Добавил:
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa Опубликованный материал нарушает ваши авторские права? Сообщите нам.
Вуз: Предмет: Файл:
4-1 Основи цифрової криміналістики / лк / lecture 2. Windows File System. FAT.pptx
Скачиваний:
122
Добавлен:
02.02.2021
Размер:
1.67 Mб
Скачать

The Boot Sector

offset

meaning

content

length

 

+004hex

OEM (original equipment manufacturer) -Name

8 bytes

10

BIOS-Parameter-Block (BPB)

11

The Boot Sector

offset

meaning

content

length

+00Bhex

bytes per sector (512)

 

2 bytes

12

The Boot Sector

offset

meaning

content

length

+00D hex

sectors per cluster

 

1 byte

13

The Boot Sector

offset

meaning

content

length

+00E hex

number of reserved sectors

2 bytes

14

The Boot Sector

offset

meaning

content

length

+010 hex

number of FAT-Copies

 

1 byte

15

The Boot Sector

offset

meaning

content

length

+011 hex

number of root-entries

2 bytes

 

for FAT 32 empty, no

limit (0)

 

16

The Boot Sector

offset

meaning

content

length

+013 hex

number of sectors per track

2 bytes

 

for bigger track the field at

 

 

 

Offset 0x020 contains the number

 

17

The Boot Sector

offset

meaning

content

length

+015 hex

media-descriptor (F8 – HDD, F0 – FD)

1 byte

18

The Boot Sector

offset

meaning

content

length

+016 hex

number of sectors for one FAT

2 bytes

--only for FAT 12 und FAT 16--

for FAT 32 the field at offset 0x024 contains the number

0FB9(hex)=4025

19

20