[Сергей]

Blocks
A dump will consist of blocks.
Blocks are not normally in the correct sequence.
So, to make an image of a disk it is necessary to restore the correct order of the blocks.

Sectors
Each block contains a number of sectors.
After removal of Mix, each sector should be in order within its block, without any sectors missing.
In this example dump the size of a sector is 528 bytes.
512 bytes of user data + 16 bytes of service information.

Markers
Each block in the dump has a marker.
The marker is a function of the block number.
Sectors within the range of the block have the same marker value.
The location of the marker is within the additional 16 service bytes at the end of each sector.
Usually the marker consists of two bytes which go successively.

Candidates for a marker
Go to beginning of the FAT table.
Click on down-arrow or press page-down and examine the last line in the sector editor:









The figures highlighted in red are constant and are candidates for a marker.

[Сергей]

The end of block
It is possible to find on change:
- A marker
- Character of the information

Goto to FAT. Click down-arrow or press Page Down.

Look at the entire sector.
It is necessary to find a sector where the nice monotonous FAT tables change to random character.

The marker should be different for this sector.

Last sector of the current block:



First sector of the next block:



Marker candidates have changed:
Were FF_00_00_FF_FF_FF
Are now FF_00_1C_FF_FF_E3

[Сергей]

The start of the block
Find as well as the end of the block.
Only to move it is necessary upwards.

The first sector of the block coincides with the boot sector:



Last sector of the previous block:



Marker candidates have changed:
Were FF_00_00_FF_FF_FF
Are now FF_02_7D_FF_FF_80

[Сергей]

Block size
[Block Size] = [start of next] - [start of current]

0x21000 = 0x35E2000 - 0x35C1000

Note that all of figures are "rounded" and without the remainder on 0x21000.

[Сергей]

Alternative method
Find utility Listing:



Right click on it and select Properties:



Enter same values.
Click on the tick in the bottom right.

The utility shows the service area bytes at the first sector of each block in the dump.

Right click on listing again and select 'Show'. You will now see several lines of data. At any time it is possible to press the 'X' to interrupt the process.

I choose this place:



Do you see groups of 8 blocks? They all have the same marker values.

The size of the block is 8 times more than current value.

0x4200 * 8 = 0x21000