One solution -- Homework 2 The first task is to find the location of the FAT (file allocation table) and root directory entries. A fairly thorough reading of the Microsoft FAT32 document would reveal that a 1474560-byte file system should be a FAT12 format. Consequently, only one sector would be used as the BPB Reserved Sector. So, you'd know the first FAT must start at sector one. Dividing 1474560 by the sector size gives 2880 sectors for the "disk". Then about 4320, or 2880*1.5, bytes would be required for FAT. That's 9 sectors. And, the document tells us that there will be two copies of the FAT. That means that the root entries will be stored in sector 19. The document also tells us to expect 224 root entries, though we really don't need this information to solve the problem. However, that's too easy. If you wanted to actually look at the fields, first you could use dd to copy off the first sector: bash-3.00$ dd if=floppy.image of=sect.0 bs=512 count=1 1+0 records in 1+0 records out Then you could go to bytes 14-15 to determine the BPB Reserved Sector Count. bash-3.00$ od -Ad -j 14 -N 2 -t d2 sect.0 0000014 1 0000016 Then to byte 16 to get the number of FATs. bash-3.00$ od -Ad -j 16 -N 1 -t d1 sect.0 0000016 2 0000017 Now on to bytes 22-23 to get the FAT size. bash-3.00$ od -Ad -j 22 -N 2 -t d2 sect.0 0000022 9 0000024 Now let's determine the number of root entries bash-3.00$ od -Ad -j 17 -N 2 -t d2 sect.0 0000017 224 0000019 Yep, it's the same 1, 2, 9, and 224 described in the document. Our second task is to find the correct root entry. We start by using dd to copy the root entry directory. bash-3.00$ dd if=floppy.image of=rootdir.image bs=512 skip=19 count=14 14+0 records in 14+0 records out You could use od to print out the name entries one at a time, but it's quicker just to print out an entire sectors in ASCII and look for COMMAND.COM . Here's the first sector: bash-3.00$ od -Ad -j 0 -N 512 -t a rootdir.image 0000000 e O sp sp sp sp sp sp S Y S sp nul enq n l 0000016 bel * ) * nul nul 9 p esc * stx nul nul H soh nul 0000032 e U T O E X E C B A T sp nul $ p l 0000048 bel * bel * nul nul nul bs H ( f nul e eot nul nul ....... many entries deleted 0000480 e L A S H P T sp S Y S sp nul sub { l 0000496 bel * bel * nul nul nul bs H ( X stx ) { nul nul 0000512 COMMAND.COM is *not* there. Try the second one: bash-3.00$ od -Ad -j 512 -N 512 -t a rootdir.image 0000512 e X T R A C T sp E X E sp nul & | l 0000528 bel * esc * nul nul nul bs H ( V etx bel R nul nul 0000544 e D I S K sp sp sp E X E sp nul @ nul m 0000560 bel * esc * nul nul nul bs H ( @ etx ff stx soh nul 0000576 e O M M A N D sp C O M sp nul gs stx m 0000592 bel * bel * nul nul nul bs H ( B eot p k soh nul ....... many entries deleted 0001024 Don't be fooled by the entry at byte 576. It doesn't start with 'C'. Actually, it's a deleted entry. Third time is a charm: bash-3.00$ od -Ad -j 1024 -N 512 -t a rootdir.image 0001024 K E Y B O A R D S Y S sp nul p sub p 0001040 ) * ) * nul nul nul bs H ( j stx ack bel nul nul ....... some entries delete 0001152 M O D E sp sp sp sp C O M sp nul + " p 0001168 ) * ) * nul nul nul bs H ( E etx 7 r nul nul 0001184 C O M M A N D sp C O M sp nul so # p 0001200 ) * ) * nul nul nul bs H ( del etx p k soh nul ....... some entries delete 0001344 nul nul nul nul nul nul nul nul nul nul nul nul nul nul nul nul * 0001536 There it is at byte 1184. The address of the first cluster is stoped 16 bytes into the directory entry. 1184+16 is 1210. bash-3.00$ od -Ad -j 1210 -N 2 -t d2 rootdir.image 0001210 895 0001212 The number of the first cluster is 895. Also, remember that clusters and sectors are the same size for a FAT12 volume. Finally to find the cluster. Start by reading the FAT: bash-3.00$ dd if=floppy.image of=fat.image bs=512 skip=1 count=9 9+0 records in 9+0 records out The document gives us a formula for finding the byte offset within the FAT for cluster 895. It's 895+(892/2), or 1342. Read the two bytes at 1342. You'll need to read them in HEX in order to extract the 12 bits cluster number from the 16 bits of the two bytes: bash-3.00$ od -Ad -j 1342 -N 2 -t x2 fat.image 0001342 380f 0001344 Because 895 is odd, the first three hex digits, or 380, is the address of the next cluster. Hex 380 is decimal 896. That looks very promising since 896 is one more than 895. Now look at the entry for 896. First compute 896+(892/2). That's 1344 and that's expected because it's two more than 1342. bash-3.00$ od -Ad -j 1344 -N 2 -t x2 fat.image 0001344 2381 0001346 Since 896 is even, we're interested in the last three hex digits. That's hex 381 and decimal 897. If you continue like this, you'll see that the first 10 clusters of the file are consequetive clutsters that start at sector 895. That's the end of the assignment, but supposed you wanted to determine if *all* the sectors of the file were really consequetive. Then you'd first need to determine the file size. It's 93,040. You can get that from directory entry for COMMAND.COM: bash-3.00$ od -Ad -j 1212 -N 4 -t d4 rootdir.image 0001212 93040 0001216 That means the file requires (93040+511)/512, or 182, sectors. Let's go ahead and print out the 288 bytes of the FAT table starting at byte 1341, the location of the first entry: bash-3.00$ od -Ad -j 1341 -N 288 -t x1 fat.image 0001341 ff 0f 38 81 23 38 83 43 38 85 63 38 87 83 38 89 0001357 a3 38 8b c3 38 8d e3 38 8f 03 39 91 23 39 93 43 0001373 39 95 63 39 97 83 39 99 a3 39 9b c3 39 9d e3 39 0001389 9f 03 3a a1 23 3a a3 43 3a a5 63 3a a7 83 3a a9 0001405 a3 3a ab c3 3a ad e3 3a af 03 3b b1 23 3b b3 43 0001421 3b b5 63 3b b7 83 3b b9 a3 3b bb c3 3b bd e3 3b 0001437 bf 03 3c c1 23 3c c3 43 3c c5 63 3c c7 83 3c c9 0001453 a3 3c cb c3 3c cd e3 3c cf 03 3d d1 23 3d d3 43 0001469 3d d5 63 3d d7 83 3d d9 a3 3d db c3 3d dd e3 3d 0001485 df 03 3e e1 23 3e e3 43 3e e5 63 3e e7 83 3e e9 0001501 a3 3e eb c3 3e ed e3 3e ef 03 3f f1 23 3f f3 43 0001517 3f f5 63 3f f7 83 3f f9 a3 3f fb c3 3f fd e3 3f 0001533 ff 03 40 01 24 40 03 44 40 05 64 40 07 84 40 09 0001549 a4 40 0b c4 40 0d e4 40 0f 04 41 11 24 41 13 44 0001565 41 15 64 41 17 84 41 19 a4 41 1b c4 41 1d e4 41 0001581 1f 04 42 21 24 42 23 44 42 25 64 42 27 84 42 29 0001597 a4 42 2b c4 42 2d e4 42 2f 04 43 31 24 43 33 44 0001613 43 ff 6f 43 37 84 43 39 a4 43 3b c4 43 3d e4 43 0001629 The remaining two steps were done with emacs keystroke macros. This is *not* programming or scripting. It's just a way to easily repeat a sequence of commands. First, use a keystroke macro to break the FAT entries into groups of three bytes, or six hex digits: 0001341 ff0f38 812338 834338 856338 878338 89a338 8bc338 8de338 8f0339 912339 934339 956339 978339 99a339 9bc339 9de339 0001389 9f033a a1233a a3433a a5633a a7833a a9a33a abc33a ade33a af033b b1233b b3433b b5633b b7833b b9a33b bbc33b bde33b 0001437 bf033c c1233c c3433c c5633c c7833c c9a33c cbc33c cde33c cf033d d1233d d3433d d5633d d7833d d9a33d dbc33d dde33d 0001485 df033e e1233e e3433e e5633e e7833e e9a33e ebc33e ede33e ef033f f1233f f3433f f5633f f7833f f9a33f fbc33f fde33f 0001533 ff0340 012440 034440 056440 078440 09a440 0bc440 0de440 0f0441 112441 134441 156441 178441 19a441 1bc441 1de441 0001581 1f0442 212442 234442 256442 278442 29a442 2bc442 2de442 2f0443 312443 334443 ff6f43 378443 39a443 3bc443 3de443 Then, use another keystroke macro to rearrange each group of six hex digits into the proper order: 0001341 fff380 381382 383384 385386 387388 38938a 38b38c 38d38e 38f390 391392 393394 395396 397398 39939a 39b39c 39d39e 0001389 39f3a0 3a13a2 3a33a4 3a53a6 3a73a8 3a93aa 3ab3ac 3ad3ae 3af3b0 3b13b2 3b33b4 3b53b6 3b73b8 3b93ba 3bb3bc 3bd3be 0001437 3bf3c0 3c13c2 3c33c4 3c53c6 3c73c8 3c93ca 3cb3cc 3cd3ce 3cf3d0 3d13d2 3d33d4 3d53d6 3d73d8 3d93da 3db3dc 3dd3de 0001485 3df3e0 3e13e2 3e33e4 3e53e6 3e73e8 3e93ea 3eb3ec 3ed3ee 3ef3f0 3f13f2 3f33f4 3f53f6 3f73f8 3f93fa 3fb3fc 3fd3fe 0001533 3ff400 401402 403404 405406 407408 40940a 40b40c 40d40e 40f410 411412 413414 415416 417418 41941a 41b41c 41d41e 0001581 41f420 421422 423424 425426 427428 42942a 42b42c 42d42e 42f430 431432 433434 fff436 437438 43943a 43b43c 43d43e Finally, break apart the six hext digits into the proper three. 0001341 fff 380 381 382 383 384 385 386 387 388 389 38a 38b 38c 38d 38e 38f 390 391 392 393 394 395 396 397 398 399 39a 39b 39c 39d 39e 0001389 39f 3a0 3a1 3a2 3a3 3a4 3a5 3a6 3a7 3a8 3a9 3aa 3ab 3ac 3ad 3ae 3af 3b0 3b1 3b2 3b3 3b4 3b5 3b6 3b7 3b8 3b9 3ba 3bb 3bc 3bd 3be 0001437 3bf 3c0 3c1 3c2 3c3 3c4 3c5 3c6 3c7 3c8 3c9 3ca 3cb 3cc 3cd 3ce 3cf 3d0 3d1 3d2 3d3 3d4 3d5 3d6 3d7 3d8 3d9 3da 3db 3dc 3dd 3de 0001485 3df 3e0 3e1 3e2 3e3 3e4 3e5 3e6 3e7 3e8 3e9 3ea 3eb 3ec 3ed 3ee 3ef 3f0 3f1 3f2 3f3 3f4 3f5 3f6 3f7 3f8 3f9 3fa 3fb 3fc 3fd 3fe 0001533 3ff 400 401 402 403 404 405 406 407 408 409 40a 40b 40c 40d 40e 40f 410 411 412 413 414 415 416 417 418 419 41a 41b 41c 41d 41e 0001581 41f 420 421 422 423 424 425 426 427 428 429 42a 42b 42c 42d 42e 42f 430 431 432 433 434 fff The file is stored in consequetive sectors!