Chapter – 16
Developing more Utilities for Disks
Introduction
In this chapter we shall discuss, how to use the information of MBR, DBR, FAT and Root Directories to develop utility programs which may help us in managing the data, in optimizing the storage or in may disk troubleshooting tasks.
Usually, these programs are solution to some specific problem. Some utility programs and their programming have been discussed in this chapter.
Hiding Partitions
Generally, the partition hiding utility is used by those users who work on such computer system which is used by users. If there are many users for same the computer, there may be a great possibility, that data of another user may be read, stolen, or deleted.
In such case, where user has some important data or some confidential information in the same computer, he may be willing to hide the partition in which he has his data in such a way that the partition should not be accessed by the Operating system, so that the may not be accessed by other user.
When the user wants to work on the system, he can access the partition back, just by unhiding the partition. Generally these types of events take place in the professional institutions, where the computers are used by many students but senior students are always worried about their important data or project work. As in lack of knowledge, the new student may harm or even delete their data.
How the partition becomes hidden
The following table represents the format of partition in partition table of MBR:
Offset |
Meaning |
Size |
Description |
00H |
Boot Type Indicator Byte |
1 Byte |
If Byte is 00H, the Partition is Inactive and if Byte is 80H, The Partition is Active (or Bootable) |
01H |
Head Number of Beginning of the Partition |
1 Byte |
Starting Head number of the Partition in Hexadecimal System |
02H |
Sector and Cylinder Number of Beginning of the Partition |
2 Bytes |
6 Bits of First Byte make Starting Sector Number and Combination of remaining 2 Bits (as Two Most Significant Bits) plus 8 Bits of another Byte (Rest 8 least Significant Bits of the 10-Bit Number ) make the Starting Cylinder Number of the Partition |
04H |
File System indicator Byte |
1 Byte |
File System Indicator Byte in Hexadecimal system (for complete list of partition indicator bytes, refer the chapter “Logical Approach to Disks and OS” discussed earlier in this book) |
05H |
Head Number of End of the Partition |
1 Byte |
Ending Head Number of the Partition in Hexadecimal System |
06H |
Sector and Cylinder Number of End of the Partition |
2 Bytes |
6 Bits of First Byte make Ending Sector Number and Combination of remaining 2 Bits (as Two Most Significant Bits) plus 8 Bits of another Byte (Rest 8 least Significant Bits of the 10-Bit Number ) make the Ending Cylinder Number of the Partition |
08H |
Absolute Sector number of Beginning of the Partition |
4 Bytes |
Number of Sectors Between the MBR and the First Sector in the Partition |
0CH |
Absolute Sector number of End of the Partition |
4 Bytes |
Number of Sectors in the Partition |
Total = 16 Bytes |
At the offset 04H, in every partition entry, there is a file system indicator byte. This indicator byte represents the type of file system of that partition. If the value of this byte is changed, the identity of the partition is changed.
For example, the value of partition indicator byte for “DOS 12-Bit FAT” is 0x01. If this value is changed to 0x11, The identity of file system in the partition table entry is changed to “Hidden DOS 12-Bit FAT” (for complete list of partition indicator bytes, refer the chapter “Logical Approach to Disks and OS” discussed earlier in this book).
The table given next shows some more examples of file system indicator byte for some partition types:
Partition type indicator Byte |
Description of File System of Partition |
0x01 |
DOS 12–bit FAT |
0x11 |
Hidden DOS 12–bit FAT |
0x04 |
DOS 16–bit FAT (<=32MB) |
0x14 |
Hidden DOS 16–bit FAT (<=32MB) |
0x05 |
DOS Extended |
0x15 |
Hidden DOS Extended |
0x06 |
DOS 16–bit big (> 32MB) |
0x16 |
Hidden DOS 16–bit big (> 32MB) |
0x07 |
NTFS |
0x17 |
Hidden NTFS |
0x0B |
Windows FAT32 |
0x1B |
Hidden Windows FAT32 |
0x0C |
Windows FAT32 (LBA) |
0x1C |
Hidden Windows FAT32 (LBA) |
0x0E |
Windows FAT16 (LBA) |
0x1E |
Hidden Windows FAT16 (LBA) |
0x0F |
Windows Extended |
0x1F |
Hidden Windows Extended |
Here we see that the corresponding hidden partition for any file system is found by adding the value 0x10 to its system indicator byte.
Although it is not the hard and fast rule for hiding the partition yet it works even for most of the file system. The reason behind it is that when we change the value of partition indicator byte, the identity of file system in the partition table entry is changed. And it is very rare that the new file system is also supported by the same operating system.
| |
page 1 | 2 | 3 | 4 | 5 | 6 |
|
 |
|
