Posted: Fri Jun 21, 2013 5:56 am Post subject: Re: Volume Boot Record Structure
In VBR, there is 3 main components: volume boot code, disk parameter block and signature value right???
Depends. VBR (Volume Boot Record?) could easily refer to any type of volume-specific boot (as distinct from disk-specific boot). Some VBR may split up the way you state.
The Microsoft FAT specification uses other terms: 'boot sector', 'BIOS Parameter Block', and treats the initial jump instruction as separate from the boot code, as well as the OEM name that immediately follows it.
And, is disk parameter block and BIOS parameter block the same?
BIOS parameter block is a pretty well-defined Microsoft term. 'disk parameter block' is not a term I can identify definitely, but in the context of Windows-related volumes, I would interpret it as synonymous with BIOS parameter block.
What is a volume serial number and label? What is the purpose of having it???
Volume label -- typically just a way for a user to name a volume. Could be done to make it easier to identify.
Volume serial number -- it's usually an attempt to make a removable volume unique. Otherwise files could be read/written from/to the wrong source/destination.
These things are covered pretty well in Brian Carrier's book File System Forensic Analysis. I recommend you get a copy.
Btw, does anyone know how to extract a FAT12 file???
You need to understand the FAT12 file system pretty well for that -- again, see Carrier's book.
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum