| Author |
Message |
Сергей
Joined: 26 Aug 2005
Posts: 7876
Location: Soft-Center
|
 Posted: Sun Apr 13, 2008 20:18 Post subject: Example_1 - Virtual_Translator
|
|
Virtual Translator
The Virtual Translator builds an image of a disk from the specified blocks. It Shows the service zone from a different perspective.
Purpose
- To find a link between the marker and block number.
Search for blocks
We need to find the as many blocks as possible that are in the correct place in the image.
This flash does not have partition table. So, the disk image begins directly with the boot sector.
Find the utility:
Right click. Properties.
Enter first block:
Parameters:
Block_Size - the size of the block
Sector - geometry of each sector. 512 bytes data + 16 bytes system bytes.
Blocks - the block list, in the following format:
<block number in image> / <block start address in a dump> / <comments>
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 7876
Location: Soft-Center
|
|
Posted: Sun Apr 13, 2008 20:20 Post subject:
|
|
Block 1
To find the next block, we look the last sector of previous block: 0x35c1000 + 0x21000 - 0x210 = 0x35E1DF0
The last cluster highlighted in red 00_6D_00_00.
The following cluster is 01_6D_00_00.
We need find the block that begins with these value.
Search string: 016D0000/h/0x21000/0
The Start of the block 1:
Enter him in Virtual Translator
By means of buttons with arrows you can save all records from this window in a text file. And then load it load back.
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 7876
Location: Soft-Center
|
|
Posted: Sun Apr 13, 2008 20:20 Post subject:
|
|
Blocks 2-7
Using these techniques, find 6 more blocks:
| Code: | Block Start End Claster Seacrh
0 0x35c1000 0x35E1DF0 00_6D_00_00 016D0000/h/0x21000/0
1 0x82b6000 0x82D6DF0 00_ED_00_00 01ED0000/h/0x21000/0
2 0x5fc7000 0x5FE7DF0 00_6D_01_00 016D0100/h/0x21000/0
3 0x7c23000 0x7C43DF0 00_ED_01_00 01ED0100/h/0x21000/0
4 0x393c000 0x395CDF0 80_7C_00_00 817C0000/h/0x21000/0
5 0x3813000 0x3833DF0 80_FC_00_00 81FC0000/h/0x21000/0
6 0x4aa3000 0x4AC3DF0 80_7C_01_00 817C0100/h/0x21000/0
7 0x037b000 0x039BDF0 random characters... |
Go to start of block 7. Amd move down.
While you found the root:
Beyond the root is the user data - this looks like random characters.
With this method we can't find more blocks.
Enter found blocks in Virtual Translator:
Open Virtual Translator folder.
There is blocks you just entered.
If you select one of the blocks, the editor will go to address of the beginning of the block.
Right click on any block. Show.
You will see the service area of each sector of this block.
Right click on Virtual Translator. Save.
Save Disk.image. It is an image made of the found blocks.
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 7876
Location: Soft-Center
|
|
Posted: Sun Apr 13, 2008 20:23 Post subject:
|
|
Search blocks with directories
Open Disk.image in Image_Explorer.
Open Root:
Directory "Flowers" is green.
This mean his header is correct.
The directories 'Sea' and 'Views' are dark red.
This means, that they lay outside the image.
Our objective now is to find the blocks in which these catalogues reside and to put them in the correct place.
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 7876
Location: Soft-Center
|
|
Posted: Sun Apr 13, 2008 20:24 Post subject:
|
|
Directory "Sea"
Left click on "Sea".
The sector editor will go to address where this directory should be. In Log we see message:
| Code: | Canceled.
Media Error: Read failure |
This means a read error. The 'Sea' directory is still not present in image.
The editor screen is filled by with 0x37.
This is a filler used for sectors that are 'not found'.
In Image
The 'Sea' directory should be at address 0x1194c00.
To find out which block this is in, you will need to divide this number into the block size.
Note, the block size in the image is different to the block size in the dump.
Each sector in the dump is 528 bytes and has to be converted to a 512 byte sector:
[in image] = [in dump] / 528 * 512
0x20000 = 0x21000 / 0x210 * 0x200
Number of the block with 'Sea': 0x1194c00 / 0x20000 = 0x8C
Now we have to find the address of the block with the 'Sea' directory in the dump.
In Dump
Right click on "Sea". Search String.
In Log we see search string:
2E20202020202020202020103f3f3f3f3f3f3f3f00003f3f3f3f614200000000/h/16/0
We find this line in the dump in Flash_Extractor:
This address is inside of the block.
We need start of the block.
For our purposes we need to divide the address into the size block size, to remove the leading part, and multiply by size of the block:
0x54E7660 / 0x21000 = 0x292
0x292 * 0x21000 = 0x54D2000
This is the start of the block.
Addition
Add this block to the Virtual Translator:
Save as an image. Check that the "Sea" directory becomes green:
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 7876
Location: Soft-Center
|
|
Posted: Sun Apr 13, 2008 20:26 Post subject:
|
|
Directory "Views"
Do the same for the directory 'Views'.
Check that the directory is on place:
|
|
|
Сергей
Joined: 26 Aug 2005
Posts: 7876
Location: Soft-Center
|
|
Posted: Sun Apr 13, 2008 20:30 Post subject:
|
|
Link between the marker and block number
Look at Virtual Translator Log:
Here the blocks we have found are listed:
Image - address where block placed*
Dump - address where block taken*
Далее - service area
In brackets: address / Block_Size
In example block number 0 system area highlighted:
Now we need to find the link between the marker and block number:
The marker in this flash is equal to number of the block
|
|
|
|
