55:43 +0700, JJ <jj4public@vfemail.net> wrote:

>On Sat, 09 May 2015 00:03:10 -0500, Robert Wessel wrote:
>> 
>> With the caution that you (approximately) can't get write access to a
>> mounted volume, and you probably will face some security roadblocks in
>> any case.
>
>I'm not entirely sure but AFAIK XP64 administrators have not been demoted
>since there's no UAC feature yet. Under XP32, administrators can open a disk
>or mounted volume with read+write access with proper sharing flags.


Surely requiring admin privileges counts as a security roadblock?!

[toc] | [prev] | [next] | [standalone]

#5434

On Sat, 09 May 2015 11:43:58 -0500, Robert Wessel wrote:

> On Sat, 9 May 2015 21:55:43 +0700, JJ <jj4public@vfemail.net> wrote:
> 
>>On Sat, 09 May 2015 00:03:10 -0500, Robert Wessel wrote:
>>> 
>>> With the caution that you (approximately) can't get write access to a
>>> mounted volume, and you probably will face some security roadblocks in
>>> any case.
>>
>>I'm not entirely sure but AFAIK XP64 administrators have not been demoted
>>since there's no UAC feature yet. Under XP32, administrators can open a disk
>>or mounted volume with read+write access with proper sharing flags.
> 
> Surely requiring admin privileges counts as a security roadblock?!

Yes, if the account that run the software is not a member of the
Administrators group.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.programming

csiph-web