Low-Level Disk Access Information

This Page contens stuff compiled by Günther Brunthaler

  1. DOS Disk Generic Layout
    1. The CMOS Parameter Info
    2. Purpose

      total # of cylinders of a physical disk drive as auto-detected or specified in the drive documentation. A cylinder is comprised of all the tracks on all discs within a hard disk drive that have the same track number but are read from and written to the discs by different reading/writing heads.

      # of heads of a physical drive. Each cylinder is made up of that number of tracks. Head indexes are zero-based, i. e. from 0 to the # of heads minus 1.

      # of sectors of a physical drive. Sectors are numbered from 1 to this value on each track. There is the same number of sectors on every track as far as accessing software is concerned, although the actual physical drive layout may be completely different - but this is completely transparent even for the disk controller.

      cylinder index for write precompensation or 0FFFFh if unused. Cylinders and tracks are specified as zero-based indexes, i. e. from 0 to the total # of cylinders minus 1.

      cylinder index used as landing zone for parking the drive’s heads. Usually the last cylinder of the drive - not used for anything else (thus the highest used cylinder index is the total number of cylinders minus 2). If you set the landing zone to the total number of cylinders, no cylinder is reserved as landing zone.

    3. The Boot Sector
    4. Offset

      Size

      Purpose

      000h

      3 Bytes

      For DOS 2.x, 3 byte near jump (0E9h). For DOS 3.x, 2 byte near jump (0EBh) followed by a NOP (90h). Will be executed at 0000:7C00.

      003h

      8 Bytes

      OEM name and version, e. g. "MSWIN4.0", "MSDBL6.0", "MSDOS5.0", "<5BytesTrash>IHC", "PC TOOLS", "Olivetti", "PSA 1.04"

      00Bh

      Word

      bytes per sector (should be set to 200h)

      00Dh

      Byte

      # of sectors per cluster (must be a power of 2)

      00Eh

      Word

      # of reserved sectors (starting at logical sector 0)

      010h

      Byte

      # of FATs. Usually 2.

      011h

      Word

      max # of root directory entries (32 bytes each). Usually 512 (or 32 sectors) for hard disks.

      013h

      Word

      # of sectors in DOS partition or whole diskette (total # of sectors in media, including boot sector directories, etc.) or 0h if unused (and entry at offset 20h is used instead).

      015h

      Byte

      media descriptor (see section 1.4)

      016h

      Word

      # of sectors occupied by a single FAT. Usually ceiling(HighestUsedClusterIndex / NumberOfFATEntriesPerFATSector). The latter is floor(BytesPerSector / 2) for 16 bit FATs or floor(BytesPerSector / 1.5) for 12 bit FATs.

      018h

      Word

      # of sectors per track

      01Ah

      Word

      # of heads - this equals the number of tracks on each cylinder.

      01Ch

      DWord

      # of hidden sectors (relative sector offset from the containing partition table). Same as relative sectors from partition table entry.

      020h

      DWord

      total # of sectors in logical image (only used if entry at offset 13h is set to 0h)

      024h

      Byte

      physical drive number (00h for first diskette dive:, 01h for next diskette drive, 80h for first hard disk, 81h for next hard disk, etc.)

      025h

      Byte

      ? - pad byte? - set to 0h

      026h

      Byte

      extended boot sector signature, set to 29h in order to enable the special meanings for offsets between 26h and 40h. Only this way DOS uses the serial number field and only then the LABEL command writes a copy of the volume name into the boot sector. However, the smallest offset ever observed to be used for the boot program has been 030h so far.

      027h

      DWord

      Serial Number, will be displayed as "<highWord>-<lowWord>"

      02Bh

      0Bh Bytes

      Disk Label, padded with spaces (20h). This entry is set in addition to a corresponding "Volume"-entry in the root directory.

      036h

      8 Bytes

      File System ID "FAT12" or "FAT16" - padded with spaces (20h). Regardless of what is specified here, the actual FAT size will be determined run time by performing the following check: If the highest used cluster index is less than 4087, a 12 bit FAT is assumed, otherwise it is assumed to be a 16 bit FAT.

      03Eh

      1C0h Bytes

      remaining boot code and data, actual entry point will be jumped at from code at offset 000h

      1FEh

      2 Bytes

      Boot Sector Valid signature: bytes 55h, Aah

    5. Media Descriptor Byte
    6. Bit

      Purpose

      7-3

      always set to "1"

      2

      "0" for fixed (i. e. non-removable) devices

      1

      "0" if there are other than exactly 8 sectors per track

      0

      "0" if medium is not double-sided

    7. DOS Disk Standard Formats
    8. Inch

      Total Capacity

      DOS Version

      Heads

      Sectors/
      Track

      Tracks

      Sectors/
      FAT

      RootDir
      Sectors

      RootDir
      Entries

      Sectors/
      Cluster

      Total
      Sectors

      5.25

      160K

      1.0

      1

      8

      40

      1

      4

      64

      1

      320

      5.25

      320K

      1.1

      2

      8

      40

      1

      7

      112

      2

      360

      5.25

      180K

      2.0

      1

      9

      40

      2

      4

      64

      1

      640

      5.25

      360K

      2.0

      2

      9

      40

      2

      7

      112

      2

      720

      5.25

      1.2M

      3.0

      2

      15

      80

      7

      14

      224

      1

      2400

      3.5

      720K

      3.2

      2

      9

      80

      3

      7

      112

      2

      1440

      3.5

      1.44M

      3.3

      2

      18

      80

      9

      14

      224

      1

      2880

    9. Master Boot Record Layout
    10. Offset

      Bytes

      Purpose

      000h

      1BEh

      Master Boot Code; will be run at 0000:7C00

      1Beh

      010h

      Partition Table Entry for partition #1

      1CEh

      010h

      Partition Table Entry for partition #2

      1DEh

      010h

      Partition Table Entry for partition #3

      1EEh

      010h

      Partition Table Entry for partition #4

      1FEh

      002h

      MBR Valid signature: bytes 055h, 0Aah

    11. Partition Table Entry Layout
    12. Offset

      Bytes

      Purpose

      0h

      1

      boot indicator: 00h if non-bootable, 80h if bootable partition. (This is also the drive number of the boot drive.)

      1h

      1

      partition starting head

      2h

      1

      bits 7-6: bits 9-8 of starting cylinder; bits 5-0: starting sector. Partitions normally start at sector 1 of a cylinder for a given head.

      3h

      1

      bits 7-0 of starting cylinder

      4h

      1

      Operating System Indicator Byte (see section 1.8)

      5h

      1

      partition ending head. Partitions normally end with the last sector of a cylinder for a given head.

      6h

      1

      bits 7-6: bits 9-8 of ending cylinder; bits 5-0: ending sector

      7h

      1

      bits 7-0 of ending cylinder

      8h

      4

      relative sector offset of the first actual partition sector

      Ch

      4

      total # of sectors in partition

    13. Operating System Indicator Byte
    14. Value

      (Symbol and) Meaning

      00h

      "Free" - Empty or unspecified non-DOS

      01h

      "DOS-12" - DOS 12-bit FAT (£ 20740 sectors)

      02h

      "XENIX" - XENIX root file system

      03h

      XENIX /usr file system (obsolete)

      04h

      "DOS-16" - DOS 16-bit FAT (³ 20740 sectors)

      05h

      "EXTEND" - DOS 3.3+ extended partition, contains nested logical drives (FDISK). An extended partition contains the following components: a partition table in the first sector, and up to four partitions nested within the containing extended partition. But in practice, in each partition table, only the first partition table entry refers to an actual partition, while the second partition is an extended partition and the remaining two partition table entries are unused. Logical drives in the extended partition are actually the first partitions of deeper and deeper nested extended partitions.

      06h

      "BIGDOS" - DOS 3.31+ Large File System, required for MS-DOS partitions ³ 33 MB

      07h

      "HPFS" - QNX, OS/2 HPFS, NTFS or Advanced Unix

      08h

      "Split" - AIX bootable partition or SplitDrive

      09h

      AIX data partition or Coherent

      0Ah

      OPUS

      10h

      PUS

      40h

      ENIX 80286

      50h

      (OnTrack?) Disk Manager, read-only partition

      51h

      Novell??? or (OnTrack?) Disk Manager, read/write partition

      52h

      CP/M or Microport System V/386

      56h

      GoldenBow Vfeature

      61h

      "Speed" - SpeedStor

      63h

      "386/ix" - Unix SysV/386, 386/ix; or Mach, MtXinu BSD 4.3 on Mach; or GNU HURD

      64h

      "NET286" - Novell NetWare

      65h

      "NET386" - Novell NetWare

      75h

      "PCIX" - PC/IX

      80h

      Minix v1.1 - 1.4a

      81h

      Minix v1.4b+ or Linux

      82h

      Linux Swap partition (planned)

      93h

      Amoeba file system

      94h

      Amoeba bad block table

      B7h

      BSDI file system (secondarily swap)

      B8h

      BSDI swap partition (secondarily file system)

      C6h

      DR-DOS 6.0 LOGIN.EXE-secured partition

      DBh

      "CP/M" - CP/M, Concurrent CP/M, Concurrent DOS; or CTOS (Convergent Technologies OS)

      E1h

      SpeedStor 12-bit FAT extended partition

      E4h

      SpeedStor 16-bit FAT extended partition

      F2h

      DOS 3.3+ secondary

      FEh

      LANstep

      FFh

      "BBT" - Xenix bad block table

    15. The FAT

The FAT - or File Allocation Table - is a linked list describing cluster chains that represent files or directories.

The root directory has a fixed position on each partition and cannot grow beyond its maximum number of entries as specified in the boot sector.

All other directories are treated exactly like normal data files at FAT level.

The FAT entry for each cluster that is not the last cluster in a file contains the cluster number of the next cluster for this file.

Each free cluster has a corresponding FAT entry value of 0, where 0 and 1 are not used as actual cluster numbers. The FAT entries for clusters 0 and 1 are actually signatures and must be 0FFF8h and 0FFFFh respectively (for 16 bit FATs). For 12 bit FATs the entries are 0FF8h and 0FFFh. All entries are in INTEL format, i. e. lower order bytes first, higher order bytes next. No actual data space is allocated for clusters 0 and 1, the cluster data space (immediately starting after the last root directory sector) starts with cluster number 2.

Bad sectors have an associated FAT entry value of 0FFF7h for 16-bit FATs or 0FF7h for 12-bit FATs. Note that modern hard disks only rarely do have bad sectors visible to the BIOS, so bad sectors may be used by boot viruses to place their remaining code.

The last sector in a FAT cluster chain has a corresponding FAT entry of 0FFFFh for 16-bit FATs or 0FFFh for 12-bit FATs, thus indicating that this is the last cluster of the file. Depending on the file’s actual size (which can be determined by examining ist associated directory entry which also contains the starting cluster) there may be some unused bytes at the end of the cluster that are not included into the actual file’s contents. This unused space is often called the "Slack" of the file, and some viruses may also use this space to hide parts of their code.

Because the highest valid data cluster number if 0FFF6h for 16-bit FATs or 0FF6h for 12-bit FATs and clusters 0 and 1 do not actually exist, a partition can have a maximum of 65525 data clusters for a 16-bit FAT, or 4085 for a 12-bit FAT, where the highest used data cluster number is 1 higher, i. e. 65526 and 4086. Thererfore, if the highest data cluster has an index greater than 4086, a 16-bit FAT is assumed, otherwise is treated as a 12-bit FAT.

Back2Animszurück zu animierte Beispiele
Back2misc Back to misc. Points of interest 1
Back to SiteMapBack to SiteMap