“计算机检测维修与数据恢复”赛项竞赛FAT32文件系统.docx

资源描述

FAT32文件系统介绍 MBRMBR (Master Boot Record)是硬盘的主引导记录；作用是计算机在按下电源键以后，开始 000000000 33 C0 8E DO BC 00 7C FB 50 07 50 IF FC BE IB 7C 3AIDM |uP P | 000000010 BF IB 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 Bl 04 C PW3 6HE^ + 000000020 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5 8n | u lA adl Io 000000030 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B 14 It 8,to p ' 1 000000040 F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88 di< tu» I edl 000000050 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B N eF s*pF P t 000000060 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83 『t ， uOIF 1 000000070 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB F IV e! s H e 000000080 BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0 Ml 冲｝U缸 r tE 000000090 B7 07 EB A9 8B FC IE 57 8B F5 CB BF 05 00 8A 56 - e@lu WIoEi IV 0000000A0 00 B4 08 CD 13 72 23 8A Cl 24 3F 98 8A DE 8A FC • I r#IA$?llklu 0000000B0 43 F7 E3 8B DI 86 D6 Bl 06 D2 EE 42 F7 E2 39 56 C-SINIO+ 6fBz9V 0000000C0 0A 77 23 72 05 39 46 08 73 IC B8 01 02 BB 00 7C w#r 9F s , » | 0000000D0 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A IN IV I sQ0tN2al 0000000E0 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD V I ealV '》aU'Ai 0000000F0 13 72 36 81 FB 55 AA 75 30 F6 Cl 01 74 2B 61 60 r6luU^u0dA t+a' 000000100 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A j j yv yv j h |j 000000110 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B j Blot aas Ot 000000120 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61 2alV I ebaiiAInva 000000130 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61 lid partition ta 000000140 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E ble Error loadm 000000150 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 g operating syst 000000160 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61 em Missing opera 000000170 74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00 ting system 000000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000001B0 00 00 00 00 00 00 00 00 31 89 3D 8F 00 00 80 01 11 = 1 1 0000001C0 01 00 07 FE FF FF 3F 00 00 00 41 7C FC 06 00 00 丽？ A|u 0000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 oo||55 AA U9 执行主板的BIOS程序，进行完一系列检测和配置以后，开始按CMOS中设定的系统引导顺序进行引导。存放位置是硬盘的0柱面、0磁头、1扇区，一共512字节，主引导程序占扇区的446字节为第一局部，作用是引导系统，分区表占扇区的64字节为第二局部，作用是用于管理硬盘的分区，结束标识55AA占扇区两个字节为第三局部，作用是用「判断该引导扇区的合法性！ MBR扇区结构 Master Boot Record(446字节) 分区信息1（16字节）分区信息2（16字节）分区信息3（16字节）分区信息4 （16字节）55AA FAT32—DBR 跳转指令' 0 1 2 3 4 5 6 78 9 A B C__ -E— fOBM代号 0291E000(T ■EB 58 90 ||4D 53 57 49 4E 34 2E 311 00 02 08 20 00 eX MSWIN4.1 0291E0010 02 00 00 00 00 F8 00 00 3F 00 FF 00 00 8F 14 00 0 ? y 0291E0020 F4 54 D2 00 8C 34 00 00 00 00 00 00 02 00 00 00 6To 14 0291E0030 01 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 -BPB 块 0291E0040 80 01 29 00 00 00 00 4E 4F 20 4E 41 4D 45 20 20 1 )NO NAME 0291E0050 20 20 46 41 54 33 32 20 20 20 30 00 00 00 00 00 FAT32 0291E0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E00A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E00B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E00C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E00D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E00E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E00F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 -弓1导柠科 0291E0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 JI 0291E0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E0140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E0150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E0160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E0170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E0180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E0190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E01A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E01B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E01C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E01D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E01E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0291E01F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA- 结束标识uz FAT32-DBR 中 BPB 解析字节偏移字段长度（字节）字段内容及含义 OxOB 2 每扇区字节数 OxOD 1 每簇扇区数 OxOE 2 DOS保存扇区数 0x10 1 FAT表个数 Oxll 2 未用 0x13 2 未用 0x15 1 介质描述符（十六进制） 0x16 2 未用 0x18 2 每磁道扇区数 0x1 A 2 磁头数 OxlC 4 隐藏扇区 0x20 4 该分区的扇区总数 0x24 4 每FAT扇区数 0x28 2 标记 0x2A 2 版本 Ox2C 4 根目录首簇号 0x30 2 文件系统信息扇区号 0x32 2 DBR备份扇区号 0x34 12 保存 0x40 1 BIOS卵动器号 0x41 1 未用 0x42 1 扩展引导标记 0x43 4 卷序列号 0x47 11 卷标 0x52 8 文件系统类型 NTFS—EBR Offset 0 1 2 3 4 5 6 7 8 9 A B c D E F / I 0C80730000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 I 0C80730030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730040 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C807300A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C807300B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C807300C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C807300D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C807300E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C807300F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730140 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730150 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730160 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730170 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 分区表 0C80730180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C80730190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 / 0C807301A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 / 0C807301B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 匕 0C807301C0 Cl FF 07 FE FF FF 3F 00 00 00 E4 6A 60 11 00 00 Ay Byy? aj 0C807301D0 Cl FF 05 FE FF FF 23 6B 60 11 23 6B 60 11 00 00 Ay bvv*k' #k' 0C807301E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^结束标识 0C807301F0 00 00 00 00 00 00 00 00 00 00 00 00 00 oo||55 AA Kus 由于MBR仅仅为分区表保存了 64字节的存储空间，然而硬盘最多只能分出4个逻辑磁盘。因为4个往往不能满足需求，为了需求引入扩展分区的概念。所谓扩展分区，严格地讲它不是一个实际意义的分区，它仅仅是一个指向下一个用来定义分区的参数指针，这种指针结构形成一个单向链表。这样在主引导扇区中除了主磁盘分区外，仅需要存储一个被称为扩展分区的分区信息，通过这个扩展分区的信息就可以找到下一个分区的起始位置，以此类推就可以找到所有的分区。扩展分区中的每个逻辑驱动港的分区信息都存在一个类似于MBR的扩展引导记录(Extended Boot Record, EBR)中，扩展引导记录包括分区表和结束标识 “55 AA” EBR中分区表的第一项描述第一个逻辑驱动器，第二项指向下一个逻辑驱动器的EBR如果不存在下一个逻辑驱动器，第二项就不需要使用如下列图! 扩展分区结构图主扩展分区 EBR1的分区表分区表项1 分区表项2 逻辑驱动器1 子扩展分区1 EBR2的分区表分区表项1 分区表项2 逻辑驱动器2 子扩展分区2 EBR3的分区表分区表项1 分区表项2 逻辑驱动器3 FAT表 FAT32文件系统由DBR及其保存扇区，FAT1, FAT2和DATA四个局部组成，其机构如下列图： ① ① © DATA DBR及其保帝扇区 DBR及其保存扇区：DBR的含义是DOS引导记录，也称为操作系统引导记录，在DBR之后往往会有一些保存扇区。 FAT1： FAT的含义是文件分配表，FAT32 一般有两份FAT, FAT1是第一份，也是主FAT。FAT2： FAT2是FAT32的第二份文件分配表，也是FAT 1的备份。但不是备份主要的FAT1,而是备份前4个簇。 DATA： DATA也就是数据区，是FAT32文件系统的主要区域，其中包含目录区域。 FAT表结构及作用 1、FAT32文件一般有两份FAT,他们由格式化程序在对分区进行格式化时创立，FAT1是主，FAT2是备份。 2、FAT1跟在DBR之后，其具体地址由DBR的BPB参数中指定，FAT2跟在FAT1的后面。 3、FAT表由FAT表项构成，我们把FAT表项简称FAT项，每个FAT项占用4字节。 4、每个FAT项都有一个固定的编号，这个编号从0开始。 5、FAT表项的前两个FAT项为文件系统保存使用，0号FAT为介质类型, 1号FAT为文件系统错误标志。 6、分区的数据区中每个簇都会映射到FAT表中的唯一一个FAT项，因为0 号FAT和1号FAT被系统占用，用户的数据从2号FAT开始记录。 7、如果某个文件占用很多个簇，那么第一个FAT项记录下一个FAT项的编号（既簇号），如果这个文件结束了，那么用“OFFFFFFF”表示。 8、分区格式化后，用户文件以簇为单位存放在数据区中，一个文件至少占用一个簇。 9、FAT的主要作用是标明分区存储的介质以及簇的使用情况。如何定位FAT1： 1、首先从MBR的分区表中得知分区的起始扇区，偏移到此扇区。 2、从DBR的BPB中得知DBR的保存扇区数，FAT表的个数，FAT表的大小。 3、因此FAT1二分区起始扇区+DBR保存扇区，FAT2二分区起始扇区+DBR保留扇区+FAT1。 FAT1表结构图: Offset 00004800 00004810 00004820 00004830 00004840 00004850 00004860 00004870 叫表项1号表项2号表项3号表项 [0注2 3 44A B C D，E F /」耳」 |F8 FF FF OFlFF加印 Ffl 而即 FF 0肚0 00 00 期?， 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00004880 00004890 000048A0 000048B0 000048C0 A/SAA A CTX 八 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 AA AA A A /SA AA AA A A A A 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 AA AA AA AA AA AA AA AA 每个FAT项是由32位二进制值构成。每个FAT项都有一个固定的编号，这个编号从0开始，第一个FAT项为。号FAT项，第二个FAT项为1号FAT项，以此类推。FAT表的前两个FAT项有专门的用途：0号FAT项通常标识分区所在的戒子类型，“F8”表示硬盘的戒子类型为硬盘；1号FAT项用来存储文件系统的标志，说明文件系统被非法卸载或者是磁盘外表存在错误。分区的数据区中的每一个簇都会映射到FAT表中一个唯一的FAT项。通过FAT项的取值范围，可以看到所对应的簇的状态。 FAT表项中簇的状态 FAT项值（32位）含义 00000000H 未使用的簇 00000002H 〜FFFFFFEFH 已分配的簇 FFFFFFFOH~FFFFFFF6H 保存 FFFFFFF7H 坏簇 FFFFFFF8H~FFFFFFFFH EOF文件结束簇

展开阅读全文