Examples in Learning How Disk
Boot Records, FATs and Directories Function
[A Basic Course in Forensics/Data Recovery]

Examining The Windows 98, 98 SE,
Win ME and Win XP Boot Disks
with Symantec's Norton Utilities (NU)
Disk Editor and/or MS-DOS DEBUG

Copyright©2003 by Daniel B. Sedory
[Do NOT reproduce without permission from the author.]

My plan is to cover each aspect of the FAT File Systems as these pages progress. I hope you find the text here to be practical: showing you how to use a Disk Editor while learning about the MS FAT File Systems and the Win OSs that use them.

The Exercises will include helpful topics; such as showing you how to use DEBUG to test for floppy boot viruses and will include making a better boot diskette than Microsoft's "Startup" versions.

Table of Contents

Page One

You really do need to read through ALL the pages here since the context at any point builds upon what has come before it, but here's an Index:

Page One:
• Introduction
• The Norton Disk Editor and ...
  • MD5 Checksums -- links for obtaining some free MD5 programs (required).
• How to make a Windows Startup Disk
• Make more than one copy!
• Can DISKEDIT run under Windows 2000/XP or Windows 9x/ME ?
• Running DISKEDIT under DOS
• DIRECTORY View of the Windows 98 Startup Disk
   • "Layout" of a 1440 kb diskette (Boot Record, FATs, Directory and Data)
   • Windows 98 SE Startup Disk Directory
   • Windows ME Startup Disk Directory
   • The Windows XP Startup Disk (only an edited version of the Win ME disk!)
• MD5 Sums for checking every file on all the Windows Startup Disks!

Page Two:
• The MSWIN4.1 Floppy Disk Boot Record (in detail)
• Exercise 1: Using MS-DEBUG to check for Boot viruses and Writing Binary Objects with DISKEDIT
• Exercise 2: Editing MAC Times, creating Image Files and checking the MD5 sum of a whole diskette

Page Three:

Page One

The Starman.

The Starman's Realm Index Page