Win2000 disk editing (2)

One of the disk editing operations is for the master boot record, this time describes the operation for the partition table.

First, the background knowledge of the partition and partition table:

The partition table storage location after the master boot record in the 512 bytes of the 0 cylinder 0 plane 1 sector of the hard disk, The starting position of the partition table information stored in the main boot sector is fixed, and is continuously stored from the 2BEH of the sector. The record information of one partition occupies a total of 16 bytes, and the partition table until the countdown to the sector The third byte ends (including the third byte of the last). A total of 64 bytes, so a hard disk can be divided into up to 4 partitions. In practice, if the number of partitions is less than 4, the partition record location partition command program that is not used can be automatically filled with 0.

The meaning of these 16 bytes in each partition record is as follows: (indicated by the partition table address offset)

Offset meaning record length (bytes)
00H Boot indicator 1
01H Partition boot record head number 1
02H Partition boot record sector number 1
03H Partition boot record cylinder number 1
04H System indicator 1
05H Partition end head No. 1
06H Partition end sector number 1
07H Partition end cylinder number 1
08H Total number of sectors in front of partition 4
0CH Number of sectors allocated to partition 4

The boot indicator in the table refers to whether the partition can be booted. If it is 80H, it is bootable. If it is 00H, it is not bootable. In the process of using FDISK, there is an operation to activate the partition. The essence is to write the byte. It is 80H. The system indicator indicates which partition format the partition belongs to, and 01H indicates FAT16.

Since each partition can be divided into logical drives, the essence of activation is which logical drive is activated. For example, many machines divide a physical hard disk of about 10G into two partitions, then divide the first partition into two logical drives C and D, and activate the logical drive C to be bootable. Pay special attention to this step: Logical drive D can no longer be activated. If you want to install two operating systems, you must first partition the logical drive in the second partition and then activate one of the logical drives in the partition.

The main operations that can be performed on the hard disk partition table are: a. How to read and save the partition table information when the hard disk status is intact? b. How to replace the damaged partition table with the backup partition table after the partition table fails? c. If there is no backup of the available partition table, how to manually rebuild the partition table information? Among them, the most difficult, of course, the most technically required is to manually rebuild the partition table.

In the help documentation, it is clearly stated that DiskProbe does not support FAT32, so DiskProbe cannot operate on FAT32 partition tables. From this point of view, its function is quite limited. However, I have found out before that some of the tools described in the help documentation do have different functions from the actual ones, so you can't take the statement in the help documentation too seriously, but because I don't use the FAT32 partition method on my own machine. There is no experiment for FAT32. If you have a FAT32 hard drive, you can experiment it yourself.

In the step of resolving the partition table failure, the first step is to read and check the partition table information in the master boot record. This part describes:

Second, the method of obtaining partition table information

Whether it is to backup the partition table or just look at it, you need to get the partition table information first, the steps are:

1. Execute the program: DiskProbe
2. In the menu Drives, click on the mouse: Physical Drive.
3. In the dialog box of the menu Open Physical Drive, double-click the one you want to display the partition table. Drive name. For example: Physical Drive 0
4. In the Open Physical Drive dialog box in the Handle 0 range, click Set Active, then click OK.
5. In the Sectors section of the menu, click Read. .
6. In the Read Sectors dialog box that appears, enter the starting sector and sector number to be read. That is, the Starting Sector is filled with 0, and the Number of Sectors is filled with 1, the actual two. The number is also the default. Then click Read to read the sector information.
The above six steps are actually reading the main boot record sector;

7. In the View menu, click Partition table. Dialog box for displaying partition table information immediately

8. To double-click the number of the partition table in the list box of Partition table index, the corresponding partition table information in the figure will change automatically. It can also be seen from the figure that the partition table information corresponds to the above table, including: partition start head number and partition end head number; partition start sector number and partition end sector number; partition start cylinder number And the end of the cylinder number;

9. It should be said that the partition table should be saved as a file, but since only the area is 64 bytes, and the main boot record coexists in the same sector, generally Save it to the same file along with the master boot record.
10. If you use the debug tool that you will use dos, you can write an assembler that reads the contents of this sector and prints it by copying the screen. You can save the contents of the main boot sector on paper. For the purpose of analysis and reference. Due to the use of assembly language, this method has limited limitations and all windows9.x series or dos are available. Type under DOS: Debug Enter
(The following code is manually entered, note that spaces cannot be omitted)
-a0
mov ax 201
mov bx 100
mov cx 1
mov dx 80
int 13
int 3
-g=0

Then use the command: -d100 to display the content. When the printer is online, press the PrintScreen button on the keyboard to display the screen. The content displayed at the time was completely printed on paper. But I have not tested whether this method is available under the NTFS partition.

Some friends may have such a question: Windows 2000 is a system with very high security requirements. Instead of using a password, the INT13 interrupt is called in the assembly to directly read the main boot sector. Will it succeed or affect security? This kind of worry is superfluous, because security is for the operating system and files running on the operating system, and the main boot sector does not belong to any operating system, that is, when the machine is executing the master boot record code, The operating system has not yet been built in memory, everything has not yet appeared, of course it is safe. Therefore, this does not contradict the security of the data file.

Third, how to use the backup partition table (or the main boot sector information) to recover the damaged partition table:

1. First execute the program: DiskProbe.
2. In the menu In Drives, click on the mouse: Physical Drive.
3. In the dialog box of the Open Physical Drive menu, double-click the name of the drive you are going to repair the partition table. For example: Physical Drive 0
4. In the Open Physical Drive dialog box in the Handle 0 range, click Set Active, then click OK.
5. In the Sectors section of the menu, click Read.
6. In the Read Sectors dialog box that appears, enter the starting sector and sector number to be read, that is, the Starting Sector is filled with 0, and the Number of Sectors is filled with 1, the actual two numbers. It is also the default. Then click Read to read the sector information.
7. In the View menu, click Partition table. Display the current partition table information
8. In the list box of Partition table index, double-click the number of the partition table to be repaired. When selected, the lower part of the dialog box immediately displays the corresponding partition table information. (The information is definitely not the value before the repair). The above operations are similar to reading the partition table and even reading the master boot record, but the following are more important:
9. Fill in the new values ​​in the parameters in the dialog box. These new values ​​should be obtained after checking the backup partition table information file. Of course, it can also be directly converted from the backup partition table file to partition information. If you do not want to use the dialog form when editing, you can convert the display to byte form by the method described above. In the byte form, only the selected partition information is displayed, and other parts (including the master boot record) are 0.
10. In the Sectors menu, mouse click: Write.
11. The Write Sector dialog box will appear, select 0 in the Starting sector of the starting sector, and then click Write it save.

12. Click Yes, and the operation of overwriting the original data is completed.

Fourth, manually rebuild the partition table

This method requires the user to be very familiar with the partition structure, preferably the hard disk partition is less, the partition situation is relatively simple. If the partition is large and complicated, it is too difficult. Even in simple cases, don't use this method as a last resort.

It is difficult to manually create a partition table in the calculation of partition data. The data that needs to be known before calculation is: the number of cylinders of the hard disk, the number of heads, and the number of sectors per track. These data can be easily found on the hard disk label.

First, because the 0 cylinder 0 head (face) 1 sector does not belong to any partition and is hidden, the first partition should start from 0 cylinder 1 head 1 sector. Today's hard disks are relatively large. Commonly, 63 sectors per track, each sector is 512 bytes, and the number of cylinders and the number of heads vary with the capacity of the hard disk. When calculating, the capacity is first selected, and the sector number, head number, and cylinder number at the end of the first partition are derived based on the required capacity. The last value to be filled is converted to hexadecimal. Immediately adjacent to the previous end position is the starting position of the second partition, and so on, until the end. The number of heads can be understood as equal to the number of magnetic faces, and the number of cylinders can be understood as the number of tracks that can be divided on one magnetic face. Thus, the capacity of a magnetic face is 512 * 63 (sector) * the number of cylinders. For example, the first partition needs to use the first 125 magnetic faces (or heads), and the next partition must start from the 126th magnetic face (or head). Then the capacity is =512*63*125* cylinder number. The calculation of the number of cylinders in the sector is similar to this. For more detailed calculations, please refer to the relevant information. The calculated data is filled in the partition table, and its operation is the same as above.

V. Attention to problems

1. The above is not so much a manual reconstruction of the partition, it is better to manually create a new partition. The danger is great. And did not test for NTFS.
2. If the original partition is restored, manual rebuild is not recommended, because the original data will be lost once the wrong partition table is entered.
3. The calculation must convert the result to hexadecimal, you can use the calculator in the attached file. (set to function type).