tag:blogger.com,1999:blog-9762978278302121872024-03-23T03:14:49.851-07:00Data Recovery and Forensic ResearchData Recovery and Forensic ResearchZijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.comBlogger14125tag:blogger.com,1999:blog-976297827830212187.post-88432488695124641002013-05-24T12:41:00.003-07:002013-05-24T12:41:30.552-07:00I am backI think I will start to pick up this blog again personally.Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com2tag:blogger.com,1999:blog-976297827830212187.post-26922282460410201052011-03-17T06:38:00.000-07:002011-04-04T02:08:14.753-07:00Special RAID Type<span class="Apple-style-span">Recently, I’ve seen two very special types of RAID. They are neither RAID5 nor RAID6. But they have the same tolerance of drive failure as RAID5/RAID6, where the data is still recoverable when two drives are failed.<br /><br /><br /><br />1. RAID from Adaptec 3805<br />It has a data stripe size of 512 sectors and two rows as one data unit (5 data stripes) cycle. The data structure is:<br /><br /><a href="http://computersciencelabs.com/CSLBlog/17032011/Table/1.PNG" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 711px; height: 68px;" src="http://computersciencelabs.com/CSLBlog/17032011/Table/1.PNG" border="0" alt="" /></a><br /><br />P1= D5 XOR D2<br />P2= D1 XOR D3<br />P3= D2 XOR D4<br />P4= D3 XOR D5<br />P5= D4 XOR D1<br /><br />For example, if Drive 1 and Drive 3 are failed, data on them can be regenerated by:<br />D1= D4 XOR P5;<br />D3= D5 XOR P4;<br /><br /><a href="http://computersciencelabs.com/CSLBlog/17032011/Table/2.PNG" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 712px; height: 66px;" src="http://computersciencelabs.com/CSLBlog/17032011/Table/2.PNG" border="0" alt="" /></a><br /><br /><br />Due to the parity bits are not on the same row as the data bits, there is no software available in the market supports the regeneration of the missing data strips from crossed-row data and parity. The parity has to be on the same row as the data to regenerate the missing data by R-studio. Special script needs to be written to regenerate the content of the failed drives, so as to use conventional software to retrieve the data in the final step.<br />To regenerate the D1 on the first row of each data unit cycle, as in the example above, the script will calculate the XOR result between D4 on the first row and P5 on the second row and store the result on the first row of the missing drive. After running the script, the data structure will look like:<br /><br /><a href="http://computersciencelabs.com/CSLBlog/17032011/Table/3.PNG" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 712px; height: 128px;" src="http://computersciencelabs.com/CSLBlog/17032011/Table/3.PNG" border="0" alt="" /></a><br /><br />Now, we can use the R-Studio to retrieve the data. Build a virtual RAID using all the working drives and the drives regenerated. Set the RAID type as customized:<br /><br /><a href="http://computersciencelabs.com/CSLBlog/17032011/1.PNG" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 943px; height: 161px;" src="http://computersciencelabs.com/CSLBlog/17032011/1.PNG" border="0" alt="" /></a><br /><br /><br />2. The second special type of RAID allows maximum two failed drives. It uses the redundancy of the original data, playing the same role as the parity. The data structure is:<br /><br /><a href="http://computersciencelabs.com/CSLBlog/17032011/Table/4.PNG" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 712px; height: 66px;" src="http://computersciencelabs.com/CSLBlog/17032011/Table/4.PNG" border="0" alt="" /></a><br /><br />Within a data unit cycle, it also has two rows as the first type. There is no parity at all. The green colored set of data is the redundancy. As can be seen from the data structure, even though it supports up to two failed drives, these two failed drives can NOT be 1+3, 1+4, 2+4, 2+5, 3+5. Any other failed drives combinations will be tolerated. For example, Drive 1 and Drive 2 are failed.<br /><br /><a href="http://computersciencelabs.com/CSLBlog/17032011/Table/5.PNG" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 712px; height: 67px;" src="http://computersciencelabs.com/CSLBlog/17032011/Table/5.PNG" border="0" alt="" /></a><br /><br /><br />Using R-Studio, we can construct a customized virtual RIAD to retrieve the data as:<br /><br /><a href="http://computersciencelabs.com/CSLBlog/17032011/2.PNG" onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 679px; height: 117px;" src="http://computersciencelabs.com/CSLBlog/17032011/2.PNG" border="0" alt="" /></a></span><div><br /></div><div><span class="Apple-style-span" ><span class="Apple-style-span" style="border-collapse: collapse; "><span class="Apple-style-span" style="color: rgb(17, 17, 17); font-family: arial; line-height: 25px; border-collapse: separate; "><b><span class="Apple-style-span" style="border-collapse: collapse; color: rgb(51, 51, 51); line-height: 18px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><i><span class="Apple-style-span" >Written by: Zijian Xie (R&D Manager, MSc,</span></i></span><span class="Apple-style-span" style="border-collapse: collapse; color: rgb(51, 51, 51); line-height: 18px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><i><span class="Apple-style-span" >BEng</span><span class="Apple-style-span" >)</span></i></span></b></span></span></span></div>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com3tag:blogger.com,1999:blog-976297827830212187.post-74464487966050492892011-02-24T06:30:00.000-08:002011-02-24T06:31:02.553-08:00Script to attach MDF without LDF under SQL2000<div>USE MASTER</div><div>GO</div><div>SP_CONFIGURE 'ALLOW UPDATES',1 RECONFIGURE WITH OVERRIDE</div><div>GO</div><div>UPDATE SYSDATABASES SET STATUS =32768 WHERE NAME='db_NAME'</div><div>Go</div><div>sp_dboption 'db_NAME', 'single user', 'true'</div><div>Go</div><div>DBCC CHECKDB('db_NAME') </div><div>Go</div><div>update sysdatabases set status =28 where name='db_NAME'</div><div>Go</div><div>sp_configure 'allow updates', 0 reconfigure with override</div><div>Go</div><div>sp_dboption 'db_NAME', 'single user', 'false'</div><div>Go</div>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com3tag:blogger.com,1999:blog-976297827830212187.post-17804770865270879402011-02-24T05:53:00.000-08:002011-04-04T02:09:08.420-07:00Seagate 7200.12 ‘SIM ERROR’ Firmware Fault<p class="MsoNormal"><span class="apple-style-span"><span style="font-size:12.0pt; line-height:115%;font-family:"Arial","sans-serif";color:black;mso-themecolor: text1">The symptoms of ‘SIM Error’ firmware fault from hard drives belong to Seagate 7200.12 family are:<o:p></o:p></span></span></p> <p class="MsoListParagraphCxSpFirst" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><!--[if !supportLists]--><span class="apple-style-span"><span style="font-size:12.0pt;line-height:115%; font-family:"Arial","sans-serif";mso-fareast-font-family:Arial;color:black; mso-themecolor:text1"><span style="mso-list:Ignore">1.<span style="font:7.0pt "Times New Roman""> </span></span></span></span><!--[endif]--><span class="apple-style-span"><span style="font-size:12.0pt;line-height:115%;font-family:"Arial","sans-serif"; color:black;mso-themecolor:text1">Hard drive status keeps BUSY forever after switching on;<o:p></o:p></span></span></p> <p class="MsoListParagraphCxSpLast" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><!--[if !supportLists]--><span class="apple-style-span"><span style="font-size:12.0pt;line-height:115%; font-family:"Arial","sans-serif";mso-fareast-font-family:Arial;color:black; mso-themecolor:text1"><span style="mso-list:Ignore">2.<span style="font:7.0pt "Times New Roman""> </span></span></span></span><!--[endif]--><span class="apple-style-span"><span style="font-size:12.0pt;line-height:115%;font-family:"Arial","sans-serif"; color:black;mso-themecolor:text1">In the serial command line, it outputs (when PCB is attached to hard drive):<o:p></o:p></span></span></p> <p class="MsoNormal"><span class="apple-style-span"><span style="line-height: 115%; color: black; "><span class="Apple-style-span">SIM Error 3005</span></span></span><span style="line-height: 115%; color: black; "><span class="Apple-style-span"><br /><strong><span style="font-weight: normal; ">No</span></strong><span class="apple-converted-space"><b> </b></span><strong><span style="font-weight: normal; ">HOST</span></strong><span class="apple-converted-space"><b> </b></span><strong><span style="font-weight: normal; ">FIS</span></strong><span class="apple-style-span">-ReadyStatusFlags 2002A1A5</span><br /></span><span class="apple-style-span"><span class="Apple-style-span">ASCII Diag mode</span><span class="Apple-style-span" style="font-family: 'Courier New'; "><o:p></o:p></span></span></span></p> <p class="MsoListParagraph" style="text-indent:-.25in;mso-list:l0 level1 lfo1"><!--[if !supportLists]--><span class="apple-style-span"><span style="font-size:12.0pt;line-height:115%; font-family:"Arial","sans-serif";mso-fareast-font-family:Arial;color:black; mso-themecolor:text1"><span style="mso-list:Ignore">3.<span style="font:7.0pt "Times New Roman""> </span></span></span></span><!--[endif]--><span class="apple-style-span"><span style="font-size:12.0pt;line-height:115%;font-family:"Arial","sans-serif"; color:black;mso-themecolor:text1">In the serial command line, it outputs (when PCB is detached from hard drive):<o:p></o:p></span></span></p> <p class="MsoNormal"><span class="apple-style-span"><span style="font-size:12.0pt; line-height:115%;font-family:"Arial","sans-serif";color:black;mso-themecolor: text1"><span style="mso-spacerun:yes"> </span></span></span><strong><span style="font-size:12.0pt;line-height:115%;font-family:"Courier New";color:black; mso-themecolor:text1;font-weight:normal;mso-bidi-font-weight:bold">No</span></strong><span class="apple-converted-space"><b style="mso-bidi-font-weight:normal"><span style="font-size:12.0pt;line-height:115%;font-family:"Courier New";color:black; mso-themecolor:text1"> </span></b></span><strong><span style="font-size: 12.0pt;line-height:115%;font-family:"Courier New";color:black;mso-themecolor: text1;font-weight:normal;mso-bidi-font-weight:bold">HOST</span></strong><span class="apple-converted-space"><b style="mso-bidi-font-weight:normal"><span style="font-size:12.0pt;line-height:115%;font-family:"Courier New";color:black; mso-themecolor:text1"> </span></b></span><strong><span style="font-size: 12.0pt;line-height:115%;font-family:"Courier New";color:black;mso-themecolor: text1;font-weight:normal;mso-bidi-font-weight:bold">FIS</span></strong><span class="apple-style-span"><span style="font-size:12.0pt;line-height:115%; font-family:"Courier New";color:black;mso-themecolor:text1">-ReadyStatusFlags 2002A1A5<o:p></o:p></span></span></p> <p class="MsoNormal"><span class="apple-style-span"><span style="font-size:12.0pt; line-height:115%;font-family:"Arial","sans-serif";color:black;mso-themecolor: text1">To use the conventional method of fixing a ‘BUSY and LBA=0’ 7200.11 hard drive, it outputs:<o:p></o:p></span></span></p> <p class="MsoNormal"><span class="Apple-style-span"><strong><span style="line-height: 115%; font-family: 'Courier New'; color: black; font-weight: normal; ">No</span></strong><span class="apple-converted-space"><b><span style="line-height: 115%; font-family: 'Courier New'; color: black; "> </span></b></span><strong><span style="line-height: 115%; font-family: 'Courier New'; color: black; font-weight: normal; ">HOST</span></strong><span class="apple-converted-space"><b><span style="line-height: 115%; font-family: 'Courier New'; color: black; "> </span></b></span><strong><span style="line-height: 115%; font-family: 'Courier New'; color: black; font-weight: normal; ">FIS</span></strong><span class="apple-style-span"><span style="line-height: 115%; font-family: 'Courier New'; color: black; ">-ReadyStatusFlags 2002A1A5</span></span></span><span style="line-height: 115%; font-family: 'Courier New'; color: black; "><span class="Apple-style-span"><br /><span class="apple-style-span">ASCII Diag mode</span><br /><span class="apple-style-span">F3 T>/2</span><br /><span class="apple-style-span">F3 2>Z</span><br /><span class="apple-style-span">Spin Down Complete</span><br /><span class="apple-style-span">Elapsed Time 6.015 secs</span><br /><span class="apple-style-span">F3 2></span><br /><span class="apple-style-span">ASCII Diag mode</span><br /><span class="apple-style-span">F3 T>/2</span><br /><span class="apple-style-span">F3 2>U</span><br /><span class="apple-style-span">HighPowerMode</span><br /><span class="apple-style-span">ExecuteSpinRequest</span><br /><span class="apple-style-span">Spin Up Complete</span><br /><span class="apple-style-span">Elapsed Time 3.624 secs</span><br /><span class="apple-style-span">F3 2>/1</span><br /><span class="apple-style-span">F3 1>N1</span><br /></span><span class="apple-style-span"><span class="Apple-style-span">Init SMART Fail</span><span class="Apple-style-span"><o:p></o:p></span></span></span></p> <span style="font-size:12.0pt;line-height:115%;font-family:"Arial","sans-serif"; mso-fareast-font-family:SimSun;mso-fareast-theme-font:minor-fareast;color:black; mso-themecolor:text1;mso-ansi-language:EN-US;mso-fareast-language:ZH-CN; mso-bidi-language:AR-SA">The initialization of SMART module is failed even though the hard drive passes the Spin up and Spin down operation. To solve this problem, instead of doing N1 to clear the SMART after comand U, we use command m0 first. </span><div><span style="font-size:12.0pt;line-height:115%;font-family:"Arial","sans-serif"; mso-fareast-font-family:SimSun;mso-fareast-theme-font:minor-fareast;color:black; mso-themecolor:text1;mso-ansi-language:EN-US;mso-fareast-language:ZH-CN; mso-bidi-language:AR-SA"><br /></span></div><div><span style="font-size: 12pt; line-height: 115%; "><span class="Apple-style-span" style="font-size: 12px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><span class="Apple-style-span"><p style="line-height: normal; ">(P) SATA Reset </p><p style="line-height: normal; "> SIM Error 3005 <br />No HOST FIS-ReadyStatusFlags 2002A1A5 <br />ASCII Diag mode </p><p style="line-height: normal; ">F3 T>/2 </p><p style="line-height: normal; ">F3 2>Z </p><p style="line-height: normal; ">Spin Down Complete <br />Elapsed Time 6.035 secs <br />F3 2>U</p><p style="line-height: normal; "> HighPowerMode<br />ExecuteSpinRequest</p><p style="line-height: normal; ">Spin Up Complete<br />Elapsed Time 3.573 secs<br />F3 2>/</p><p style="line-height: normal; ">F3 T>m0,2,2,,,,,22<br />Max Wr Retries = 00, Max Rd Retries = 00, Max ECC T-Level = 16, Max Certify Rewr<br />ite Retries = not supported</p><p style="line-height: normal; ">User Partition Format Successful - Elapsed Time 0 mins 00 secs</p><p style="line-height: normal; ">F3 T>/1</p><p style="line-height: normal; ">F3 1>N1</p><p style="line-height: normal; ">Clear SMART is completed.<br />F3 1><br />Rst 0x08M<br />(P) SATA Reset</p><p style="line-height: normal; "><br /></p><p style="line-height: normal; "><span class="Apple-style-span" style="color: rgb(17, 17, 17); font-family: arial; font-size: 13px; line-height: 25px; -webkit-border-horizontal-spacing: 0px; -webkit-border-vertical-spacing: 0px; "><b><span class="Apple-style-span" style="border-collapse: collapse; color: rgb(51, 51, 51); line-height: 18px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><i><span class="Apple-style-span">Written by: Zijian Xie (R&D Manager, MSc,</span></i></span><span class="Apple-style-span" style="border-collapse: collapse; color: rgb(51, 51, 51); line-height: 18px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><i><span class="Apple-style-span">BEng</span><span class="Apple-style-span">)</span></i></span></b></span></p></span></span></span></div>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com14tag:blogger.com,1999:blog-976297827830212187.post-89122842170754433382011-01-13T08:19:00.000-08:002011-01-16T09:21:09.395-08:00Types of RAID6<div><div style="text-align: justify;">1. P+Q RAID6</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">Each data stripe of a P+Q double parity RAID6 has a standard RAID5 parity and a ‘Q’ parity which is generated by Reed-Solomon coding algorithm. It allows up to two drives failure. The minimum number of disks is 4. </div><div style="text-align: justify;"><br /></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/13012011/P+Q.PNG"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 621px; height: 260px; " src="http://computersciencelabs.com/CSLBlog/13012011/P+Q.PNG" border="0" alt="" /></a><div style="text-align: justify;">The HP ADG RAID6 is a special type of P+Q RAID6. Within each standard data stripe, there are an integer number of smaller data stripes where the P and Q parities remain on the same disk. This is also called delay parity. Generally speaking, this type of RAID6 has a delay parity value of 16. </div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">2. NetApp Double XOR RAID 6</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">It is also called RAID-DP and has a similar data structure of RAID4. P and Q parities are generated and stored on the same drives. It allows up to two drives failure. The minimum number of disks is 4. </div><div style="text-align: justify;"><br /></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/13012011/NETAPP.PNG"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 613px; height: 210px; " src="http://computersciencelabs.com/CSLBlog/13012011/NETAPP.PNG" border="0" alt="" /></a><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">3. X-Code RAID6</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">It is also called vertical XOR RAID6. The minimum number of disks is 4. It allows up to two drives failure. Each data stripe group has N (disk number) of data stripes. For example, if it has 5 disks, each data stripe group has 5 rows of data stripes as shown in the figure below. </div><div style="text-align: justify;"><br /></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/13012011/X-code.PNG"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 613px; height: 230px; " src="http://computersciencelabs.com/CSLBlog/13012011/X-code.PNG" border="0" alt="" /></a><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">4. ZZS Code RAID6</div><div style="text-align: justify;">The minimum physical number of disks of ZZS code RAID6 is 5 and it has to be a prime number (5, 7, 11, 13, 19...). But the ZZS coding algorithm also allows one of the drives contains zeros. In another word, the minimum logical number of disk is 4. In ZZS coding algorithm, it also defines the calculation unit (one cycle) is equal to (n-1)/2 if there is n physical disks in the RAID6. For example showing below, it has 7 disks, thus, each cycle has three data stripes. </div><div style="text-align: justify;"><br /></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/13012011/ZZS.PNG"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 613px; height: 130px; " src="http://computersciencelabs.com/CSLBlog/13012011/ZZS.PNG" border="0" alt="" /></a><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">5. Park Code RAID6</div><div style="text-align: justify;">Park is an engineer of IBM. He designed a new coding algorithm to implement a type of RAID6, supports disk number of 3 to 38. Park code RAID6 is always using three data stripes as a calculation unit. </div><div style="text-align: justify;"><br /></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/13012011/ParkRAID6.PNG"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 613px; height: 130px; " src="http://computersciencelabs.com/CSLBlog/13012011/ParkRAID6.PNG" border="0" alt="" /></a><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">Currently, I don't find any software application support the ZZS and Park RAID6. But, with all the disks intact, the data are still retrievable by customised RAID of R-studio. Leave your comments if you know any other types of RAID6 or solutions.</div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family: arial; font-size: large; "><span class="Apple-style-span"><span class="Apple-style-span"><span class="Apple-style-span" style="border-collapse: collapse; color: rgb(51, 51, 51); line-height: 18px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><i><b>Written by: Zijian Xie (R&D Manager, MSc,</b></i></span></span></span><span class="Apple-style-span" style="border-collapse: collapse; color: rgb(51, 51, 51); line-height: 18px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><i><b>BEng</b></i></span><span class="Apple-style-span" style="border-collapse: collapse; color: rgb(51, 51, 51); line-height: 18px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><i><b>)</b></i></span></span></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div><div style="text-align: justify;"><br /></div></div>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com5tag:blogger.com,1999:blog-976297827830212187.post-90316260182619867892010-11-11T06:08:00.000-08:002011-01-16T09:15:07.670-08:00256-Bit Based Hardware Encryption on WD MyBook Essential<div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;">Western Digital’s refreshed My Book Essential external hard drive provides a simple, secure, and inexpensive home backup solution. With an enormous 2TB capacity, built-in WD SmartWare software, 256-bit built-in encryption with user password protection, there is very little not to like here. But, imagine what would happen if the hardware of the device is broken? For example, the PCB board of the hard drive is damaged by a power surge. Can data recovery engineer retrieve any user data by any conventional techniques? A test is being carried out on two 320GB WD MyBook Essential external hard drives for research purpose. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/11112010/photo5.PNG"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 300px; height: 224px; " src="http://computersciencelabs.com/CSLBlog/11112010/photo5.PNG" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;">Two drives are initialized by factory default setting and there are no user password being used. Use a hex editor to view the sector 0 and sector 1 from these two drives (as shown in the figure below respectively). Sector 0 is a Master Boot Record. Sector 1 contains a patterning data where it should be zero in a conventional hard drive. The patterning data are unique and different on two drives (as shown in the table below). </span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-size: medium; "><b><span class="Apple-style-span">Drive A</span></b><span class="Apple-style-span"> 0x E6 89 D2 0F D3 62 4C F8 3A 2E 7B B7 6A 7A FC BF</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-size: medium; "><b><span class="Apple-style-span">Drive B</span></b><span class="Apple-style-span"> 0x 3A 73 9F 10 1A 47 97 F2 9A 31 BB E5 CC 8F 97 50</span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/11112010/11349.PNG"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 300px; height: 365px; " src="http://computersciencelabs.com/CSLBlog/11112010/11349.PNG" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/11112010/11360.PNG"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 300px; height: 365px; " src="http://computersciencelabs.com/CSLBlog/11112010/11360.PNG" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div> <div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;">Assume that both PCB boards are now damaged by users and the drives are not spinning up anymore. </span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/11112010/photo%20(3).PNG"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 300px; height: 224px; " src="http://computersciencelabs.com/CSLBlog/11112010/photo%20(3).PNG" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div> <div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;">A compatible PCB is borrowed from a donor drive (as shown in the figure below). </span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/11112010/photo%20(4).PNG"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 300px; height: 224px; " src="http://computersciencelabs.com/CSLBlog/11112010/photo%20(4).PNG" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div> <div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;">Direct replacement of WD PCB is not going to work. The adaptive ROM content on the donor PCB needs to be recreated by ROM overlay modules on the platter. This can be achieved by firmware manipulation tool, which is not introduced here. The reason of using a SATA interface PCB instead of USB interface on a donor drive, it is because the firmware repair utilities don’t support USB interface for firmware manipulation. Once the ROM is regenerated and the PCB is attached to the failed hard drives, both hard drives are spinning up again and recognized by computer correctly. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;">Use a hex editor to view the same sectors again after replacing the PCB, sector 0 contains some data, which look like have been encrypted, and sector 1 contains zeros. Obviously, the contents are totally different to what they were seen before the PCB was swapped. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/11112010/11349-SATA.PNG"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 300px; height: 365px; " src="http://computersciencelabs.com/CSLBlog/11112010/11349-SATA.PNG" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/11112010/11360-sata.PNG"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 300px; height: 365px; " src="http://computersciencelabs.com/CSLBlog/11112010/11360-sata.PNG" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div> <div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;">Based on the test above, the original PCB utilizes an encryption feature where the decryption key is unique to a hard drive. Even the sectors are become accessible through a donor PCB, the user files are still not recoverable without the original PCB being fixed. The patterning data stored at sector 1 and some following sectors where they should contain zeros are the key parameter to the decryption process. But there is only the WD knows the decryption algorithm until someone else is able to disclose it by reverse engineering. Bear in mind that, the patterning data will be unknown without the original PCB is working. So, to find out the key parameter, the controller chip and/or the firmware modules have to be look</span></span><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;">ed at. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span"><span class="Apple-style-span" style="font-size: medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" ><span class="Apple-style-span"><span class="Apple-style-span"><span class="Apple-style-span" style="border-collapse: collapse; color: rgb(51, 51, 51); line-height: 18px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><i><b>Written by: Zijian Xie (R&D Manager, MSc,</b></i></span></span></span><span class="Apple-style-span" style="border-collapse: collapse; color: rgb(51, 51, 51); line-height: 18px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><i><b>BEng</b></i></span><span class="Apple-style-span" style="border-collapse: collapse; color: rgb(51, 51, 51); line-height: 18px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><i><b>)</b></i></span></span></div>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com27tag:blogger.com,1999:blog-976297827830212187.post-80565724862179923362010-10-14T06:39:00.000-07:002011-03-22T08:42:22.812-07:00Deleted Microsoft SQL Database Recovery Case StudyThe video will show how we use the File Defragmentation Technique (FDT) to retrieve a accidentally deleted Microsoft SQL database (SQL2000, SQL2005, SQL2008). A comparison on the recovery performance between conventional DR method and FDT will be given too. <div><br /></div><div>(Keyword: Forensic MDF Recovery, SQL Recovery, SQL Deletion Recovery)<br /><br /><embed src="http://www.youtube.com/v/jiObGrQH2qE?fs=" hl="en_US" width="480" height="385" type="application/x-shockwave-flash" allowfullscreen="true" allowscriptaccess="always"></embed></div>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com6tag:blogger.com,1999:blog-976297827830212187.post-12486243814992840272010-09-20T04:45:00.000-07:002010-09-20T05:14:37.317-07:00Windows Dynamic Disks (LDM)<div><span class="Apple-style-span">VBLK is the most important parameter in the LDM database. The best way to examine it is to use 'dmdiag.ext' which can be downloaded from the Windows website. It helps us to recreate the logical disk structure. I created a group of dynamics disks under Windows, consists of two physical drives. </span><span class="Apple-style-span" style="font-family: arial; ">Volumes are:</span></div><div><span class="Apple-style-span">1. Spanned (purple);</span></div><div><span class="Apple-style-span">2. Stripped (green); </span></div><div><span class="Apple-style-span">3. Simple (yellow); </span></div><div><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://www.computersciencelabs.com/CSLBlog/20092010/WindowsLDM_1.PNG"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 628px; height: 100px;" src="http://www.computersciencelabs.com/CSLBlog/20092010/WindowsLDM_1.PNG" border="0" alt="" /></a><br /><br /></div><div>Run the 'dmdiag.exe', we have:</div><div><br /></div><div><table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none;mso-border-alt:solid black .5pt; mso-border-themecolor:text1;mso-yfti-tbllook:1184;mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-border-insideh:none;mso-border-insidev:none"> <tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes"> <td width="638" valign="top" style="width:6.65in;border:solid black 1.0pt; mso-border-themecolor:text1;border-bottom:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 48: type=0x0034 flags=0x0000 gen_flags=0x0004 size=156<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 14 15<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Disk: Disk2 rid=0.1030 updated=0.1094<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> assoc: diskid=a5820739-c02a-4ed9-9b13-009f5a4ff6a0 lastdevice=IDE\DISKWDC_WD800BB-00CAA1______________________17.07W17\4457572D414D4538363336303834_030_0_0_0_0<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags: <o:p></o:p></span></span></span></p> </td> </tr> <tr> <td width="638" valign="top" style="width:6.65in;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-bottom-alt:solid black .5pt; mso-border-bottom-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><o:p><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> </span></span></o:p></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 55: type=0x0034 flags=0x0000 gen_flags=0x0004 size=156<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 6 9<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Disk: Disk1 rid=0.1027 updated=0.1103<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> assoc: diskid=aab20507-ea67-4952-ac74-82d1a6abb42a lastdevice=IDE\DISKMAXTOR_6Y080L0__________________________YAR41BW0\3259513133444535202020202020202020202020<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags: <o:p></o:p></span></span></span></p> </td> </tr></tbody></table></div><div><table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none;mso-border-alt:solid black .5pt; mso-border-themecolor:text1;mso-yfti-tbllook:1184;mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-border-insideh:none;mso-border-insidev:none"> <tbody><tr> <td width="638" valign="top" style="width:6.65in;border:solid black 1.0pt; mso-border-themecolor:text1;border-bottom:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 36: type=0x0033 flags=0x0000 gen_flags=0x0004 size=51<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 13<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Subdisk: Disk1-01 rid=0.1076 updated=0.1077<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> info: disk=0.1027 offset=0 len=20480000 hidden=0<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> assoc: plex=0.1074 (column=0 offset=0)<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags:<o:p></o:p></span></span></span></p> </td> </tr> <tr> <td width="638" valign="top" style="width:6.65in;border-top:none;border-left: solid black 1.0pt;mso-border-left-themecolor:text1;border-bottom:none; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-left-alt: solid black .5pt;mso-border-left-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><o:p><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> </span></span></o:p></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 42: type=0x0033 flags=0x0000 gen_flags=0x0004 size=50<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 16<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Subdisk: Disk1-02 rid=0.1081 updated=0.1082<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> info: disk=0.1027 offset=20480000 len=10240000 hidden=0<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> assoc: plex=0.1074 (column=0 offset=20480000)<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags: <o:p></o:p></span></span></span></p> </td> </tr> <tr> <td width="638" valign="top" style="width:6.65in;border-top:none;border-left: solid black 1.0pt;mso-border-left-themecolor:text1;border-bottom:none; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-left-alt: solid black .5pt;mso-border-left-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><o:p><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> </span></span></o:p></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 51: type=0x0033 flags=0x0000 gen_flags=0x0004 size=51<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 20<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Subdisk: Disk1-03 rid=0.1091 updated=0.1094<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> info: disk=0.1027 offset=30720000 len=30720000 hidden=0<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> assoc: plex=0.1089 (column=0 offset=0)<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags: <o:p></o:p></span></span></span></p> </td> </tr> <tr> <td width="638" valign="top" style="width:6.65in;border-top:none;border-left: solid black 1.0pt;mso-border-left-themecolor:text1;border-bottom:none; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-left-alt: solid black .5pt;mso-border-left-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><o:p><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> </span></span></o:p></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 58: type=0x0033 flags=0x0000 gen_flags=0x0004 size=51<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 22<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Subdisk: Disk1-04 rid=0.1102 updated=0.1103<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> info: disk=0.1027 offset=61440000 len=98635377 hidden=0<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> assoc: plex=0.1100 (column=0 offset=0)<o:p></o:p></span></span></span></p> </td> </tr> <tr> <td width="638" valign="top" style="width:6.65in;border-top:none;border-left: solid black 1.0pt;mso-border-left-themecolor:text1;border-bottom:none; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-left-alt: solid black .5pt;mso-border-left-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><o:p><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> </span></span></o:p></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 46: type=0x0033 flags=0x0000 gen_flags=0x0004 size=51<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 17<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Subdisk: Disk2-01 rid=0.1084 updated=0.1085<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> info: disk=0.1030 offset=0 len=20480000 hidden=0<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> assoc: plex=0.1074 (column=0 offset=30720000)<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags: <o:p></o:p></span></span></span></p> </td> </tr> <tr> <td width="638" valign="top" style="width:6.65in;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-bottom-alt:solid black .5pt; mso-border-bottom-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><o:p><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> </span></span></o:p></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 52: type=0x0833 flags=0x0000 gen_flags=0x0004 size=53<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 21<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Subdisk: Disk2-02 rid=0.1093 updated=0.1094<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> info: disk=0.1030 offset=20480000 len=30720000 hidden=0<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> assoc: plex=0.1089 (column=1 offset=0)<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags: <o:p></o:p></span></span></span></p> </td> </tr></tbody></table></div><div><table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none;mso-border-alt:solid black .5pt; mso-border-themecolor:text1;mso-yfti-tbllook:1184;mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-border-insideh:none;mso-border-insidev:none"> <tbody><tr> <td width="638" valign="top" style="width:6.65in;border:solid black 1.0pt; mso-border-themecolor:text1;border-bottom:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 45: type=0x0032 flags=0x0000 gen_flags=0x0004 size=48<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 12<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Plex: Volume1-01 rid=0.1074 update=0.1085<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> type: layout=CONCAT<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> state: state=ACTIVE<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> assoc: vol=0.1072<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags: <o:p></o:p></span></span></span></p> </td> </tr> <tr> <td width="638" valign="top" style="width:6.65in;border-top:none;border-left: solid black 1.0pt;mso-border-left-themecolor:text1;border-bottom:none; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-left-alt: solid black .5pt;mso-border-left-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><o:p><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> </span></span></o:p></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 50: type=0x1032 flags=0x0000 gen_flags=0x0004 size=52<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 19<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Plex: Stripe1-01 rid=0.1089 update=0.1094<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> type: layout=STRIPE columns=2 width=128<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> state: state=ACTIVE<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> assoc: vol=0.1087<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags: <o:p></o:p></span></span></span></p> </td> </tr> <tr> <td width="638" valign="top" style="width:6.65in;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-bottom-alt:solid black .5pt; mso-border-bottom-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><o:p><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> </span></span></o:p></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 57: type=0x0032 flags=0x0000 gen_flags=0x0004 size=48<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 18<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Plex: Volume2-01 rid=0.1100 update=0.1103<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> type: layout=CONCAT<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> state: state=ACTIVE<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> assoc: vol=0.1098<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags: <o:p></o:p></span></span></span></p> </td> </tr></tbody></table></div><div><table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none;mso-border-alt:solid black .5pt; mso-border-themecolor:text1;mso-yfti-tbllook:1184;mso-padding-alt:0in 5.4pt 0in 5.4pt; mso-border-insideh:none;mso-border-insidev:none"> <tbody><tr> <td width="638" valign="top" style="width:6.65in;border:solid black 1.0pt; mso-border-themecolor:text1;border-bottom:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 44: type=0x0251 flags=0x0000 gen_flags=0x0004 size=84<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 10<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Volume: Volume1 rid=0.1072 update=0.1085 mountname=E:<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> info: len=51200000 guid=9546148a-73bd-491a-8ba2-2e6e87c303a0<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> type: parttype=6 usetype=gen<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> state: state=ACTIVE<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> policies: read=SELECT<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags: writeback<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><o:p><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> </span></span></o:p></span></p> </td> </tr> <tr> <td width="638" valign="top" style="width:6.65in;border-top:none;border-left: solid black 1.0pt;mso-border-left-themecolor:text1;border-bottom:none; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-left-alt: solid black .5pt;mso-border-left-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 60: type=0x0251 flags=0x0000 gen_flags=0x0004 size=84<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 8<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Volume: Volume2 rid=0.1098 update=0.1105 mountname=G:<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> info: len=98635377 guid=6f913350-77b3-4bed-99d6-96ef6da8cf2d<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> type: parttype=6 usetype=gen<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> state: state=ACTIVE<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> policies: read=SELECT<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags: writeback<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><o:p><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> </span></span></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:2;mso-yfti-lastrow:yes"> <td width="638" valign="top" style="width:6.65in;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-bottom-alt:solid black .5pt; mso-border-bottom-themecolor:text1;mso-border-right-alt:solid black .5pt; mso-border-right-themecolor:text1;padding:0in 5.4pt 0in 5.4pt"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Record 54: type=0x0251 flags=0x0000 gen_flags=0x0004 size=84<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span">#Blocks: 7<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> Volume: Stripe1 rid=0.1087 update=0.1096 mountname=F:<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> info: len=61440000 guid=9f16eb7d-1f88-4405-aede-3928d2859cb3<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> type: parttype=6 usetype=gen<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> state: state=ACTIVE<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> policies: read=SELECT<o:p></o:p></span></span></span></p> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span lang="EN-GB"><span class="Apple-style-span" style="font-size: x-small;"><span class="Apple-style-span"> flags: writeback</span></span><o:p></o:p></span></p> </td> </tr></tbody></table></div><div><br /></div><div>According to the information displayed above, the four layers Windows LDM structure can be recreated as:</div><div><br /></div><div><br /></div><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://www.computersciencelabs.com/CSLBlog/20092010/WindowsLDM_2.PNG"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 795px; height: 445px;" src="http://www.computersciencelabs.com/CSLBlog/20092010/WindowsLDM_2.PNG" border="0" alt="" /></a><br /><span class="Apple-style-span">Based on the this four-layered LDM structure, volumes can be recreated virtually using data recovery software. </span>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com5tag:blogger.com,1999:blog-976297827830212187.post-28002322375894913182010-08-26T09:23:00.000-07:002010-09-16T07:34:13.442-07:00RAID5 Parity Detection<div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">Today I am going to show you a new algorithm we just implemented to detect the parity location on each member drive of a RAID5. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">It doesn't reply on the file system of the RAID5. It can be used for Windows RAIDs, Linux RAIDs, MAC RAIDs and UNIX RAIDs. Even though the algorithm is not giving you a complete RAID configuration, the result generated by the application will indicate the strip size and the drives' sequence. The drives' sequence is different to drives' order. For example, a RAID5 has a drives' sequence of 3-2-0-1, the drives' order can be 2-0-1-3, 0-1-3-2, 1-0-2-3, etc. It depends on which drive is the first drive and the rotation direction of the RAID5. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">The example given in the video is a 4-disks Windows RAID5. According to the result, we worked out the strip size is 256 sectors and the drives' sequence is 4-3-2-1.</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /><object width="560" height="340"><param name="movie" value="http://www.youtube.com/v/JYdvSYynGKc?fs=1&hl=en_US"><param name="allowFullScreen" value="true"><param name="allowscriptaccess" value="always"><embed src="http://www.youtube.com/v/JYdvSYynGKc?fs=1&hl=en_US" type="application/x-shockwave-flash" allowscriptaccess="always" allowfullscreen="true" width="560" height="340"></embed></object><br /><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">This algorithm becomes extremely useful to work out the RAID configuration (strip size, drives' order, header size and rotation direction)when dealing with a RAID5 created by an unknown or a strange file system. We will discuss this further on our blog in the near future.</span></span></div><br /><br /><span style="font-weight:bold;"><span class="Apple-style-span" style="font-family:'times new roman';"><i>(Designed by Zijian Xie, R&D Manager, MSc, BEng)</i></span><span style="font-style:italic;"></span></span>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com3tag:blogger.com,1999:blog-976297827830212187.post-12263612628640502322010-08-10T02:38:00.000-07:002010-08-10T03:16:39.401-07:00Data Structure of Non-Standard Sector<div style="text-align: justify;"><span class="Apple-style-span" style=" ;font-family:arial;font-size:medium;">Today, details in identification of a non-standard sectored device will be introduced. </span></div><span class="Apple-style-span" style="font-family:arial;"><div style="text-align: justify;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></div><span class="Apple-style-span" style="font-size:medium;"><div style="text-align: justify;">In conventional storage systems, they are normally using a standard 512Byte sector unit to store user data. In order to achieve a lower BER (Bit Error Rate), addition CRC checksum is added after each 512Byte user data in high level storage systems. These addition bytes will ONLY be recognized by its RAID controller where the storage media is operating with. The RAID controller will eliminate the addition bytes before it passes the raw data to the operating system (Windows OS/Linux/etc.) from a non-standard sectored storage media. In another word, device users will not be able to tell if a non-standard sector scheme has been used or not in their systems. So as for data recovery companies, file systems will not be recognized by any recovery application if the hard drives from a non-standard sectored RAID controller are raw mounted under aliened computer. </div><div style="text-align: justify;"><br /></div><div style="text-align: justify;">As the figure shown below, 8 byte CRC checksum are attached to the end of each 512 byte user data, which results in data shifting after the sector 0. The DBR (DOS Boot Record) of NTFS file system (as content show beginning with “EB 52 90”) will be shifted to address offset 8 (as shown on the right in this example) instead of offset 0 where it is supposed to be (as shown on the left). As you can imagine, all the remaining content will be shifted accordingly. The shifting cycle is 64 times (=512/8). It means that you will see a standard sector of data without shifting every 64 blocks of 520 sectors. </div></span></span><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/10082010/non_standard_sector.jpg"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 558px; height: 302px;" src="http://computersciencelabs.com/CSLBlog/10082010/non_standard_sector.jpg" border="0" alt="" /></a><div><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size: small;"><br /></span></span></div><div><span class="Apple-style-span" style=" border-collapse: collapse; color: rgb(51, 51, 51); line-height: 18px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><i><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size: small;"><b>Written by: Zijian Xie (R&D Manager, BEng, MSc)</b></span></span></i></span></div>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com3tag:blogger.com,1999:blog-976297827830212187.post-42354028497118457062010-08-07T16:59:00.000-07:002010-08-10T03:17:22.183-07:00Winhex Template for Compound Document File Header<span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">I created a Winhex template for the Compound Document File header. Used the repaired Excel spreadsheet in the last article as an example, the template will look like:<br /><span class="Apple-style-span" style="font-family:Georgia, serif;color:#551A8B;"><u><span class="Apple-style-span" style="font-family:arial;color:#000000;"></span></u></span></span></span><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://www.computersciencelabs.com/CSLBlog/08082010/Compound%20File%20Header.PNG"><img style="display:block; margin:0px auto 10px; text-align:center;cursor:pointer; cursor:hand;width: 411px; height: 584px;" src="http://www.computersciencelabs.com/CSLBlog/08082010/Compound%20File%20Header.PNG" border="0" alt="" /></a></span></span><div><span class="Apple-style-span" style="font-family:arial;"><br /></span></div><div><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-family: 'trebuchet ms', verdana, arial, sans-serif; border-collapse: collapse; color: rgb(51, 51, 51); line-height: 18px; -webkit-border-horizontal-spacing: 2px; -webkit-border-vertical-spacing: 2px; "><i><span class="Apple-style-span" style="font-size: small;"><b>Written by: Zijian Xie (R&D Manager, BEng, MSc)</b></span></i></span></span></div>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com0tag:blogger.com,1999:blog-976297827830212187.post-8670144734628928962010-08-06T08:34:00.000-07:002010-08-06T09:33:16.611-07:00Microsoft Excel Document Repair<div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">Having read the paper of ‘MS Compound Document File Format’ again, I created a sector map to demonstrate the parameters in the file header. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/06082010/1.bmp"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 700px; height: 361px; " src="http://computersciencelabs.com/CSLBlog/06082010/1.bmp" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div> <div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">The green and blue parameters are the standard values. They are generic values except the revision number and the version number (which are normally not important at all). The red and yellow parameters are the critical ones which are used to construct the actual content in a spreadsheet. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">• SAT Size (sec) : The number of sectors that used by the Sector Allocation Table (SAT). </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">• First SecID of DIR : The SecID of the first sector that stores the Directory table (DIR). </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">• First SecID of SSAT : The SecID of the first sector that stores the Short Sector Allocation Table (SSAT). </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">• Size of SSAT(sec) : The number of sectors that used by the SSAT. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">• First SecID of MSAT : The SecID of the first sector that stores the Master Sector Allocation Table (MSAT). </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">• Size of MSAT : The number of sectors that used by the MSAT. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">• SecIDs of MSAT : The SecID chain that stores all the SecIDs used by the MSAT. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">Only the first 109 SecIDs of MSAT will be stored in the sector of file header. It will be padded by ‘0xFFFF’ if it has less than 109 SecIDs. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><i><br /></i></span></span></div><div style="text-align: left;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><i>(Note: If you need more explanations, please refer to </i></span></span><i><span style="line-height:115%;font-family:"Arial","sans-serif"; mso-fareast-mso-fareast-theme-font:minor-fareast;mso-ansi-language: EN-US;mso-fareast-language:ZH-CN;mso-bidi-language:AR-SAfont-family:宋体;font-size:11.0pt;"><a href="http://sc.openoffice.org/compdocfileformat.pdf">http://sc.openoffice.org/compdocfileformat.pdf</a>)</span></i><span class="Apple-style-span" style=" ;font-family:arial;"><span class="Apple-style-span" style=" ;font-size:medium;"><i> </i></span><span class="Apple-style-span" style=" ;font-size:medium;"><i><a href="http://sc.openoffice.org/compdocfileformat.pdf"></a></i></span><span class="Apple-style-span" style=" ;font-size:medium;"><i>)</i></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">Based on the concepts above, I am trying to repair a corrupted spreadsheet document manually, instead of using repair software. Open the file, it shows the content are corrupted:</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/06082010/2.bmp"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 425px; height: 257px; " src="http://computersciencelabs.com/CSLBlog/06082010/2.bmp" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span" style=" ;font-family:arial;font-size:medium;">Use Winhex to view the file (beginning), it shows:</span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/06082010/3.bmp"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 366px; height: 347px; " src="http://computersciencelabs.com/CSLBlog/06082010/3.bmp" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">Not saying the rest of the file, it is quite obvious that the file header (Page 1) is damage completely. As we know, the standard sector size of OLE2 document is 512 bytes. We can interpret the file as a hard disk, which makes it easier to examine the data structure. In Winhex, this file starts from sector 0 to sector 2327. This sector number is different to ‘SecID’ described in OLE2 document specification. They have a relationship as the table below:</span></span><span class="Apple-style-span" style=" ;font-family:Arial, sans-serif;font-size:medium;"> </span></div><div style="text-align: justify;"><span class="Apple-style-span" style=" ;font-family:Arial, sans-serif;font-size:medium;"><br /></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"> <div align="center"> <table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none;mso-border-alt:solid black .5pt; mso-border-thememso-yfti-tbllook:1184;mso-padding-alt:0in 5.4pt 0in 5.4ptcolor:text1;"> <tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;height:24.7pt"> <td width="80" style="width:60.05pt;border:solid black 1.0pt;mso-border-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themepadding: 0in 5.4pt 0in 5.4pt;height:24.7ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><b style="mso-bidi-font-weight: normal"><span style="Arial","sans-serif"font-family:";">OLE2<o:p></o:p></span></b></p> </td> <td width="80" style="width:59.65pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-left:none;mso-border-left-alt:solid black .5pt;mso-border-left-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themepadding: 0in 5.4pt 0in 5.4pt;height:24.7ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">Header<o:p></o:p></span></p> </td> <td width="79" style="width:59.55pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-left:none;mso-border-left-alt:solid black .5pt;mso-border-left-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themepadding: 0in 5.4pt 0in 5.4pt;height:24.7ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">SecID 0<o:p></o:p></span></p> </td> <td width="79" style="width:59.55pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-left:none;mso-border-left-alt:solid black .5pt;mso-border-left-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themepadding: 0in 5.4pt 0in 5.4pt;height:24.7ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">SecID 1<o:p></o:p></span></p> </td> <td width="79" style="width:59.6pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-left:none;mso-border-left-alt:solid black .5pt;mso-border-left-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themepadding: 0in 5.4pt 0in 5.4pt;height:24.7ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">Sec 2<o:p></o:p></span></p> </td> <td width="79" style="width:59.6pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-left:none;mso-border-left-alt:solid black .5pt;mso-border-left-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themepadding: 0in 5.4pt 0in 5.4pt;height:24.7ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">SecID 3<o:p></o:p></span></p> </td> <td width="53" style="width:39.9pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-left:none;mso-border-left-alt:solid black .5pt;mso-border-left-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themepadding: 0in 5.4pt 0in 5.4pt;height:24.7ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">…<o:p></o:p></span></p> </td> <td width="106" style="width:79.25pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-left:none;mso-border-left-alt:solid black .5pt;mso-border-left-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themepadding: 0in 5.4pt 0in 5.4pt;height:24.7ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">SecID N<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:1;mso-yfti-lastrow:yes;height:25.15pt"> <td width="80" style="width:60.05pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-top:none;mso-border-top-alt:solid black .5pt;mso-border-top-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themepadding: 0in 5.4pt 0in 5.4pt;height:25.15ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><b style="mso-bidi-font-weight: normal"><span style="Arial","sans-serif"font-family:";">Physical<o:p></o:p></span></b></p> </td> <td width="80" style="width:59.65pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:25.15ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">Sector 0<o:p></o:p></span></p> </td> <td width="79" style="width:59.55pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:25.15ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">Sector 1<o:p></o:p></span></p> </td> <td width="79" style="width:59.55pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:25.15ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">Sector 2<o:p></o:p></span></p> </td> <td width="79" style="width:59.6pt;border-top:none;border-left:none;border-bottom: solid black 1.0pt;mso-border-bottom-themecolor:text1;border-right:solid black 1.0pt; mso-border-right-themecolor:text1;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:25.15ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">Sector 3<o:p></o:p></span></p> </td> <td width="79" style="width:59.6pt;border-top:none;border-left:none;border-bottom: solid black 1.0pt;mso-border-bottom-themecolor:text1;border-right:solid black 1.0pt; mso-border-right-themecolor:text1;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:25.15ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">Sector 4<o:p></o:p></span></p> </td> <td width="53" style="width:39.9pt;border-top:none;border-left:none;border-bottom: solid black 1.0pt;mso-border-bottom-themecolor:text1;border-right:solid black 1.0pt; mso-border-right-themecolor:text1;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:25.15ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">…<o:p></o:p></span></p> </td> <td width="106" style="width:79.25pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:25.15ptcolor:text1;"> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;line-height:normal"><span style="Arial","sans-serif"font-family:";">SecID N+1<o:p></o:p></span></p> </td> </tr> </tbody></table> </div> <p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph">To repair the sector 0 (Header), we can copy the content of sector 0 from a working .xls file to replace the current damage one. This action will repair the standard values. Obviously, the critical parameters mentioned above need to be adjusted or recalculated. Thus, the places where need changing are:</p></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">1. SAT Size (sec) : offset 0x2C to 0x2F</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">2. First SecID of DIR : offset 0x30 to 0x33</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">3. First SecID of SSAT : offset 0x3C to 0x3F</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">4. Size of SSAT(sec) : offset 0x40 to 0x43</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">5. First SecID of MSAT : offset 0x44 to 0x47</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">6. Size of MSAT : offset 0x48 to 0x4B</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">7. SecIDs of MSAT : offset 0x4C to 0x1FF</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">If the file size is not bigger than 6.8MB, the content of place 5 and place 6 do not need changed. This is because 109 double words pointers will be enough to store the whole SAT. Place 5 will be ‘0xFEFFFFFF’ (-2) and place 6 will be ‘0x00000000’.</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">Let’s start to repair the critical parameters by finding the SAT first. SAT is very similar to FAT tables in FAT32 file system. It contains a multiple chains of sector pointers. Also, this is usually stored at the beginning area. Looking at sector 1, this is a sector used by the SAT obviously. The first double word of ‘0xFDFFFFFF’ indicates the current sector is used to store the SAT. There are another two ‘0xFDFFFFFF’ at this sector, which indicate SecID5 and SecID6 are also used by SAT. </span></span></div> <div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/06082010/4.bmp"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 676px; height: 348px; " src="http://computersciencelabs.com/CSLBlog/06082010/4.bmp" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span" style=" ;font-family:arial;font-size:medium;">At SecID6 (sector 7), we found another two pointers have a value of ‘0xFDFFFFFF’. They are SecID 308 and SecID 309 respectively. </span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/06082010/5.bmp"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 402px; height: 292px; " src="http://computersciencelabs.com/CSLBlog/06082010/5.bmp" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span" style=" ;font-family:arial;font-size:medium;">After a continuous searching, the SecIDs used by SAT are</span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><div align="center"> <table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none;mso-border-alt:solid black .5pt; mso-border-thememso-yfti-tbllook:1184;mso-padding-alt:0in 5.4pt 0in 5.4ptcolor:text1;"> <tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";"><b> SecID<o:p></o:p></b></span></p> </td> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-left:none;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";"><b>Physical Sector</b><o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:1;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">0<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">1<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:2;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">5<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">6<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:3;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">6<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">7<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:4;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">308<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">309<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:5;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">309<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">310<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:6;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">613<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">614<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:7;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">614<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">615<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:8;height:12.7pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:12.7ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">615<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:12.7ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">616<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:9;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">917<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">918<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:10;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">918<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">919<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:11;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">1221<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">1222<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:12;height:12.7pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:12.7ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">1222<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:12.7ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">1223<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:13;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">1524<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">1525<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:14;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">1525<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">1526<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:15;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">1526<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">1527<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:16;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">1830<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">1831<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:17;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">1831<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">1832<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:18;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">2164<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">2165<o:p></o:p></span></p> </td> </tr> <tr style="mso-yfti-irow:19;mso-yfti-lastrow:yes;height:13.25pt"> <td width="122" valign="top" style="width:91.45pt;border:solid black 1.0pt; mso-border-themecolor:text1;border-top:none;mso-border-top-alt:solid black .5pt; mso-border-top-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif"font-family:";">2187<o:p></o:p></span></p> </td> <td width="122" valign="bottom" style="width:91.45pt;border-top:none;border-left: none;border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themepadding:0in 5.4pt 0in 5.4pt;height:13.25ptcolor:text1;"> <p class="MsoNormal" style="text-align: left;margin-bottom: 0.0001pt; line-height: normal; "><span style="Arial","sans-serif";font-family:";color:black;">2188<o:p></o:p></span></p> </td> </tr> </tbody></table></div></span></span></div> <div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style=" ;font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">There are 19 sectors used by the SAT. Thus, Size of SAT and First SecID of SAT can be modified to:</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">Size of SAT = 19 (0x13000000)</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">First SecID of SAT = 0x00000000</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">Also, the field of SecIDs of SAT can be changed according to the table above. There are less than 109 SecIDs being used by SAT, thus:</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">First SecID of MSAT = 0xFEFFFFFF</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">Size of MSAT = 0x00000000</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">Directory table is always started with ‘ROOT ENTRY’. We search for a string of ‘ROOT ENTRY’ in UNICODE, and found sector 2 is used to store the DIR. Thus the First SecID of DIR is 0x01000000.</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/06082010/6.bmp"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 325px; height: 312px; " src="http://computersciencelabs.com/CSLBlog/06082010/6.bmp" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span" style=" ;font-family:arial;font-size:medium;">Regarding the SSAT, it will have a similar data structure as the SAT. But normally, it will have a shorter size in the length of the table. Checking through the first few sectors of the file, I found sector 3 should be the first sector of SSAT. </span></div> <div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/06082010/7.bmp"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 310px; height: 296px; " src="http://computersciencelabs.com/CSLBlog/06082010/7.bmp" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style=" ;font-family:arial;font-size:medium;">Thus, the First SecID of SSAT is 0x02000000. To check the next SecID from the SAT, we found a value of 0xFEFFFFFF at the offset of SecID 2, which indicates that the current SecID is the end of the current SID chain. In another word, the Size of SSAT is just a single sector, which has a value of 0x01000000. </span></div><div style="text-align: justify;"><span class="Apple-style-span" style=" ;font-family:arial;font-size:medium;"><br /></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">To replace the recalculated values in the file header, it will look like this:</span></span></div> <div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/06082010/8.bmp"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 463px; height: 441px; " src="http://computersciencelabs.com/CSLBlog/06082010/8.bmp" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span" style=" ;font-family:arial;font-size:medium;">Try to open the file and it is readable now. </span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/06082010/9.bmp"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 500px; height: 255px; " src="http://computersciencelabs.com/CSLBlog/06082010/9.bmp" border="0" alt="" /></a><div style="text-align: justify;"><span class="Apple-style-span" style=" ;font-family:arial;font-size:medium;">After manually recovered the file, I was interested to see if the recovery software can do anything or not. I tried a demo version of Excel Recovery software. Finally, the preview shows nothing apart from the sheet names. </span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="http://computersciencelabs.com/CSLBlog/06082010/10.bmp"><img style="text-align: justify;display: block; margin-top: 0px; margin-right: auto; margin-bottom: 10px; margin-left: auto; cursor: pointer; width: 521px; height: 308px; " src="http://computersciencelabs.com/CSLBlog/06082010/10.bmp" border="0" alt="" /></a><div><br /></div><div><span class="Apple-style-span" style="font-family: arial; font-size: 12px; color: rgb(34, 34, 34); line-height: 16px; -webkit-border-horizontal-spacing: 10px; -webkit-border-vertical-spacing: 10px; "><b><i><span class="Apple-style-span" style="font-size: small; ">Written by: Zijian Xie (R&D Manager, BEng, MSc)</span></i></b></span></div>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com2tag:blogger.com,1999:blog-976297827830212187.post-6703732996763682632010-07-30T02:35:00.001-07:002010-08-04T05:05:01.619-07:00SQL Defragmentation Technique<a onblur="try {parent.deselectBloggerImageGracefully();} catch(e) {}" href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNuXm4ooFyQE3TYc8nBmeSvSqZDMeJae1XQU_xN_c-HNlwktSUwBGOECadwuKz9mtlll8ruihlRWSIIKq8HAX3tF1dgUydo_O9dzIHf_3akYVIR6KcvBQqkxmdlXDWX1Ts94W9TrJiuhc/s1600/CSL+SQL+Recovery.bmp"><img style="float:left; margin:0 10px 10px 0;cursor:pointer; cursor:hand;width: 400px; height: 50px;" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhNuXm4ooFyQE3TYc8nBmeSvSqZDMeJae1XQU_xN_c-HNlwktSUwBGOECadwuKz9mtlll8ruihlRWSIIKq8HAX3tF1dgUydo_O9dzIHf_3akYVIR6KcvBQqkxmdlXDWX1Ts94W9TrJiuhc/s400/CSL+SQL+Recovery.bmp" border="0" alt="" id="BLOGGER_PHOTO_ID_5499639667783449330" /></a><span class="Apple-style-span" style="font-size:medium;"><br /></span><span class="Apple-style-span" style=" -webkit-border-horizontal-spacing: 10px; -webkit-border-vertical-spacing: 10px; font-family:Arial;font-size:12px;"><div align="center"><div style="text-align: justify;"><strong><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></strong></div><div style="text-align: justify;"><strong><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></strong></div><div style="text-align: justify;"><strong><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></strong></div><div style="text-align: justify;"><strong><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></strong></div><div style="text-align: justify;"><strong><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">The nature of an SQL database file</span></span></strong></div><div style="text-align: justify;"><strong><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></strong></div><span class="Apple-style-span" style="font-family:arial;"><div style="text-align: justify;"><span class="Apple-style-span" style="font-size:medium;">A database file is a data storage centre that consists of an organized collection of data for one or multiple users. The size of this data centre grows as the user's gradually introduce new data into it. When a database file is first created, the operating system will assign an area of the hard disk or RAID large enough to store this file. Due to the nature of the database, this initial area will not be large enough for the gradually rising amount of data. The operating system will then assign a new area to store the new data belonging to the database. Obviously, this operation will be continued as typically, the user(s) are adding to the database everyday. As a result, file fragments are generated.</span></div></span><p></p><p align="left"></p><div style="text-align: justify;"><strong><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></strong></div><div style="text-align: justify;"><strong><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">Why existing methods of recovery do not work</span></span></strong></div><div style="text-align: justify;"><strong><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></strong></div><span class="Apple-style-span" style="font-family:arial;"><div style="text-align: justify;"><span class="Apple-style-span" style="font-size:medium;">As we explained in the last article, when a database file is accidentally deleted, the metadata of this file is deleted at the same time. The fragments belonging to this deleted database will become anonymous without the associated metadata. To recover this file, the IT manager/DR technician will typically use a conventional recovery application. However, these applications are designed to retrieve files that have been accidentally deleted - they will be useless when being used to recover fragmented files, especially *.mdf file fragments.</span></div></span><p></p><p align="left"></p><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><b><span class="Apple-style-span" style="font-size:medium;"><br /></span></b></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><b><span class="Apple-style-span" style="font-size:medium;">MDF Page Structure and Deframentation Technique</span></b></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><b><span class="Apple-style-span" style="font-size:medium;"><br /></span></b></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">MDF file uses a standard database file format to store the tables and contents. The minimum storage unit is a Page. A page is an integer multiple of sectors. The number of sectors in a page is determined by different database application. For example, a Microsoft MDF file has 16 sectors in a page. So the page size is 8KB. Within a MDF file, it has a page structure as shown below:</span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><div align="center"> <table class="MsoTableGrid" border="1" cellspacing="0" cellpadding="0" style="border-collapse:collapse;border:none;mso-border-alt:solid black .5pt; mso-border-thememso-yfti-tbllook:1184;mso-padding-alt:0in 5.4pt 0in 5.4ptcolor:text1;"> <tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;height:33.6pt"> <td width="180" style="width:135.3pt;border:solid black 1.0pt;mso-border-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themecolor:text1;background: black;mso-background-themepadding:0in 5.4pt 0in 5.4pt;height: 33.6ptcolor:text1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";"><span class="Apple-style-span" style="color:#FFFFFF;">Page Sector Offset<o:p></o:p></span></span></b></p> </td> <td width="180" style="width:135.3pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-left:none;mso-border-left-alt:solid black .5pt;mso-border-left-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themecolor:text1;background: black;mso-background-themepadding:0in 5.4pt 0in 5.4pt;height: 33.6ptcolor:text1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";"><span class="Apple-style-span" style="color:#FFFFFF;">Page ID</span><o:p></o:p></span></b></p> </td> </tr> <tr style="mso-yfti-irow:1;height:33.6pt"> <td width="180" style="width:135.3pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-top:none;mso-border-top-alt:solid black .5pt;mso-border-top-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themecolor:text1;background: #D9D9D9;mso-background-thememso-background-themeshade:217; padding:0in 5.4pt 0in 5.4pt;height:33.6ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">0<o:p></o:p></span></b></p> </td> <td width="180" style="width:135.3pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themecolor: text1;background:#D9D9D9;mso-background-thememso-background-themeshade: 217;padding:0in 5.4pt 0in 5.4pt;height:33.6ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">Page ID = 0<o:p></o:p></span></b></p> </td> </tr> <tr style="mso-yfti-irow:2;height:33.6pt"> <td width="180" style="width:135.3pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-top:none;mso-border-top-alt:solid black .5pt;mso-border-top-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themecolor:text1;background: #D9D9D9;mso-background-thememso-background-themeshade:217; padding:0in 5.4pt 0in 5.4pt;height:33.6ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">16<o:p></o:p></span></b></p> </td> <td width="180" style="width:135.3pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themecolor: text1;background:#D9D9D9;mso-background-thememso-background-themeshade: 217;padding:0in 5.4pt 0in 5.4pt;height:33.6ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">Page ID = 1<o:p></o:p></span></b></p> </td> </tr> <tr style="mso-yfti-irow:3;height:33.6pt"> <td width="180" style="width:135.3pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-top:none;mso-border-top-alt:solid black .5pt;mso-border-top-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themecolor:text1;background: #D9D9D9;mso-background-thememso-background-themeshade:217; padding:0in 5.4pt 0in 5.4pt;height:33.6ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">32<o:p></o:p></span></b></p> </td> <td width="180" style="width:135.3pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themecolor: text1;background:#D9D9D9;mso-background-thememso-background-themeshade: 217;padding:0in 5.4pt 0in 5.4pt;height:33.6ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">Page ID = 2<o:p></o:p></span></b></p> </td> </tr> <tr style="mso-yfti-irow:4;height:33.6pt"> <td width="180" style="width:135.3pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-top:none;mso-border-top-alt:solid black .5pt;mso-border-top-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themecolor:text1;background: #D9D9D9;mso-background-thememso-background-themeshade:217; padding:0in 5.4pt 0in 5.4pt;height:33.6ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">48<o:p></o:p></span></b></p> </td> <td width="180" style="width:135.3pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themecolor: text1;background:#D9D9D9;mso-background-thememso-background-themeshade: 217;padding:0in 5.4pt 0in 5.4pt;height:33.6ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">Page ID = 3<o:p></o:p></span></b></p> </td> </tr> <tr style="mso-yfti-irow:5;height:33.6pt"> <td width="180" style="width:135.3pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-top:none;mso-border-top-alt:solid black .5pt;mso-border-top-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themecolor:text1;background: #D9D9D9;mso-background-thememso-background-themeshade:217; padding:0in 5.4pt 0in 5.4pt;height:33.6ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">64<o:p></o:p></span></b></p> </td> <td width="180" style="width:135.3pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themecolor: text1;background:#D9D9D9;mso-background-thememso-background-themeshade: 217;padding:0in 5.4pt 0in 5.4pt;height:33.6ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">Page ID = 4<o:p></o:p></span></b></p> </td> </tr> <tr style="mso-yfti-irow:6;height:33.6pt"> <td width="180" style="width:135.3pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-top:none;mso-border-top-alt:solid black .5pt;mso-border-top-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themecolor:text1;background: #D9D9D9;mso-background-thememso-background-themeshade:217; padding:0in 5.4pt 0in 5.4pt;height:33.6ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">…<o:p></o:p></span></b></p> </td> <td width="180" style="width:135.3pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themecolor: text1;background:#D9D9D9;mso-background-thememso-background-themeshade: 217;padding:0in 5.4pt 0in 5.4pt;height:33.6ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";"><o:p> </o:p></span></b></p> </td> </tr> <tr style="mso-yfti-irow:7;mso-yfti-lastrow:yes;height:35.25pt"> <td width="180" style="width:135.3pt;border:solid black 1.0pt;mso-border-themecolor: text1;border-top:none;mso-border-top-alt:solid black .5pt;mso-border-top-themecolor: text1;mso-border-alt:solid black .5pt;mso-border-themecolor:text1;background: #D9D9D9;mso-background-thememso-background-themeshade:217; padding:0in 5.4pt 0in 5.4pt;height:35.25ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">16*N<o:p></o:p></span></b></p> </td> <td width="180" style="width:135.3pt;border-top:none;border-left:none; border-bottom:solid black 1.0pt;mso-border-bottom-themecolor:text1; border-right:solid black 1.0pt;mso-border-right-themecolor:text1;mso-border-top-alt: solid black .5pt;mso-border-top-themecolor:text1;mso-border-left-alt:solid black .5pt; mso-border-left-themecolor:text1;mso-border-alt:solid black .5pt;mso-border-themecolor: text1;background:#D9D9D9;mso-background-thememso-background-themeshade: 217;padding:0in 5.4pt 0in 5.4pt;height:35.25ptcolor:background1;"> <p class="MsoNormal" align="center" style="text-align:center"><b><span lang="EN-GB" style="font-family:";">Page ID = N<o:p></o:p></span></b></p> </td> </tr> </tbody></table></div></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;">MDF pages will be arranged in a sequential order based on the Page ID stored in a page header within a MDF file. Obviously, pages will be fragmented because of the nature of a database file as mentioned above. The SQL Defragmentation Technique is going to locate each piece of fragments by looking at the Page IDs in the page headers and then resemble them in a correct order. </span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><b><i><span class="Apple-style-span" style="font-size:medium;"><br /></span></i></b></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><b><i><span class="Apple-style-span" style="font-size:small;">Written by: Zijian Xie (R&D Manager, BEng, MSc)</span></i></b></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><b><span class="Apple-style-span" style="font-size:medium;"><br /></span></b></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><b><span class="Apple-style-span" style="font-size:medium;"><br /></span></b></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><b><span class="Apple-style-span" style="font-size:medium;"><br /></span></b></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><b><span class="Apple-style-span" style="font-size:medium;"><br /></span></b></span></div><strong><div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><i><span class="Apple-style-span" style="font-size:medium;"><br /></span></i></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-weight: normal; "><strong><span class="Apple-style-span" style="font-family:arial;"><i><span class="Apple-style-span" style="font-size:medium;"><br /></span></i></span></strong></span></div><div style="text-align: justify;"><span class="Apple-style-span" style="font-weight: normal; "><strong><span class="Apple-style-span" style="font-family:arial;"><i><span class="Apple-style-span" style="font-size:medium;"><br /></span></i></span></strong></span></div></strong></div><div align="left"><p></p></div></span>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com0tag:blogger.com,1999:blog-976297827830212187.post-61318248151333632552010-07-30T02:12:00.000-07:002010-07-30T04:32:20.419-07:00File Fragmentation and Defragmentation<div style="text-align: justify;"><span class="Apple-style-span" style="font-family:arial;"><p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;text-align: justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">After a partition and a formation on a computer hard drive, all the sectors in user data area belong to this partition are marked as ‘Not in Use’. A number of new files will be introduced to and stored on these usable sectors sequentially and consecutively. A sequence of user data sectors are marked as ‘Occupied’ (coloured as shown in the figure below).</span></span><span style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;"><o:p></o:p></span></span></p> <table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="501" style="width:376.0pt;margin-left:4.85pt;border-collapse:collapse;mso-yfti-tbllook: 1184;mso-padding-alt:0in 0in 0in 0in"> <tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;mso-yfti-lastrow:yes; height:14.25pt"> <td width="115" nowrap="" valign="bottom" style="width:86.0pt;border:solid windowtext 1.0pt; background:yellow;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File0</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="64" nowrap="" valign="bottom" style="width:48.0pt;border:solid windowtext 1.0pt; border-left:none;background:#C00000;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File1</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="84" nowrap="" valign="bottom" style="width:63.0pt;border:solid windowtext 1.0pt; border-left:none;background:#00B050;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File2</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="76" nowrap="" valign="bottom" style="width:57.0pt;border:solid windowtext 1.0pt; border-left:none;background:#FDE9D9;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File3</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="99" nowrap="" valign="bottom" style="width:74.0pt;border:solid windowtext 1.0pt; border-left:none;background:#DBEEF3;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;">File4</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="64" nowrap="" valign="bottom" style="width:48.0pt;border:solid windowtext 1.0pt; border-left:none;background:#C2D69A;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File5</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> </tr> </tbody></table> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; text-align:justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span lang="EN-GB" style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">When some of the files are deleted or removed, the corresponding sector will become ‘Not in Use’ again. In this example, File0, File3 and File5 are deleted for demonstration.</span></span><span style=" color: rgb(34, 34, 34); font-family:'Times New Roman', serif;"><span class="Apple-style-span" style="font-size:medium;"><o:p></o:p></span></span></p> <table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="501" style="width:376.0pt;margin-left:4.85pt;border-collapse:collapse;mso-yfti-tbllook: 1184;mso-padding-alt:0in 0in 0in 0in"> <tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;mso-yfti-lastrow:yes; height:14.25pt"> <td width="115" nowrap="" valign="bottom" style="width:86.0pt;border:solid windowtext 1.0pt; padding:0in 5.4pt 0in 5.4pt;height:14.25pt"></td> <td width="64" nowrap="" valign="bottom" style="width:48.0pt;border:solid windowtext 1.0pt; border-left:none;background:#C00000;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File1</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="84" nowrap="" valign="bottom" style="width:63.0pt;border:solid windowtext 1.0pt; border-left:none;background:#00B050;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File2</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="76" nowrap="" valign="bottom" style="width:57.0pt;border:solid windowtext 1.0pt; border-left:none;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"></td> <td width="99" nowrap="" valign="bottom" style="width:74.0pt;border:solid windowtext 1.0pt; border-left:none;background:#DBEEF3;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;">File4</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="64" nowrap="" valign="bottom" style="width:48.0pt;border:solid windowtext 1.0pt; border-left:none;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"></td> </tr> </tbody></table> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; text-align:justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span lang="EN-GB" style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">Another new file of File6 is introduced and stored on sectors that marked as ‘Not in use’. As a result, File6 has three pieces of fragments.</span></span><span style=" color: rgb(34, 34, 34); font-family:'Times New Roman', serif;"><span class="Apple-style-span" style="font-size:medium;"><o:p></o:p></span></span></p> <table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="501" style="width:376.0pt;margin-left:4.85pt;border-collapse:collapse;mso-yfti-tbllook: 1184;mso-padding-alt:0in 0in 0in 0in"> <tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;mso-yfti-lastrow:yes; height:14.25pt"> <td width="115" nowrap="" valign="bottom" style="width:86.0pt;border:solid windowtext 1.0pt; background:#00B0F0;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><a name="OLE_LINK1"><span style=" ;font-family:Arial, sans-serif;color:black;">File6</span></a><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="64" nowrap="" valign="bottom" style="width:48.0pt;border:solid windowtext 1.0pt; border-left:none;background:#C00000;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File1</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="84" nowrap="" valign="bottom" style="width:63.0pt;border:solid windowtext 1.0pt; border-left:none;background:#00B050;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File2</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="76" nowrap="" valign="bottom" style="width:57.0pt;border:solid windowtext 1.0pt; border-left:none;background:#00B0F0;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File6</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="99" nowrap="" valign="bottom" style="width:74.0pt;border:solid windowtext 1.0pt; border-left:none;background:#DBEEF3;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;">File4</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="64" nowrap="" valign="bottom" style="width:48.0pt;border:solid windowtext 1.0pt; border-left:none;background:#00B0F0;padding:0in 5.4pt 0in 5.4pt;height:14.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File6</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> </tr> </tbody></table> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; text-align:justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">File6 is deleted accidentally by user, what happens to the sector map is the fragments belong to File6 are marked as ‘Not in Use’ (as in grey) again:</span></span><span style=" color: rgb(34, 34, 34); font-family:'Times New Roman', serif;"><span class="Apple-style-span" style="font-size:medium;"><o:p></o:p></span></span></p> <table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="505" style="width:378.55pt;margin-left:4.85pt;border-collapse:collapse;mso-yfti-tbllook: 1184;mso-padding-alt:0in 0in 0in 0in"> <tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;mso-yfti-lastrow:yes; height:10.25pt"> <td width="112" nowrap="" valign="bottom" style="width:84.2pt;border:solid windowtext 1.0pt; background:#D8D8D8;padding:0in 5.4pt 0in 5.4pt;height:10.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:10.25pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File6</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="62" nowrap="" valign="bottom" style="width:46.85pt;border:solid windowtext 1.0pt; border-left:none;background:#C00000;padding:0in 5.4pt 0in 5.4pt;height:10.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:10.25pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File1</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="90" nowrap="" valign="bottom" style="width:67.5pt;border:solid windowtext 1.0pt; border-left:none;background:#00B050;padding:0in 5.4pt 0in 5.4pt;height:10.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:10.25pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File2</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="78" nowrap="" valign="bottom" style="width:58.5pt;border:solid windowtext 1.0pt; border-left:none;background:#D8D8D8;padding:0in 5.4pt 0in 5.4pt;height:10.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:10.25pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File6</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="94" nowrap="" valign="bottom" style="width:70.85pt;border:solid windowtext 1.0pt; border-left:none;background:#DBEEF3;padding:0in 5.4pt 0in 5.4pt;height:10.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:10.25pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File4</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="68" nowrap="" valign="bottom" style="width:50.65pt;border:solid windowtext 1.0pt; border-left:none;background:#D8D8D8;padding:0in 5.4pt 0in 5.4pt;height:10.25pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:10.25pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File6</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> </tr> </tbody></table> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; text-align:justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">To recover this deleted File6, the recovery application locates the starting sector of this file by looking at the file header. But it will always assume that this file was stored consecutively without fragments. As a result, the recovered File6 is going to be looked like this:</span></span><span style=" color: rgb(34, 34, 34); font-family:'Times New Roman', serif;"><span class="Apple-style-span" style="font-size:medium;"><o:p></o:p></span></span></p> <table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="505" style="width:378.55pt;margin-left:4.85pt;border-collapse:collapse;mso-yfti-tbllook: 1184;mso-padding-alt:0in 0in 0in 0in"> <tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;mso-yfti-lastrow:yes; height:12.95pt"> <td width="265" nowrap="" valign="bottom" style="width:198.55pt;border:solid windowtext 1.0pt; background:red;padding:0in 5.4pt 0in 5.4pt;height:12.95pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">Recovered File6</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="78" nowrap="" valign="bottom" style="width:58.5pt;border:solid windowtext 1.0pt; border-left:none;background:#D8D8D8;padding:0in 5.4pt 0in 5.4pt;height:12.95pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File6</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="94" nowrap="" valign="bottom" style="width:70.85pt;border:solid windowtext 1.0pt; border-left:none;background:#DBEEF3;padding:0in 5.4pt 0in 5.4pt;height:12.95pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File4</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="68" nowrap="" valign="bottom" style="width:50.65pt;border:solid windowtext 1.0pt; border-left:none;background:#D8D8D8;padding:0in 5.4pt 0in 5.4pt;height:12.95pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; line-height:normal"><span style=" ;font-family:Arial, sans-serif;color:black;">File6</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> </tr> </tbody></table> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; text-align:justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span lang="EN-GB" style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">Obviously, the recovered File6 contains the first fragment of File6 and content from File1 and File2. Even though this file is opened, it will be corrupted.</span></span><span style=" color: rgb(34, 34, 34); font-family:'Times New Roman', serif;"><span class="Apple-style-span" style="font-size:medium;"><o:p></o:p></span></span></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; text-align:justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span lang="EN-GB" style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">To use a conventional recovery application to recover the lost/deleted files from hard drives, it is quite common that the files are corrupted or partial corrupted when they are opened. For example, a JPEG is partially corrupted, a word document is unable to open due to data corruption or it is opened but with all unknown characters and so on. This problem will become severed and fatal when the lost file type is database format (MS SQL, MS Access, Oracle, etc.) .</span></span><span style=" color: rgb(34, 34, 34); font-family:'Times New Roman', serif;"><span class="Apple-style-span" style="font-size:medium;"><o:p></o:p></span></span></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; text-align:justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span style=" color: rgb(34, 34, 34); font-family:'Times New Roman', serif;"><o:p><span class="Apple-style-span" style="font-size:medium;"> </span></o:p></span></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; text-align:justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span lang="EN-GB" style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">All these kinds of lost files mentioned above are deemed as unrecoverable files, because:</span></span><span style=" color: rgb(34, 34, 34); font-family:'Times New Roman', serif;"><span class="Apple-style-span" style="font-size:medium;"><o:p></o:p></span></span></p> <p class="MsoNormal" style="margin-top:0in;margin-right:0in;margin-bottom:3.0pt; margin-left:0in;text-align:justify;text-justify:inter-ideograph;text-indent: 0in;line-height:normal;mso-list:l0 level1 lfo1;tab-stops:list .5in"><span style=" color: rgb(34, 34, 34); font-family:Symbol;"><span class="Apple-style-span" style="font-size:medium;">·</span><span style="font:7.0pt "Times New Roman""><span class="Apple-style-span" style="font-size:medium;"> </span></span></span><span lang="EN-GB" style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">1. Data sectors are overwritten after file deletion by introducing new files;</span></span><span style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;"><o:p></o:p></span></span></p> <p class="MsoNormal" style="margin-top:0in;margin-right:0in;margin-bottom:3.0pt; margin-left:0in;text-align:justify;text-justify:inter-ideograph;text-indent: 0in;line-height:normal;mso-list:l0 level1 lfo1;tab-stops:list .5in"><span style=" color: rgb(34, 34, 34); font-family:Symbol;"><span class="Apple-style-span" style="font-size:medium;">·</span><span style="font:7.0pt "Times New Roman""><span class="Apple-style-span" style="font-size:medium;"> </span></span></span><span lang="EN-GB" style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">2. In FAT32 file system hard drive, the MSB (Most Significant Bytes) of current file address are cleared to zero after its deletion. Without knowing the precise starting address of the deleted file, the recovery software will just assume the MSB is zero. Even though the recovered file has its original name and correct size base on this recovery algorithm, the file is still found to be corrupted after opening. Some advanced file recovery application has tried to solve this problem. But it is only working when the lost file has NO fragment on hard drive.</span></span><span style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;"><o:p></o:p></span></span></p> <p class="MsoNormal" style="margin-top:0in;margin-right:0in;margin-bottom:3.0pt; margin-left:0in;text-align:justify;text-justify:inter-ideograph;text-indent: 0in;line-height:normal;mso-list:l0 level1 lfo1;tab-stops:list .5in"><span style=" color: rgb(34, 34, 34); font-family:Symbol;"><span class="Apple-style-span" style="font-size:medium;">·</span><span style="font:7.0pt "Times New Roman""><span class="Apple-style-span" style="font-size:medium;"> </span></span></span><span lang="EN-GB" style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">3. Generally speaking, database files are stored in discrete sector areas as it grows every day. All the recovery applications assume that the files are stored in a successive and linear area on a hard drive. It is because they are not able to determine and find all the discrete fragments that belong to a deleted file.</span></span><span style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;"><o:p></o:p></span></span></p> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; text-align:justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span lang="EN-GB" style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">File Defragmentation (FD) technology is proposed in this article. File defragment is a term used to describe a process to search for all the fragments belong to a same file and reconstruct this file using the fragments found. Using this technology on the example above, the recovered File6 should look like this:</span></span><span style=" color: rgb(34, 34, 34); font-family:'Times New Roman', serif;"><span class="Apple-style-span" style="font-size:medium;"><o:p></o:p></span></span></p> <table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="505" style="width:378.55pt;margin-left:4.85pt;border-collapse:collapse;mso-yfti-tbllook: 1184;mso-padding-alt:0in 0in 0in 0in"> <tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;mso-yfti-lastrow:yes; height:9.35pt"> <td width="112" nowrap="" valign="bottom" style="width:84.2pt;border:solid windowtext 1.0pt; background:#D8D8D8;padding:0in 5.4pt 0in 5.4pt;height:9.35pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:9.35pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File6-1</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="62" nowrap="" valign="bottom" style="width:46.85pt;border:solid windowtext 1.0pt; border-left:none;background:#C00000;padding:0in 5.4pt 0in 5.4pt;height:9.35pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:9.35pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File1</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="90" nowrap="" valign="bottom" style="width:67.5pt;border:solid windowtext 1.0pt; border-left:none;background:#00B050;padding:0in 5.4pt 0in 5.4pt;height:9.35pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:9.35pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File2</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="78" nowrap="" valign="bottom" style="width:58.5pt;border:solid windowtext 1.0pt; border-left:none;background:#D8D8D8;padding:0in 5.4pt 0in 5.4pt;height:9.35pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:9.35pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File6-2</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="94" nowrap="" valign="bottom" style="width:70.85pt;border:solid windowtext 1.0pt; border-left:none;background:#DBEEF3;padding:0in 5.4pt 0in 5.4pt;height:9.35pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:9.35pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File4</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="68" nowrap="" valign="bottom" style="width:50.65pt;border:solid windowtext 1.0pt; border-left:none;background:#D8D8D8;padding:0in 5.4pt 0in 5.4pt;height:9.35pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:9.35pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File6-3</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> </tr> </tbody></table> <p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height: 10.35pt"><span style=" color: rgb(34, 34, 34); display: none; font-family:Arial, sans-serif;"><o:p> </o:p></span></p> <table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="258" style="width:193.35pt;margin-left:4.85pt;border-collapse:collapse;mso-yfti-tbllook: 1184;mso-padding-alt:0in 0in 0in 0in"> <tbody><tr style="mso-yfti-irow:0;mso-yfti-firstrow:yes;mso-yfti-lastrow:yes; height:10.7pt"> <td width="112" nowrap="" valign="bottom" style="width:84.2pt;border:solid windowtext 1.0pt; background:#D8D8D8;padding:0in 5.4pt 0in 5.4pt;height:10.7pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:10.7pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File6-1</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="78" nowrap="" valign="bottom" style="width:58.5pt;border:solid windowtext 1.0pt; border-left:none;background:#D8D8D8;padding:0in 5.4pt 0in 5.4pt;height:10.7pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:10.7pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File6-2</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> <td width="68" nowrap="" valign="bottom" style="width:50.65pt;border:solid windowtext 1.0pt; border-left:none;background:#D8D8D8;padding:0in 5.4pt 0in 5.4pt;height:10.7pt"> <p class="MsoNormal" style="mso-margin-top-alt:auto;margin-bottom:0in; margin-bottom:.0001pt;text-align:justify;text-justify:inter-ideograph; mso-line-height-alt:10.7pt"><span style=" ;font-family:Arial, sans-serif;color:black;">File6-3</span><span style=" ;font-family:'Times New Roman', serif;"><o:p></o:p></span></p> </td> </tr> </tbody></table> <p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; text-align:justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;">As a result, the deleted File6 is recovered successfully and it is 100% intact. If any fragments belong File6 have been overwritten, even the FD technology will not help anymore. This is simply because data has been magnetically overwritten or removed.</span></span><span style="font-family:"Times New Roman","serif"; mso-fareast-Times New Roman"font-family:";font-size:12.0pt;"><o:p></o:p></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; text-align:justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;"><br /></span></span></p><p class="MsoNormal" style="mso-margin-top-alt:auto;mso-margin-bottom-alt:auto; text-align:justify;text-justify:inter-ideograph;mso-line-height-alt:10.35pt"><span style=" color: rgb(34, 34, 34); font-family:Arial, sans-serif;"><span class="Apple-style-span" style="font-size:medium;"><span class="Apple-style-span" style="font-family: arial; font-size: 12px; line-height: 16px; -webkit-border-horizontal-spacing: 10px; -webkit-border-vertical-spacing: 10px; "><b><i><span class="Apple-style-span" style="font-size: small; ">Written by: Zijian Xie (R&D Manager, BEng, MSc)</span></i></b></span></span></span></p></span></div><p></p> <p class="MsoNormal" style="text-align:justify;text-justify:inter-ideograph"><span lang="EN-GB" style="mso-ansi-language:EN-GB"><o:p> </o:p></span></p>Zijian Xiehttp://www.blogger.com/profile/11763732328598462279noreply@blogger.com0