Are there still windows 9x users? We write the utility for reading NTFS
Recently, finding windows 9x users has become difficult, but possible. But still they are. It is also known that it is not possible to use hard disks with NTFS partitions using standard operating system tools. Let's try to fix it by writing a program that allows you to read data from NTFS partitions.
What will we demand from our program?
Yes, in general, not much. The developed program should copy from partitions of a hard disk with the NTFS5 file system to FAT partitions. This program should be used if Windows 2000 (which uses NTFS 5) is missing or unavailable. Long file names should be supported, as well as hard drives of any capacity (including more than 8GB). The operating environment is OS DOS, Windows 9x. The program must have a "standard" two-pane "Norton" interface.
We will decide on the algorithm
After starting the program, a list of existing partitions appears on the screen with an indication of the hard disk, partition type and partition size. By default, the choice of partitions with a type other than NTFS is prohibited (a corresponding message is displayed). If you select an NTFS partition, it checks whether the partition is NTFS. In case of a discrepancy, a corresponding message is issued. If the partition is recognized as NTFS, 2 file panels are displayed. The left pane displays a list of files and directories in the root directory of the NTFS partition. The right displays the contents of the current directory of the current logical drive.
The user performs the necessary actions (such as browsing the partition files, copying from the NTFS partition to the FAT partition) and exits the program
')
How is everything arranged
When the program starts, the parameters of all hard drives in the system are determined. Defined: geometry, volume, as well as support for advanced functions of reading and writing. The result for each drive is recorded in the following structure:
Standard read / write functions (implemented through functions 02h and 03h of interrupt 13h) require specifying 3-dimensional sector numbers (track-head-sector) and work only for hard disks of no more than 8GB. Extended functions (Int13 Ext) (42h and 43h interrupts 13h) allow you to specify the absolute sector number and work on hard drives of any size. Therefore, with such support, reading of sectors is performed only through these functions.
Then, for each hard disk, the partitions located on it are determined. The result for each section is recorded in the structure:
The procedure for searching for partitions is recursive, since the presence of extended partitions in general gives a tree. An extended partition can have one of 2 types: 05h (for HDD <= 8GB) or 0Fh (for HDD> 8GB). In the second case, access to the partition is possible only through Int13 Ext.
Work with logical disks FAT is performed in a standard way (via interrupt 21h), therefore it is not of interest. It is worth noting that, depending on whether long file names are supported, either standard functions or functions of the 71h group of the interrupt 21h are used.
Working with the NTFS partition is based on manual parsing of all structures. In accordance with the NTFS structure, the sequence of analysis of the partition is as follows (note: after reading each MFT record or index block, the fixup area must be corrected — see the NTFS structure for more details):
1. Two important parameters are extracted from the boot sector of a partition: the number of sectors per cluster and the number of the cluster where the MFT begins.
2. MFT record number 3 (volume information) is read and an attempt is made to extract the name (label) of the volume from it. In case of failure, it is assumed that the volume does not have a label.
3. Read MFT entry number 5 (root directory). The index contains a list of files and directories.
4. When switching to a directory (above- or under-), the MFT record responsible for the required directory is read, and the index is also extracted from it.
5. When accessing a file (for example, for reading), the MFT record responsible for the file is read and analyzed.
If it is interesting, I'll sign for more. Source codes here .
PS:
Source zip here .
And it looks like this in pictures:
What will we demand from our program?
Yes, in general, not much. The developed program should copy from partitions of a hard disk with the NTFS5 file system to FAT partitions. This program should be used if Windows 2000 (which uses NTFS 5) is missing or unavailable. Long file names should be supported, as well as hard drives of any capacity (including more than 8GB). The operating environment is OS DOS, Windows 9x. The program must have a "standard" two-pane "Norton" interface.
We will decide on the algorithm
After starting the program, a list of existing partitions appears on the screen with an indication of the hard disk, partition type and partition size. By default, the choice of partitions with a type other than NTFS is prohibited (a corresponding message is displayed). If you select an NTFS partition, it checks whether the partition is NTFS. In case of a discrepancy, a corresponding message is issued. If the partition is recognized as NTFS, 2 file panels are displayed. The left pane displays a list of files and directories in the root directory of the NTFS partition. The right displays the contents of the current directory of the current logical drive.
The user performs the necessary actions (such as browsing the partition files, copying from the NTFS partition to the FAT partition) and exits the program
')
How is everything arranged
When the program starts, the parameters of all hard drives in the system are determined. Defined: geometry, volume, as well as support for advanced functions of reading and writing. The result for each drive is recorded in the following structure:
struct sDrvInfo { unsigned char Drive; // (80h..FFh) unsigned char ExtSupp; // Int13 Ext (0 - ) unsigned short NumCyl; // unsigned short NumHead; // unsigned short NumSect; // unsigned long NumAll; // sDrvInfo *Next; // }; Standard read / write functions (implemented through functions 02h and 03h of interrupt 13h) require specifying 3-dimensional sector numbers (track-head-sector) and work only for hard disks of no more than 8GB. Extended functions (Int13 Ext) (42h and 43h interrupts 13h) allow you to specify the absolute sector number and work on hard drives of any size. Therefore, with such support, reading of sectors is performed only through these functions.
Then, for each hard disk, the partitions located on it are determined. The result for each section is recorded in the structure:
struct sPartInfo { unsigned char Drive; // (80h..FFh) unsigned char Type; // unsigned long Start; // unsigned long Size; // unsigned long Table; // // , unsigned char NumEnt; // sPartInfo *Next; // };
The procedure for searching for partitions is recursive, since the presence of extended partitions in general gives a tree. An extended partition can have one of 2 types: 05h (for HDD <= 8GB) or 0Fh (for HDD> 8GB). In the second case, access to the partition is possible only through Int13 Ext.
Work with logical disks FAT is performed in a standard way (via interrupt 21h), therefore it is not of interest. It is worth noting that, depending on whether long file names are supported, either standard functions or functions of the 71h group of the interrupt 21h are used.
Working with the NTFS partition is based on manual parsing of all structures. In accordance with the NTFS structure, the sequence of analysis of the partition is as follows (note: after reading each MFT record or index block, the fixup area must be corrected — see the NTFS structure for more details):
1. Two important parameters are extracted from the boot sector of a partition: the number of sectors per cluster and the number of the cluster where the MFT begins.
2. MFT record number 3 (volume information) is read and an attempt is made to extract the name (label) of the volume from it. In case of failure, it is assumed that the volume does not have a label.
3. Read MFT entry number 5 (root directory). The index contains a list of files and directories.
4. When switching to a directory (above- or under-), the MFT record responsible for the required directory is read, and the index is also extracted from it.
5. When accessing a file (for example, for reading), the MFT record responsible for the file is read and analyzed.
If it is interesting, I'll sign for more. Source codes here .
PS:
Source zip here .
And it looks like this in pictures:
Source: https://habr.com/ru/post/126151/
All Articles