Project 4 - Disk Structure Analysis
DAT 2343 - Winter 2000
Synopsis
This Project has you use DEBUG to analyse the structure of a
specially-formatted FAT12-style diskette. You are to locate some deleted
subdirectories and files, trace their location on disk, and ultimately find
the contents of the first data block of a deleted file located inside a
deleted subdirectory.
Preparation
| For this project you will need to use the same diskette that was
reformatted and returned to you from your handed-in Project 3. (If you did
not hand in Project 3, you must provide a diskette to the instructor that
will be reformatted and have some files loaded on it.) |
| Write protect the disk before you begin your analysis. Since
you are analysing deleted file structures, anything you write to this
diskette will over-write and damage the information for which you are
looking. |
| Shut down Windows. Completely. Use "pure" MS-DOS
for this assignment. You (probably) can't decode these disks if
Windows is running. You must restart your computer in "pure"
MS-DOS mode. (If you try using DEBUG to read these disks under some
versions of Windows, you will get fatal disk errors: Abort, Retry, Fail?)
Do not use a DOS window inside Windows. |
Project Steps
- Write protect your disk. Shut down Windows and start up your
computer in MS-DOS mode. (Using an MS-DOS window under Windows
probably won't work.)
- Use DEBUG to load a copy of the boot sector from your floppy disk into
memory. Display at least the first 20h bytes of the boot sector
and either save a copy of this dump to a file (using output redirection on the MS-DOS
command line) or print a copy of the screen directly (using Print Screen).
If you choose to save to a file, you will need to print this file (using a Courier or Terminal fixed-width font) at the
end of the project.
- Based on the values supplied by the DEBUG dump, provide the following
information in both hexadecimal and decimal (giving two numbers for each of
the five values):
Boot Sector Dump Value |
Hexadecimal |
Decimal |
the number of sectors per file allocation unit (cluster) |
|
|
the number of root directory entries |
|
|
the number of copies of the FAT |
|
|
the number of sectors used by each copy of the FAT |
|
|
the number of sectors per track |
|
|
Calculate the absolute disk sector number of the first sector of the root
directory.
| Show clearly how you used the Boot Sector Dump information to
calculate this value. |
| Give the absolute sector value in both hexadecimal and decimal (two
numbers).
|
Using the absolute disk sector number that you just calculated, load the
first sector of the root directory into memory. (Remember to use
only hexadecimal numbers in your commands to DEBUG!) Your DEBUG dump
will show that this root directory once contained many odd file names, as
well as holding the entries for the few not-deleted files you can still see
left on your diskette (including the README file).
| Display enough of this root directory to locate the entry for the
deleted subdirectory named "Project Four Directory".
This name is the Windows95 long name of this subdirectory; ignore the
long name entries. You will have to locate its corresponding
MS-DOS short name. |
| Save the DEBUG output showing this complete deleted directory entry to
a file, or print your screen directly.
|
Examine the dump of the root directory entry of this deleted "Project
Four Directory" subdirectory:
| From the dump, determine the starting cluster number of this
"Project Four Directory" subdirectory. Give the cluster
number in both hexadecimal and decimal (two numbers). |
| Using that cluster number, determine the absolute disk sector number
of the first sector of the "Project Four Directory"
subdirectory itself. |
| Show clearly how you used the Boot Sector Dump information and the
subdirectory's cluster number to calculate this absolute sector number. |
| Give this absolute sector number for the "Project Four
Directory" subdirectory in both hexadecimal and decimal.
|
Using the absolute disk sector number you just calculated, load the first
sector of the deleted "Project Four Directory" subdirectory into
memory.
| Save the DEBUG output showing the contents of this subdirectory to a
file, or print your screen directly. Note that the dump shows that
this deleted subdirectory only contains deleted files. |
| In the dump of this subdirectory, locate the deleted file that was
called "Find This File". This name is the Windows95 long
name of this file; ignore the long name entries. You will have to
locate its corresponding MS-DOS short name. |
| Calculate, using information in this subdirectory entry, the starting
cluster number and then the absolute disk sector number of the first
sector of this deleted file named "Find This File". |
| Show clearly how you used the Boot Sector Dump information and the
file's cluster numbers to calculate this absolute start sector number. |
| Give this absolute sector number for the "Find This File"
file in both hexadecimal and decimal.
|
Using the absolute disk sector number you just calculated, load the first
sector of the "Find This File" file into memory.
| Save the DEBUG output showing at least 20h bytes of the contents of
this sector to a file, or print your screen directly. |
| You will recognize that you have found the right sector, because the
ASCII dump will show the word "BINGO!" followed by your disk
serial number as the first strings of the sector.
|
Using the disk geometry of your encoded floppy disk, calculate the
location on disk in terms of Cylinder, Head (also known as side or surface),
and track-Sector numbers (C/H/S) of absolute disk sector 84h.
Express the numbers in C/H/S in decimal, not hexadecimal.
| Show clearly how you used the Boot Sector Dump information and the
absolute sector number 84h to calculate this
C/H/S location. |
| Is the sector 84h located on the top side of your floppy disk
or on the bottom side?
|
BONUS: Calculate the location on disk of the beginning of file
"Find This File" in terms of C/H/S. Express the numbers in
C/H/S in decimal, not hexadecimal.
| Show clearly how you used the Boot Sector Dump information and the
file's absolute sector number to calculate this
C/H/S location. |
| Was the first sector of the "Find This File" file located on
the top side of your floppy disk or on the bottom side? |
Hand In
| Please pay attention to the required DEBUG output dumps for various
steps, above. You may wish to review how to do DEBUG dumps using output redirection on the MS-DOS
command line. |
| The print-outs and calculations of this project on paper must be
delivered to the instructor (or under his office door at WB222B) no later
than (Day Section 030:) 3:30pm, Wednesday April 19, 2000; or (Night
Section 521:) 9:00pm, Tuesday May 2, 2000.. No late
assignments can be accepted. (The term is over!) I will
post an announcement when the assignments have been marked and may be
picked up before the final exam. Questions can be posted to the course
news group and I'll answer them there up to the final exam.
(After the exam, you're on your own!) |
| Submit only clearly printed calculations on paper, in a format adhering
to my usual assignment
guidelines. |
| No diskettes! Keep your encoded floppy as a souvenir. |
| Make sure you reformat your encoded floppy before you try
to re-use it for other data storage! |
|