Non-Resident DATA Field with Multiple Cluster Runs

Materials:
Working complete PC
Blank Diskette
Student Diskette, "New Boot A Ver 2.0+"
Student CD-ROM, "Room 6359"
Objectives:
The student will become familiar with:
Using the partition table to determine the VBR's location,
Read the partition's VBR
Determining Cluster zero's start sector LBA address,
Determine the cluster size for the partition
Locate a file's primary MFT entry,
Determine that the file's $DATA attribute is non-resident,
Determine the location of the $DATA cluster runs within the MFT entry,
Determine the total number of sectors addressed by the cluster runs,
Determine the absolute file size,
Interpret a file with a multiple cluster runs,
Locate the non-resident data clusters,
Rescue the data held in the non-resident clusters.
Competency:
The student will continue learning how to use Norton DiskEdit for the purposes of data recovery including routine acquisition of the MBR of BIOS drive 80h, analysis of the partition table including the calculation of the location of the NTFS VBR, acquire that VBR, display it on screen and analyze it. Then use DiskEdit to find a file's MFT Entry, analyze it and locate the $DATA field, determine that it is non-resident and learn how to interpret the cluster runs, locate them on the drive and save the data to another location for recovery.

    Preparation

  1. The student should have a lab PC with Windows 2000 or higher running on a single NTFS partitioned C: drive on an HDD being handled as a "Basic Disk" then proceed with the following procedures.

  2. Launch the Windows operating system to the desktop. Preferably in a second partition, create a folder and within the folder create a text file using Notepad and cut and paste the following text into it:

    echo VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA-- >> a.txt
echo VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB-- >> b.txt
echo VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC-- >> c.txt
echo VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD-- >> d.txt
echo VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE-- >> e.txt
echo VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF-- >> f.txt
echo VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG-- >> g.txt
echo VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH-- >> h.txt
echo VSECTOR%1II----VSECTOR%1II----VSECTOR%1II----VSECTOR%1II-- >> i.txt
echo VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ-- >> j.txt
echo VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK-- >> k.txt
echo VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL-- >> l.txt
echo VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM-- >> m.txt
echo VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN-- >> n.txt
echo VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO-- >> o.txt
echo VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP-- >> p.txt
echo VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ-- >> q.txt
echo VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR-- >> r.txt
echo VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS-- >> s.txt
echo VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT-- >> t.txt
echo VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU-- >> u.txt
echo VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV-- >> v.txt
echo VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW-- >> w.txt
echo VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX-- >> x.txt
echo VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY-- >> y.txt
echo VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ-- >> z.txt
echo VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA-- >> a.txt
echo VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB-- >> b.txt
echo VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC-- >> c.txt
echo VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD-- >> d.txt
echo VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE-- >> e.txt
echo VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF-- >> f.txt
echo VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG-- >> g.txt
echo VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH-- >> h.txt
echo VSECTOR%1II----VSECTOR%1II----VSECTOR%1II----VSECTOR%1II-- >> i.txt
echo VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ-- >> j.txt
echo VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK-- >> k.txt
echo VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL-- >> l.txt
echo VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM-- >> m.txt
echo VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN-- >> n.txt
echo VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO-- >> o.txt
echo VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP-- >> p.txt
echo VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ-- >> q.txt
echo VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR-- >> r.txt
echo VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS-- >> s.txt
echo VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT-- >> t.txt
echo VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU-- >> u.txt
echo VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV-- >> v.txt
echo VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW-- >> w.txt
echo VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX-- >> x.txt
echo VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY-- >> y.txt
echo VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ-- >> z.txt
echo VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA-- >> a.txt
echo VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB-- >> b.txt
echo VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC-- >> c.txt
echo VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD-- >> d.txt
echo VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE-- >> e.txt
echo VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF-- >> f.txt
echo VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG-- >> g.txt
echo VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH-- >> h.txt
echo VSECTOR%1II----VSECTOR%1II----VSECTOR%1II----VSECTOR%1II-- >> i.txt
echo VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ-- >> j.txt
echo VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK-- >> k.txt
echo VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL-- >> l.txt
echo VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM-- >> m.txt
echo VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN-- >> n.txt
echo VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO-- >> o.txt
echo VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP-- >> p.txt
echo VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ-- >> q.txt
echo VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR-- >> r.txt
echo VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS-- >> s.txt
echo VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT-- >> t.txt
echo VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU-- >> u.txt
echo VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV-- >> v.txt
echo VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW-- >> w.txt
echo VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX-- >> x.txt
echo VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY-- >> y.txt
echo VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ-- >> z.txt
echo VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA-- >> a.txt
echo VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB-- >> b.txt
echo VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC-- >> c.txt
echo VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD-- >> d.txt
echo VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE-- >> e.txt
echo VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF-- >> f.txt
echo VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG-- >> g.txt
echo VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH-- >> h.txt
echo VSECTOR%1II----VSECTOR%1II----VSECTOR%1II----VSECTOR%1II-- >> i.txt
echo VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ-- >> j.txt
echo VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK-- >> k.txt
echo VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL-- >> l.txt
echo VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM-- >> m.txt
echo VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN-- >> n.txt
echo VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO-- >> o.txt
echo VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP-- >> p.txt
echo VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ-- >> q.txt
echo VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR-- >> r.txt
echo VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS-- >> s.txt
echo VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT-- >> t.txt
echo VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU-- >> u.txt
echo VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV-- >> v.txt
echo VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW-- >> w.txt
echo VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX-- >> x.txt
echo VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY-- >> y.txt
echo VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ-- >> z.txt
echo VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA-- >> a.txt
echo VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB-- >> b.txt
echo VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC-- >> c.txt
echo VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD-- >> d.txt
echo VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE-- >> e.txt
echo VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF-- >> f.txt
echo VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG-- >> g.txt
echo VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH-- >> h.txt
echo VSECTOR%1II----VSECTOR%1II----VSECTOR%1II----VSECTOR%1II-- >> i.txt
echo VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ-- >> j.txt
echo VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK-- >> k.txt
echo VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL-- >> l.txt
echo VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM-- >> m.txt
echo VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN-- >> n.txt
echo VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO-- >> o.txt
echo VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP-- >> p.txt
echo VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ-- >> q.txt
echo VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR-- >> r.txt
echo VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS-- >> s.txt
echo VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT-- >> t.txt
echo VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU-- >> u.txt
echo VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV-- >> v.txt
echo VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW-- >> w.txt
echo VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX-- >> x.txt
echo VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY-- >> y.txt
echo VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ-- >> z.txt
echo VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA-- >> a.txt
echo VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB-- >> b.txt
echo VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC-- >> c.txt
echo VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD-- >> d.txt
echo VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE-- >> e.txt
echo VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF-- >> f.txt
echo VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG-- >> g.txt
echo VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH-- >> h.txt
echo VSECTOR%1II----VSECTOR%1II----VSECTOR%1II----VSECTOR%1II-- >> i.txt
echo VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ-- >> j.txt
echo VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK-- >> k.txt
echo VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL-- >> l.txt
echo VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM-- >> m.txt
echo VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN-- >> n.txt
echo VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO-- >> o.txt
echo VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP-- >> p.txt
echo VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ-- >> q.txt
echo VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR-- >> r.txt
echo VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS-- >> s.txt
echo VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT-- >> t.txt
echo VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU-- >> u.txt
echo VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV-- >> v.txt
echo VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW-- >> w.txt
echo VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX-- >> x.txt
echo VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY-- >> y.txt
echo VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ-- >> z.txt
echo VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA-- >> a.txt
echo VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB-- >> b.txt
echo VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC-- >> c.txt
echo VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD-- >> d.txt
echo VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE-- >> e.txt
echo VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF-- >> f.txt
echo VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG-- >> g.txt
echo VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH-- >> h.txt
echo VSECTOR%1II----VSECTOR%1II----VSECTOR%1II----VSECTOR%1II-- >> i.txt
echo VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ-- >> j.txt
echo VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK-- >> k.txt
echo VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL-- >> l.txt
echo VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM-- >> m.txt
echo VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN-- >> n.txt
echo VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO-- >> o.txt
echo VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP-- >> p.txt
echo VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ-- >> q.txt
echo VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR-- >> r.txt
echo VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS-- >> s.txt
echo VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT-- >> t.txt
echo VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU-- >> u.txt
echo VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV-- >> v.txt
echo VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW-- >> w.txt
echo VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX-- >> x.txt
echo VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY-- >> y.txt
echo VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ-- >> z.txt
echo VSECTOR%1AA----VSECTOR%1AA----VSECTOR%1AA----AAAA-- >> a.txt
echo VSECTOR%1BB----VSECTOR%1BB----VSECTOR%1BB----BBBB-- >> b.txt
echo VSECTOR%1CC----VSECTOR%1CC----VSECTOR%1CC----CCCC-- >> c.txt
echo VSECTOR%1DD----VSECTOR%1DD----VSECTOR%1DD----DDDD-- >> d.txt
echo VSECTOR%1EE----VSECTOR%1EE----VSECTOR%1EE----EEEE-- >> e.txt
echo VSECTOR%1FF----VSECTOR%1FF----VSECTOR%1FF----FFFF-- >> f.txt
echo VSECTOR%1GG----VSECTOR%1GG----VSECTOR%1GG----GGGG-- >> g.txt
echo VSECTOR%1HH----VSECTOR%1HH----VSECTOR%1HH----HHHH-- >> h.txt
echo VSECTOR%1II----VSECTOR%1II----VSECTOR%1II----IIII-- >> i.txt
echo VSECTOR%1JJ----VSECTOR%1JJ----VSECTOR%1JJ----JJJJ-- >> j.txt
echo VSECTOR%1KK----VSECTOR%1KK----VSECTOR%1KK----KKKK-- >> k.txt
echo VSECTOR%1LL----VSECTOR%1LL----VSECTOR%1LL----LLLL-- >> l.txt
echo VSECTOR%1MM----VSECTOR%1MM----VSECTOR%1MM----MMMM-- >> m.txt
echo VSECTOR%1NN----VSECTOR%1NN----VSECTOR%1NN----NNNN-- >> n.txt
echo VSECTOR%1OO----VSECTOR%1OO----VSECTOR%1OO----OOOO-- >> o.txt
echo VSECTOR%1PP----VSECTOR%1PP----VSECTOR%1PP----PPPP-- >> p.txt
echo VSECTOR%1QQ----VSECTOR%1QQ----VSECTOR%1QQ----QQQQ-- >> q.txt
echo VSECTOR%1RR----VSECTOR%1RR----VSECTOR%1RR----RRRR-- >> r.txt
echo VSECTOR%1SS----VSECTOR%1SS----VSECTOR%1SS----SSSS-- >> s.txt
echo VSECTOR%1TT----VSECTOR%1TT----VSECTOR%1TT----TTTT-- >> t.txt
echo VSECTOR%1UU----VSECTOR%1UU----VSECTOR%1UU----UUUU-- >> u.txt
echo VSECTOR%1VV----VSECTOR%1VV----VSECTOR%1VV----VVVV-- >> v.txt
echo VSECTOR%1WW----VSECTOR%1WW----VSECTOR%1WW----WWWW-- >> w.txt
echo VSECTOR%1XX----VSECTOR%1XX----VSECTOR%1XX----XXXX-- >> x.txt
echo VSECTOR%1YY----VSECTOR%1YY----VSECTOR%1YY----YYYY-- >> y.txt
echo VSECTOR%1ZZ----VSECTOR%1ZZ----VSECTOR%1ZZ----ZZZZ-- >> z.txt

  3. Save the file as SECTOR.BAT in the folder on the second partition. This batch file will create 26 text files one sector in size by itself. However, four more small batch files will be created that will call SECTOR.BAT passing it the parameter from "000" to "999" and then SECTOR.BAT will create each of the 26 text files with 1000 sectors each and the content will contain the sector number so that the cluster run recovery can be easily tracked as it proceeds. Here are the four batch files needed:

    MAKE.BAT
call hun 0 1 2 3 4 5 6 7 8 9

HUN.BAT
:again
if %1z==z goto end
call ten %10 %11 %12 %13 %14 %15 %16 %17 %18 %19
shift
goto again
:end

TEN.BAT
:again
if %1z==z goto end
call one %10 %11 %12 %13 %14 %15 %16 %17 %18 %19
shift
goto again
:end

ONE.BAT
:again
if %1z==z goto end
call sector %1
shift
goto again
:end

  4. Copy the text under each file name and save it as that file name in the folder. When all of the batch files have been created open the command prompt (Start > Programs > Accessories > Command Prompt) Change to the correct drive letter, then to the correct directory and then run the batch file. Simply type "MAKE" at the prompt and it will create the files (and it will take a while.)

  5. Create the following batch file also using notepad and save it in the same folder as CONCAT.BAT:

    copy /b a.txt + b.txt C:\file.txt
copy /b C:\file.txt + c.txt C:\file.txt
copy /b C:\file.txt + d.txt C:\file.txt
copy /b C:\file.txt + e.txt C:\file.txt
copy /b C:\file.txt + f.txt C:\file.txt
copy /b C:\file.txt + g.txt C:\file.txt
copy /b C:\file.txt + h.txt C:\file.txt
copy /b C:\file.txt + i.txt C:\file.txt
copy /b C:\file.txt + j.txt C:\file.txt
copy /b C:\file.txt + k.txt C:\file.txt
copy /b C:\file.txt + l.txt C:\file.txt
copy /b C:\file.txt + m.txt C:\file.txt
copy /b C:\file.txt + n.txt C:\file.txt
copy /b C:\file.txt + o.txt C:\file.txt
copy /b C:\file.txt + p.txt C:\file.txt
copy /b C:\file.txt + q.txt C:\file.txt
copy /b C:\file.txt + r.txt C:\file.txt
copy /b C:\file.txt + s.txt C:\file.txt
copy /b C:\file.txt + t.txt C:\file.txt
copy /b C:\file.txt + u.txt C:\file.txt
copy /b C:\file.txt + v.txt C:\file.txt
copy /b C:\file.txt + w.txt C:\file.txt
copy /b C:\file.txt + x.txt C:\file.txt
copy /b C:\file.txt + y.txt C:\file.txt
copy /b C:\file.txt + z.txt C:\file.txt

  6. In the DOS box run CONCAT.BAT. It will create one large text file in the root of the C: drive named file.txt. It should end up quite fragmented leading to many cluster runs within the MFT entry. Restart the machine properly to either New Boot A or the Student CD-ROM. Change to the K: Drive and begin the procedures below.

    7. Procedures

  7. This module assumes that the student already knows how to use DiskEdit to select Physical Hard Drive 1 and how to find the MFT entry for the file "file.txt" Do this now. It also assumes that the student knows how to navigate the MFT entry from the standard MFT Entry header down through the attributes until the $DATA attribute is found. Once found determine that the attribute is non-resident and the location of the start of the cluster runs. The first byte of the first cluster run is highlighted here:

    Physical Sector: Cyl 2, Side 35, Sector 47
00000000:  46 49 4C 45 2A 00 03 00-DC AF 97 02 00 00 00 00   FILE*...........
00000010:  02 00 01 00 30 00 01 00-F8 01 00 00 00 04 00 00   ....0...........
00000020:  00 00 00 00 00 00 00 00-04 00 04 00 00 00 00 00   ................
00000030:  10 00 00 00 60 00 00 00-00 00 00 00 00 00 00 00   ....`...........
00000040:  48 00 00 00 18 00 00 00-90 55 AC 57 9F 1D C7 01   H........U.W....
00000050:  80 5D D9 58 9F 1D C7 01-80 5D D9 58 9F 1D C7 01   .].X.....].X....
00000060:  80 5D D9 58 9F 1D C7 01-20 00 00 00 00 00 00 00   .].X.... .......
00000070:  00 00 00 00 00 00 00 00-00 00 00 00 15 01 00 00   ................
00000080:  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
00000090:  30 00 00 00 70 00 00 00-00 00 00 00 00 00 02 00   0...p...........
000000A0:  52 00 00 00 18 00 01 00-05 00 00 00 00 00 05 00   R...............
000000B0:  90 55 AC 57 9F 1D C7 01-90 55 AC 57 9F 1D C7 01   .U.W.....U.W....
000000C0:  90 55 AC 57 9F 1D C7 01-90 55 AC 57 9F 1D C7 01   .U.W.....U.W....
000000D0:  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
000000E0:  20 00 00 00 00 00 00 00-08 03 66 00 69 00 6C 00    .........f.i.l.
000000F0:  65 00 2E 00 74 00 78 00-74 00 00 00 00 00 00 00   e...t.x.t.......
00000100:  80 00 00 00 F0 00 00 00-01 00 00 00 00 00 03 00   ................
00000110:  00 00 00 00 00 00 00 00-CB 18 00 00 00 00 00 00   ................
00000120:  40 00 00 00 00 00 00 00-00 60 C6 00 00 00 00 00   @........`......
00000130:  AB 5D C6 00 00 00 00 00-AB 5D C6 00 00 00 00 00   .].......]......
00000140:  31 01 BE F9 05 32 F4 00-3A 99 FB 22 F4 00 5E 01   1....2..:.."..^.
00000150:  22 F4 00 5D 01 22 F4 00-5D 01 22 F4 00 5D 01 22   "..]."..]."..]."
00000160:  F4 00 5D 01 31 11 1E 60-04 32 E3 00 3E A1 FB 21   ..].1..`.2..>..!
00000170:  14 CE F4 22 E1 00 31 0C-22 F4 00 FC 00 22 F4 00   ..."..1."...."..
00000180:  5C 01 22 F4 00 5C 01 22-F4 00 5B 01 22 F4 00 5B   \."..\."..[."..[
00000190:  01 31 16 0E 57 04 32 DE-00 4D AA FB 31 17 BD 58   .1..W.2..M..1..X
000001A0:  03 32 DE 00 3D A8 FC 22-F4 00 F9 00 22 F4 00 5A   .2..=.."...."..Z
000001B0:  01 22 F4 00 5A 01 22 F4-00 5A 01 22 F4 00 59 01   ."..Z."..Z."..Y.
000001C0:  31 17 34 10 04 32 DD 00-25 F1 FB 31 19 7C 12 04   1.4..2..%..1.|..
000001D0:  32 DC 00 7D EE FB 22 F4-00 F7 00 22 F4 00 58 01   2..}.."...."..X.
000001E0:  22 F4 00 58 01 22 F4 00-58 01 00 02 00 00 00 00   "..X."..X.......
000001F0:  FF FF FF FF 82 79 47 11-00 00 00 00 00 00 04 00   .....yG.........
Physical Sector: Cyl 2, Side 35, Sector 48
00000000:  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   .....yG......yG.
00000010:  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
00000020:  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
00000030:  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................

  8. Clearly this is a non-resident $DATA attribute with a long and complex cluster run. List the cluster runs on a columnar worksheet like this:

    Run#Size(Clusters)Start Cluster#Real Cluster#Sector LBA
    10105 F9 BE  
    200 F4FB 99 3A  
    300 F401 5E  
    400 F401 5D  

  9. In this exercise, the first four runs will be found to demonstrate the art. And these values have been read from the clusters runs of the example and have been filled into this worksheet. The "real" cluster number of the first run, is always provided directly in the cluster run. Copy this value into the "real" cluster number column:

    Run#Size(Clusters)Start Cluster#Real Cluster#Sector LBA
    10105 F9 BE5F9BE 
    200 F4FB 99 3A  
    300 F401 5E  
    400 F401 5D  

  10. The next cluster number provided in the cluster run list of the attribute is relative to the preceding one. Also, in this particular case, it is a negative number (highest byte's highest bit is a "1") and so the absolute value of this number must be ascertained with the procedure developed in the preceding module. Subtract the negative number from the value "1" followed by its number of zeros:

      1000000
-  FB993A
    466C6 (absolute value of the negative number)

  11. This number must then be subtracted from the preceding absolute cluster number. Since the preceding absolute cluster number has already been determined (the number provided was the absolute cluster number only because it was the first one in the run) then this number can be subtracted from it:

      5F9BE
- 466C6
  192F8

  12. This is the absolute cluster number of the second cluster run. Fill this value into the table:

    Run#Size(Clusters)Start Cluster#Real Cluster#Sector LBA
    10105 F9 BE5F9BE 
    200 F4FB 99 3A192F8 
    300 F401 5E  
    400 F401 5D  

  13. The third cluster run's cluster number is now relative to this absolute cluster number of cluster run #2. The starting cluster number provided is a positive number (highest bit of the highest byte is zero) Therefore simply add this value to the absolute cluster number of cluster run #2:

      192F8
+   15E
  19456

  14. Place this value into the table:

    Run#Size(Clusters)Start Cluster#Real Cluster#Sector LBA
    10105 F9 BE5F9BE 
    200 F4FB 99 3A192F8 
    300 F401 5E19456 
    400 F401 5D  

  15. Now the fourth run's starting cluster number is relative to this one. The fourth run's cluster number is also positive. Add it to the absolute cluster number of cluster run #3:

      19456
+   15D
  195B3

  16. It is clear then that making a mistake anywhere along the way will wreck the calculated locations of all subsequent cluster runs in the list. This is why the cluster runs sizes and provided starting cluster numbers should be listed and then calculated and placed into an absolute or "real" cluster number column in order to keep them straight. Now that these absolute cluster numbers have been calculated, convert them to the starting sector's LBA addresses. This assumes that the drive has a geometry of Cyl = 785, Head = 128, Sector/Track = 63 and the cluster size of the partition is 4 sectors/cluster and the VBR was found at Cyl = 0, Head = 1, Sector = 1 (LBA #63):

    Cluster run #1 - 5F9BE =d=> 391614 x 4 + 63 = 1566519 = SSLBA
Cluster run #2 - 192F8 =d=> 103160 x 4 + 63 =  412703 = SSLBA
Cluster run #3 - 19456 =d=> 103510 x 4 + 63 =  414103 = SSLBA
Cluster run #4 - 195B3 =d=> 103859 x 4 + 63 =  415499 = SSLBA

  17. Now that the starting sector's LBA addresses have been found, and the size of each run has also been found, the data can be brought up in Diskedit. Using the old version, the LBA addresses must be converted into their CHS coordinate addresses then the Object menu physical sector choice can be given the CHS coordinates and the size of the sector run to be chosen for the selection. Remember that each run's size has been given in clusters, convert to decimal then multiply by four to get the size in sectors. Here is the end sector of the third cluster run displayed in Diskedit:

    Physical Sector: Cyl 51, Side 60, Sector 36
00000000  45 43 54 4F 52 39 39 39-42 42 2D 2D 2D 2D 56 53   ECTOR999BB----VS
00000010  45 43 54 4F 52 39 39 39-42 42 2D 2D 2D 2D 56 53   ECTOR999BB----VS
00000020  45 43 54 4F 52 39 39 39-42 42 2D 2D 2D 2D 56 53   ECTOR999BB----VS
00000030  45 43 54 4F 52 39 39 39-42 42 2D 2D 20 0D 0A 56   ECTOR999BB-- ..V
00000040  53 45 43 54 4F 52 39 39-39 42 42 2D 2D 2D 2D 56   SECTOR999BB----V
00000050  53 45 43 54 4F 52 39 39-39 42 42 2D 2D 2D 2D 56   SECTOR999BB----V
00000060  53 45 43 54 4F 52 39 39-39 42 42 2D 2D 2D 2D 56   SECTOR999BB----V
00000070  53 45 43 54 4F 52 39 39-39 42 42 2D 2D 20 0D 0A   SECTOR999BB-- ..
00000080  56 53 45 43 54 4F 52 30-30 30 43 43 2D 2D 2D 2D   VSECTOR000CC----
00000090  56 53 45 43 54 4F 52 30-30 30 43 43 2D 2D 2D 2D   VSECTOR000CC----
000000A0  56 53 45 43 54 4F 52 30-30 30 43 43 2D 2D 2D 2D   VSECTOR000CC----
000000B0  56 53 45 43 54 4F 52 30-30 30 43 43 2D 2D 20 0D   VSECTOR000CC-- .
000000C0  0A 56 53 45 43 54 4F 52-30 30 30 43 43 2D 2D 2D   .VSECTOR000CC---
000000D0  2D 56 53 45 43 54 4F 52-30 30 30 43 43 2D 2D 2D   -VSECTOR000CC---
000000E0  2D 56 53 45 43 54 4F 52-30 30 30 43 43 2D 2D 2D   -VSECTOR000CC---
000000F0  2D 56 53 45 43 54 4F 52-30 30 30 43 43 2D 2D 20   -VSECTOR000CC-- 
00000100  0D 0A 56 53 45 43 54 4F-52 30 30 30 43 43 2D 2D   ..VSECTOR000CC--
00000110  2D 2D 56 53 45 43 54 4F-52 30 30 30 43 43 2D 2D   --VSECTOR000CC--
00000120  2D 2D 56 53 45 43 54 4F-52 30 30 30 43 43 2D 2D   --VSECTOR000CC--
00000130  2D 2D 56 53 45 43 54 4F-52 30 30 30 43 43 2D 2D   --VSECTOR000CC--
00000140  20 0D 0A 56 53 45 43 54-4F 52 30 30 30 43 43 2D    ..VSECTOR000CC-
00000150  2D 2D 2D 56 53 45 43 54-4F 52 30 30 30 43 43 2D   ---VSECTOR000CC-
00000160  2D 2D 2D 56 53 45 43 54-4F 52 30 30 30 43 43 2D   ---VSECTOR000CC-
00000170  2D 2D 2D 56 53 45 43 54-4F 52 30 30 30 43 43 2D   ---VSECTOR000CC-
00000180  2D 20 0D 0A 56 53 45 43-54 4F 52 30 30 30 43 43   - ..VSECTOR000CC
00000190  2D 2D 2D 2D 56 53 45 43-54 4F 52 30 30 30 43 43   ----VSECTOR000CC
000001A0  2D 2D 2D 2D 56 53 45 43-54 4F 52 30 30 30 43 43   ----VSECTOR000CC
000001B0  2D 2D 2D 2D 56 53 45 43-54 4F 52 30 30 30 43 43   ----VSECTOR000CC
000001C0  2D 2D 20 0D 0A 56 53 45-43 54 4F 52 30 30 30 43   -- ..VSECTOR000C
000001D0  43 2D 2D 2D 2D 56 53 45-43 54 4F 52 30 30 30 43   C----VSECTOR000C
000001E0  43 2D 2D 2D 2D 56 53 45-43 54 4F 52 30 30 30 43   C----VSECTOR000C
000001F0  43 2D 2D 2D 2D 56 53 45-43 54 4F 52 30 30 30 43   C----VSECTOR000C
Physical Sector: Cyl 51, Side 60, Sector 37
00000000  BF 79 F5 AD 1B 75 C9 6C-76 A0 29 10 42 3B 89 86   .y...u.lv.).B;..
00000010  8E CD A0 E5 5C 98 1F 6C-8A CB 51 64 B5 22 B6 96   ....\..l..Qd."..
00000020  13 24 F9 43 94 4F C3 EC-93 8B BE 96 FE 89 DD E1   .$.C.O..........
00000030  CD 86 E2 2D 8A 3F 0F 0B-FA FD 20 62 9C CF 00 BC   ...-.?.... b....
00000040  45 BF 8A E2 3C 4C 4E C0-C1 FA C0 92 33 3C 72 43   E...<LN.....3<rC
00000050  51 6A 77 26 CE C4 22 A3-0E 35 F0 CB 87 37 D7 99   Qjw&.."..5...7..
00000060  07 74 65 58 D6 21 60 8E-E6 F2 9B 04 EE FA D5 47   .teX.!`........G

  18. And here is the beginning of the fourth cluster run:

    00000190  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
000001A0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
000001B0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
000001C0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
000001D0  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00   ................
000001E0  00 00 00 00 00 00 08 00-0A 00 01 00 00 00 04 00   ................
000001F0  00 00 00 00 00 00 07 00-0B 00 01 00 00 00 02 00   ................
Physical Sector: Cyl 51, Side 67, Sector 15
00000000  43 2D 2D 20 0D 0A 56 53-45 43 54 4F 52 30 30 30   C-- ..VSECTOR000
00000010  43 43 2D 2D 2D 2D 56 53-45 43 54 4F 52 30 30 30   CC----VSECTOR000
00000020  43 43 2D 2D 2D 2D 56 53-45 43 54 4F 52 30 30 30   CC----VSECTOR000
00000030  43 43 2D 2D 2D 2D 56 53-45 43 54 4F 52 30 30 30   CC----VSECTOR000
00000040  43 43 2D 2D 20 0D 0A 56-53 45 43 54 4F 52 30 30   CC-- ..VSECTOR00
00000050  30 43 43 2D 2D 2D 2D 56-53 45 43 54 4F 52 30 30   0CC----VSECTOR00
00000060  30 43 43 2D 2D 2D 2D 56-53 45 43 54 4F 52 30 30   0CC----VSECTOR00
00000070  30 43 43 2D 2D 2D 2D 56-53 45 43 54 4F 52 30 30   0CC----VSECTOR00
00000080  30 43 43 2D 2D 20 0D 0A-56 53 45 43 54 4F 52 30   0CC-- ..VSECTOR0
00000090  30 31 43 43 2D 2D 2D 2D-56 53 45 43 54 4F 52 30   01CC----VSECTOR0
000000A0  30 31 43 43 2D 2D 2D 2D-56 53 45 43 54 4F 52 30   01CC----VSECTOR0
000000B0  30 31 43 43 2D 2D 2D 2D-56 53 45 43 54 4F 52 30   01CC----VSECTOR0
000000C0  30 31 43 43 2D 2D 20 0D-0A 56 53 45 43 54 4F 52   01CC-- ..VSECTOR
000000D0  30 30 31 43 43 2D 2D 2D-2D 56 53 45 43 54 4F 52   001CC----VSECTOR
000000E0  30 30 31 43 43 2D 2D 2D-2D 56 53 45 43 54 4F 52   001CC----VSECTOR
000000F0  30 30 31 43 43 2D 2D 2D-2D 56 53 45 43 54 4F 52   001CC----VSECTOR
00000100  30 30 31 43 43 2D 2D 20-0D 0A 56 53 45 43 54 4F   001CC-- ..VSECTO
00000110  52 30 30 31 43 43 2D 2D-2D 2D 56 53 45 43 54 4F   R001CC----VSECTO
00000120  52 30 30 31 43 43 2D 2D-2D 2D 56 53 45 43 54 4F   R001CC----VSECTO
00000130  52 30 30 31 43 43 2D 2D-2D 2D 56 53 45 43 54 4F   R001CC----VSECTO
00000140  52 30 30 31 43 43 2D 2D-20 0D 0A 56 53 45 43 54   R001CC-- ..VSECT
00000150  4F 52 30 30 31 43 43 2D-2D 2D 2D 56 53 45 43 54   OR001CC----VSECT
00000160  4F 52 30 30 31 43 43 2D-2D 2D 2D 56 53 45 43 54   OR001CC----VSECT
00000170  4F 52 30 30 31 43 43 2D-2D 2D 2D 56 53 45 43 54   OR001CC----VSECT
00000180  4F 52 30 30 31 43 43 2D-2D 20 0D 0A 56 53 45 43   OR001CC-- ..VSEC
00000190  54 4F 52 30 30 31 43 43-2D 2D 2D 2D 56 53 45 43   TOR001CC----VSEC
000001A0  54 4F 52 30 30 31 43 43-2D 2D 2D 2D 56 53 45 43   TOR001CC----VSEC
000001B0  54 4F 52 30 30 31 43 43-2D 2D 2D 2D 56 53 45 43   TOR001CC----VSEC
000001C0  54 4F 52 30 30 31 43 43-2D 2D 20 0D 0A 56 53 45   TOR001CC-- ..VSE
000001D0  43 54 4F 52 30 30 31 43-43 2D 2D 2D 2D 56 53 45   CTOR001CC----VSE
000001E0  43 54 4F 52 30 30 31 43-43 2D 2D 2D 2D 56 53 45   CTOR001CC----VSE
000001F0  43 54 4F 52 30 30 31 43-43 2D 2D 2D 2D 56 53 45   CTOR001CC----VSE

  19. Clearly then the calculations were corect and these runs are the contents in order of the file. In the next module, a resident directory will be explored, and then a non-resident directory will be explored in the final module for Data Recovery #2.

Back to Page Top

Copyright©2000-2006 Brian Robinson ALL RIGHTS RESERVED