| Author |
Message |
Сергей
Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
|
Posted: Sun Apr 13, 2008 19:43 Post subject: Example_1 - Block_Size
|
|
Blocks
A dump will consist of blocks.
Blocks are not normally in the correct sequence.
So, to make an image of a disk it is necessary to restore the correct order of the blocks.
Sectors
Each block contains a number of sectors.
After removal of Mix, each sector should be in order within its block, without any sectors missing.
In this example dump the size of a sector is 528 bytes.
512 bytes of user data + 16 bytes of service information.
Markers
Each block in the dump has a marker.
The marker is a function of the block number.
Sectors within the range of the block have the same marker value.
The location of the marker is within the additional 16 service bytes at the end of each sector.
Usually the marker consists of two bytes which go successively.
Candidates for a marker
Go to beginning of the FAT table.
Click on down-arrow or press page-down and examine the last line in the sector editor:
The figures highlighted in red are constant and are candidates for a marker.
|
|
|
Сергей
Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
|
Posted: Sun Apr 13, 2008 19:43 Post subject:
|
|
The end of block
It is possible to find on change:
- A marker
- Character of the information
Goto to FAT. Click down-arrow or press Page Down.
Look at the entire sector.
It is necessary to find a sector where the nice monotonous FAT tables change to random character.
The marker should be different for this sector.
Last sector of the current block:
First sector of the next block:
Marker candidates have changed:
Were FF_00_00_FF_FF_FF
Are now FF_00_1C_FF_FF_E3
|
|
|
Сергей
Joined: 26 Aug 2005 Posts: 7876 Location: Soft-Center
|
Posted: Sun Apr 13, 2008 19:46 Post subject:
|
|
The start of the block
Find as well as the end of the block.
Only to move it is necessary upwards.
The first sector of the | |