求一份介绍磁盘各分区的第一个扇区数据内容的资料 比如介绍D盘第一个扇区某个偏移处的数据代表什么意思 解决方案 » 免费领取超大流量手机卡,每月29元包185G流量+100分钟通话, 中国电信官方发货 http://search.download.csdn.net/search/%E6%95%B0%E6%8D%AE%E6%81%A2%E5%A4%8D%E6%8A%80%E6%9C%AF%EF%BC%88%E7%AC%AC2%E7%89%88%EF%BC%89这个是CSDN上 数据恢复技术(第2版)我有这本书,别人不要了给我了,还没看!! 可以参考WINHEX的资料template "Boot Sector FAT32"// Template by Stefan Fleischmann// To be applied to sector 0 of a FAT32-formatted logical drive.description "BIOS parameter block (BPB) and more"applies_to disksector-alignedrequires 0x02 "90"requires 0x52 "46 41 54 33 32" // ="FAT32" at offset 52requires 0x1FE "55 AA"begin read-only hex 3 "JMP instruction" char[8] "OEM" section "BIOS Parameter Block" uint16 "Bytes per sector" uint8 "Sectors per cluster" uint16 "Reserved sectors" uint8 "Number of FATs" uint16 "Root entries (unused)" uint16 "Sectors (on small volumes)" hex 1 "Media descriptor (hex)" uint16 "Sectors per FAT (small vol.)" uint16 "Sectors per track" uint16 "Heads" uint32 "Hidden sectors" uint32 "Sectors (on large volumes)" section "FAT32 Section" uint32 "Sectors per FAT" uint16 "Flags" uint16 "Version" uint32 "Root dir 1st cluster" uint16 "FSInfo sector" uint16 "Backup boot sector" read-only hex 12 "(Reserved)" endsection hex 1 "BIOS drive (hex, HD=8x)" read-only uint8 (Unused) hex 1 "Ext. boot signature (29h)" uint32 "Volume serial number (decimal)" move -4 hex 4 "Volume serial number (hex)" char[11] "Volume label" char[8] "File system" endsection goto 0x1FE read-only hex 2 "Signature (55 AA)"endtemplate "Boot Sector FAT"// Template by Stefan Fleischmann// Boot sector format for MSDOS 4.0 onwards (incl. Windows 9x)// To be applied to sector 0 of a FAT12/FAT16-formatted logical drive.description "BIOS parameter block (BPB) and more"applies_to disksector-alignedrequires 0x0 "EB" // JMP instruction will usually be EB xx 90requires 0x2 "90" // (though older drives may use E9 xx xx)requires 0x1FE "55 AA"begin read-only hex 3 "JMP instruction" char[8] "OEM" section "BIOS Parameter Block" uint16 "Bytes per sector" uint8 "Sectors per cluster" uint16 "Reserved sectors" uint8 "Number of FATs" uint16 "Root entries" uint16 "Sectors (under 32 MB)" hex 1 "Media descriptor (hex)" uint16 "Sectors per FAT" uint16 "Sectors per track" uint16 "Heads" uint32 "Hidden sectors" uint32 "Sectors (over 32 MB)" endsection hex 1 "BIOS drive (hex, HD=8x)" read-only uint8 "(Unused)" hex 1 "Ext. boot signature (29h)" uint32 "Volume serial number (decimal)" move -4 hex 4 "Volume serial number (hex)" char[11] "Volume label" char[8] "File system" goto 0x1FE read-only hex 2 "Signature (55 AA)"endtemplate "Boot Sector NTFS"// To be applied to sector 0 of an NTFS-formatted// logical drive or to the mirror copy of the boot// sector, which will be located near the end of// the partition.description "Boot sector of an NTFS partition"applies_to disksector-alignedrequires 0x00 "EB" // bytes 0 to 2 arerequires 0x02 "90" // JMP instructionrequires 0x03 "4E 54 46 53 20" // ID must be "NTFS"requires 0x1FE "55 AA" // "magic" signaturebegin read-only hex 3 "JMP instruction" //00 char[8] "SystemID" //03 uint16 "Bytes per sector" //0B uint8 "Sectors per cluster" //0D uint16 "Reserved sectors" //0E hex 3 "(always zero)" //10 read-only hex 2 "(unused)" //13 hex 1 "Media descriptor" //15 read-only hex 2 "(unused)" //16 uint16 "Sectors per track" //18 uint16 "Heads" //1A uint32 "Hidden Sectors" //1C read-only hex 4 "(unused)" //20 read-only hex 4 "(always 80 00 80 00)" //24 int64 "Total sectors" //28 int64 "Start C# $MFT" //30 int64 "Start C# $MFTMirr" //38 uint32 "Clust per MFT rec" //40 uint32 "Clust per index block" //44 hex 4 "32-bit serial number (hex)" move -4 hexadecimal uint32 "32-bit SN (hex, reversed)" move -4 hex 8 "64-bit serial number (hex)" uint32 "Checksum" //50 goto 0x1FE //boot load code follows read-only hex 2 "Signature (55 AA)" //1FEend mfc发送http post请求 求助 求一个管理多用户的源码,什么模型都可以! 请问学习windows api 函数有什么好的书籍资料? 如何获得ActiveX控件的窗口句柄? 我动态创建一个列表框,怎么达不到在对话框上用资源编辑器做出来的效果? 谁能介绍几个网站 关于DX8编程编译问题,急急急! 奇怪了,MDIGetActive()竟然出错 才鸟问题:怎么把IDR_MAINFRAME菜单加到CReBar里面去? 一个关于CDaoTableDefInfo的问题 请问如何让工具条一启动就竖直状态悬浮在左边. 关于对话框资源的问题
这个是CSDN上 数据恢复技术(第2版)我有这本书,别人不要了给我了,还没看!!
// To be applied to sector 0 of a FAT32-formatted logical drive.description "BIOS parameter block (BPB) and more"
applies_to disk
sector-alignedrequires 0x02 "90"
requires 0x52 "46 41 54 33 32" // ="FAT32" at offset 52
requires 0x1FE "55 AA"begin
read-only hex 3 "JMP instruction"
char[8] "OEM" section "BIOS Parameter Block"
uint16 "Bytes per sector"
uint8 "Sectors per cluster"
uint16 "Reserved sectors"
uint8 "Number of FATs"
uint16 "Root entries (unused)"
uint16 "Sectors (on small volumes)"
hex 1 "Media descriptor (hex)"
uint16 "Sectors per FAT (small vol.)"
uint16 "Sectors per track"
uint16 "Heads"
uint32 "Hidden sectors"
uint32 "Sectors (on large volumes)"
section "FAT32 Section"
uint32 "Sectors per FAT"
uint16 "Flags"
uint16 "Version"
uint32 "Root dir 1st cluster"
uint16 "FSInfo sector"
uint16 "Backup boot sector"
read-only hex 12 "(Reserved)"
endsection
hex 1 "BIOS drive (hex, HD=8x)"
read-only uint8 (Unused)
hex 1 "Ext. boot signature (29h)"
uint32 "Volume serial number (decimal)"
move -4
hex 4 "Volume serial number (hex)"
char[11] "Volume label"
char[8] "File system"
endsection goto 0x1FE
read-only hex 2 "Signature (55 AA)"
end
template "Boot Sector FAT"// Template by Stefan Fleischmann// Boot sector format for MSDOS 4.0 onwards (incl. Windows 9x)
// To be applied to sector 0 of a FAT12/FAT16-formatted logical drive.description "BIOS parameter block (BPB) and more"
applies_to disk
sector-alignedrequires 0x0 "EB" // JMP instruction will usually be EB xx 90
requires 0x2 "90" // (though older drives may use E9 xx xx)
requires 0x1FE "55 AA"begin
read-only hex 3 "JMP instruction"
char[8] "OEM" section "BIOS Parameter Block"
uint16 "Bytes per sector"
uint8 "Sectors per cluster"
uint16 "Reserved sectors"
uint8 "Number of FATs"
uint16 "Root entries"
uint16 "Sectors (under 32 MB)"
hex 1 "Media descriptor (hex)"
uint16 "Sectors per FAT"
uint16 "Sectors per track"
uint16 "Heads"
uint32 "Hidden sectors"
uint32 "Sectors (over 32 MB)"
endsection hex 1 "BIOS drive (hex, HD=8x)"
read-only uint8 "(Unused)"
hex 1 "Ext. boot signature (29h)"
uint32 "Volume serial number (decimal)"
move -4
hex 4 "Volume serial number (hex)"
char[11] "Volume label"
char[8] "File system" goto 0x1FE
read-only hex 2 "Signature (55 AA)"
end
template "Boot Sector NTFS"// To be applied to sector 0 of an NTFS-formatted
// logical drive or to the mirror copy of the boot
// sector, which will be located near the end of
// the partition.description "Boot sector of an NTFS partition"
applies_to disk
sector-alignedrequires 0x00 "EB" // bytes 0 to 2 are
requires 0x02 "90" // JMP instruction
requires 0x03 "4E 54 46 53 20" // ID must be "NTFS"
requires 0x1FE "55 AA" // "magic" signaturebegin
read-only hex 3 "JMP instruction" //00
char[8] "SystemID" //03
uint16 "Bytes per sector" //0B
uint8 "Sectors per cluster" //0D
uint16 "Reserved sectors" //0E
hex 3 "(always zero)" //10
read-only hex 2 "(unused)" //13
hex 1 "Media descriptor" //15
read-only hex 2 "(unused)" //16
uint16 "Sectors per track" //18
uint16 "Heads" //1A
uint32 "Hidden Sectors" //1C
read-only hex 4 "(unused)" //20
read-only hex 4 "(always 80 00 80 00)" //24
int64 "Total sectors" //28
int64 "Start C# $MFT" //30
int64 "Start C# $MFTMirr" //38
uint32 "Clust per MFT rec" //40
uint32 "Clust per index block" //44
hex 4 "32-bit serial number (hex)"
move -4
hexadecimal uint32 "32-bit SN (hex, reversed)"
move -4
hex 8 "64-bit serial number (hex)"
uint32 "Checksum" //50
goto 0x1FE //boot load code follows
read-only hex 2 "Signature (55 AA)" //1FE
end