[lnkForumImage]
TotalShareware - Download Free Software
Confronta i prezzi di migliaia di prodotti.
Asp Forum
 Home | Login | Register | Search 


 

Forums >

comp.programming

fat32 and boot sector

Bill Cunningham

5/6/2015 7:33:00 PM

Where exactly on a fat32 partition is the vb record. It's 512 bytes just
like the mbr. I need to examine this to find the root direcetory and
subsequently the FAT itself. If I were using linux I'd just look at
/dev/sda1 but it's not that convenient on win xp x64.

Bill
17 Answers

robertwessel2@yahoo.com

5/6/2015 11:30:00 PM

0

On Wed, 6 May 2015 15:32:31 -0400, "Bill Cunningham"
<nospam@nspam.invalid> wrote:

> Where exactly on a fat32 partition is the vb record. It's 512 bytes just
>like the mbr. I need to examine this to find the root direcetory and
>subsequently the FAT itself. If I were using linux I'd just look at
>/dev/sda1 but it's not that convenient on win xp x64.


What's a vb record? I've never heard of such a thing on a FAT volume.

On a FAT32 volume the entry at +44 (4 bytes) in the BPB points to the
first cluster of the root directory. The first FAT starts after the
number of reserved sectors in the partition, as specified by +14 in
the BPB (2 bytes). On a FAT32 volume that's almost always 32.

Bill Cunningham

5/7/2015 12:02:00 AM

0


"Robert Wessel" <robertwessel2@yahoo.com> wrote in message
news:fl7lkahegvmbj3lbqpplp20chr7t6k9q6k@4ax.com...
> On Wed, 6 May 2015 15:32:31 -0400, "Bill Cunningham"
> <nospam@nspam.invalid> wrote:
>
>> Where exactly on a fat32 partition is the vb record. It's 512 bytes
>> just
>>like the mbr. I need to examine this to find the root direcetory and
>>subsequently the FAT itself. If I were using linux I'd just look at
>>/dev/sda1 but it's not that convenient on win xp x64.
>
>
> What's a vb record? I've never heard of such a thing on a FAT volume.

Volume boot record. In other words the partition's boot sector. That
includes the BPB. The boot sector should be the partition's first sector.

> On a FAT32 volume the entry at +44 (4 bytes) in the BPB points to the
> first cluster of the root directory. The first FAT starts after the
> number of reserved sectors in the partition, as specified by +14 in
> the BPB (2 bytes). On a FAT32 volume that's almost always 32.

I have read something about "cluster two" being a directory cluster and
being IIRC the beginning of the FAT. The thing is unlike 12 and 16 the FAT
has no set size or place the FAT docs tell me. I am assuming because I have
not read otherwise 4096 Bytes is one cluster. Like with NTFS. My XP x64 says
FAT32 cluster size is the "default". So is the beginning of the partition in
the MBR's partition table?

Bill

robertwessel2@yahoo.com

5/7/2015 1:07:00 AM

0

On Wed, 6 May 2015 20:01:51 -0400, "Bill Cunningham"
<nospam@nspam.invalid> wrote:

>
>"Robert Wessel" <robertwessel2@yahoo.com> wrote in message
>news:fl7lkahegvmbj3lbqpplp20chr7t6k9q6k@4ax.com...
>> On Wed, 6 May 2015 15:32:31 -0400, "Bill Cunningham"
>> <nospam@nspam.invalid> wrote:
>>
>>> Where exactly on a fat32 partition is the vb record. It's 512 bytes
>>> just
>>>like the mbr. I need to examine this to find the root direcetory and
>>>subsequently the FAT itself. If I were using linux I'd just look at
>>>/dev/sda1 but it's not that convenient on win xp x64.
>>
>>
>> What's a vb record? I've never heard of such a thing on a FAT volume.
>
> Volume boot record. In other words the partition's boot sector. That
>includes the BPB. The boot sector should be the partition's first sector.


Yes, the BPB is the first sector of the partition. Are you having
trouble finding that? The partition table, which can have several
different formats, although only one is common on DOS/Windows
machines, will indicate the partition boundaries.


> > On a FAT32 volume the entry at +44 (4 bytes) in the BPB points to the
>> first cluster of the root directory. The first FAT starts after the
>> number of reserved sectors in the partition, as specified by +14 in
>> the BPB (2 bytes). On a FAT32 volume that's almost always 32.
>
> I have read something about "cluster two" being a directory cluster and
>being IIRC the beginning of the FAT. The thing is unlike 12 and 16 the FAT
>has no set size or place the FAT docs tell me. I am assuming because I have
>not read otherwise 4096 Bytes is one cluster. Like with NTFS. My XP x64 says
>FAT32 cluster size is the "default". So is the beginning of the partition in
>the MBR's partition table?


MS-DOS/Windows style FAT clusters are any where from 512 bytes to
64KB. The size is defined in the BPB. Cluster 2 is usually the first
data cluster on the volume, and *may* be where the root directory on a
FAT32 volume is located (it's encouraged to be at that location, but
it does not have to be). The start of the root directory cluster
chain is in the BPB (again, only for FA+T32 volumes, FAT12/16 volumes
have the root directory in a more fixed location).

The determination of whether a FAT volume is FAT12, 16 or 32, is a
rather delicate thing, and things like cluster sizes, reserved areas,
and a number of other things are *not* fixed, and must be computed
from the BPB. Take a look at:

http://download.microsoft.com/download/1/6/1/161ba512-40e2-4cc9-843a-923143f3456c/fat...

Bill Cunningham

5/7/2015 1:49:00 AM

0

That's exactly what I'm reading. The mbr I can find. Were in the
partition table is the location of the beginning of the bootsector is where
I have the trouble. There's a formula in that word doc that allows
computation of where the main FAT is. Where the backup is idk.

Bill

robertwessel2@yahoo.com

5/7/2015 2:24:00 AM

0

On Wed, 6 May 2015 21:49:18 -0400, "Bill Cunningham"
<nospam@nspam.invalid> wrote:

> That's exactly what I'm reading. The mbr I can find. Were in the
>partition table is the location of the beginning of the bootsector is where
>I have the trouble. There's a formula in that word doc that allows
>computation of where the main FAT is. Where the backup is idk.


The traditional MS scheme for partitioning is fairly well described
at:

http://en.wikipedia.org/wiki/Master_b...

As are overviews of several others.

Basically up to four primary partitions can exist, each with a 16-byte
entry, starting at 0x1be in the partition boot sector (MBR). Usually
you can just look at the last eight bytes to find the first sector and
total size of each partition. Other parts of each entry determine
whether it's active and bootable, and several other things.

Bill Cunningham

5/7/2015 3:41:00 AM

0


"Robert Wessel" <robertwessel2@yahoo.com> wrote in message
news:mfhlka5fkhj3n44vinhofdh77b4ikduudq@4ax.com...

> The traditional MS scheme for partitioning is fairly well described
> at:
>
> http://en.wikipedia.org/wiki/Master_b...
>
> As are overviews of several others.
>
> Basically up to four primary partitions can exist, each with a 16-byte
> entry, starting at 0x1be in the partition boot sector (MBR). Usually
> you can just look at the last eight bytes to find the first sector and
> total size of each partition. Other parts of each entry determine
> whether it's active and bootable, and several other things.

I am looking at the last 4 bytes in little endian order and it makes a
hex value. I translate that into decimal and it tells me a large value
multiply that by 512 and I get number of sectors. That seems to be an LBA
size which would begin with sector 0. The other stuff seems to be a pain to
calculate it's old c/h/s values. Is that necessary to calculate in order to
find beginning sector in LBA not physical geometry that not even right to
find a sector for first sector of a partition that is the boot sector?

That's what I want is each partition's boot sector on the filesystem.

Bill

Bill Cunningham

5/7/2015 3:43:00 AM

0

I translate that into decimal and it tells me a large value
> multiply that by 512 and I get number of sectors.

Oh not number of sectors but number of bytes in the partition.

Bill

robertwessel2@yahoo.com

5/7/2015 6:24:00 AM

0

On Wed, 6 May 2015 23:41:28 -0400, "Bill Cunningham"
<nospam@nspam.invalid> wrote:

>
>"Robert Wessel" <robertwessel2@yahoo.com> wrote in message
>news:mfhlka5fkhj3n44vinhofdh77b4ikduudq@4ax.com...
>
>> The traditional MS scheme for partitioning is fairly well described
>> at:
>>
>> http://en.wikipedia.org/wiki/Master_b...
>>
>> As are overviews of several others.
>>
>> Basically up to four primary partitions can exist, each with a 16-byte
>> entry, starting at 0x1be in the partition boot sector (MBR). Usually
>> you can just look at the last eight bytes to find the first sector and
>> total size of each partition. Other parts of each entry determine
>> whether it's active and bootable, and several other things.
>
> I am looking at the last 4 bytes in little endian order and it makes a
>hex value. I translate that into decimal and it tells me a large value
>multiply that by 512 and I get number of sectors. That seems to be an LBA
>size which would begin with sector 0. The other stuff seems to be a pain to
>calculate it's old c/h/s values. Is that necessary to calculate in order to
>find beginning sector in LBA not physical geometry that not even right to
>find a sector for first sector of a partition that is the boot sector?
>
> That's what I want is each partition's boot sector on the filesystem.


The last eight bytes of the partition table entry are two 32 bit,
little endian numbers, representing the first sector number and the
number of sectors in the partition. There's no need to multiple by
512, unless you want to get a byte count.

Bill Cunningham

5/7/2015 5:18:00 PM

0


"Robert Wessel" <robertwessel2@yahoo.com> wrote in message
news:t11mka5c13it483l7m2tpaap4rrunkp8a3@4ax.com...

> The last eight bytes of the partition table entry are two 32 bit,
> little endian numbers, representing the first sector number and the
> number of sectors in the partition. There's no need to multiple by
> 512, unless you want to get a byte count.

Is the partition data concerning C/H/S pertinent for any reason? Or is
it safe to ignore?

Bill

JJ

5/7/2015 5:27:00 PM

0

On Wed, 6 May 2015 15:32:31 -0400, Bill Cunningham wrote:
> Where exactly on a fat32 partition is the vb record. It's 512 bytes just
> like the mbr. I need to examine this to find the root direcetory and
> subsequently the FAT itself. If I were using linux I'd just look at
> /dev/sda1 but it's not that convenient on win xp x64.
>
> Bill

In Windows...

If you access the volume by opening the volume device (e.g. \\.\D:), the
first sector is the VBR. The number of VBR sectors depends on the file
system.

If you access the volume by opening the disk device (e.g.
\\.\PhysicalDrive0), the first sector is the MBR. To get a partition's VBR,
the sectors number specified in the MBR partition entry's Relative Sector
field (the 2nd last field) points to the start of the partition data - which
is the partition VBR.