Сергей
Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
|
Posted: Sun Apr 13, 2008 3:29 Post subject: Example_1 - FAT Search
|
|
FAT Search
The first Job with a dump is to find the Boot sector.
The purpose:
- Check if the dump is mixed
- Determine the size of the block
Search
Usually inside the boot sector there is the text 'FAT16' or 'FAT32'.
Enter in the search box: FAT??[space][space]
Click the magnifier icon to start the search:
Editor stops searching at address 0x35c1000.
It has found the boot sector:
The size of sector in Flash Extractor of 528 bytes, instead of the normal 512 bytes.
The additional 16 bytes stores the ECC sum, block numbers and other service information.
Click the arrow downwards to move to the next sector, until you see FAT table:
The FAT table is in the same block as boot sector.
|
|
|