
HEADER
======

Hard Disk Header Size is usually 80 bytes long, see
at >0008 - 000B.



Byte Position
     Hex          Dec
>0000 - 0007 =   0 -  3 = Raw Header "MComprHD"
>0008 - 000B =   8 - 11 = Hard Disk Header Size, for instance >0000 0050
>000C - 000F =  12 - 15 = Drive Format Version
>0010 - 0013 =  16 - 19 = Flags Field
>0014 - 0017 =  20 - 23 = Compression Type. None=0
>0018 - 001B =  24 - 27 = Block Size (Sectors per Block), for instance >0000 0001
>001C - 001F =  28 - 31 = Total # of Blocks, i.e. >0001 3380
>0020 - 0023 =  32 - 35 = Total Cylinders, i.e. >0000 0267 for a 615 cylinder drive
>0024 - 0026 =  36 - 39 = Total Heads
>0028 - 002B =  40 - 43 = Sector per Track, >0000 0020 for 32 sectors per track
>002C - 003B =  44 - 59 = MD5 checksum for this drive 
>003C - 004B =  60 - 75 = MD5 checksum for parent drive
>004C - 004F =  76 - 79 = Sector Length, >0000 0100 for a sector of 256 bytes
                   
 
POINTER TO SECTORS TABLE 
========================

Map with Pointers to Sectors starts at >0050.
Each entry in the Map is 8 bytes long (16 nibbles). 
The first 5 nibbles (2 and  bytes) are the sector length, 
for instance "00100" for 256 byte/sector.

The last 11 nibbles (5 and  bytes) are the absolute pointer to sector start,
for instance 00000099C58.

This structure (11 nibbles for pointers) allow a maximum file of 
>100000000000 bytes (17,592,186,044,416 bytes, i.e. 17 Terabytes ), 
more than enough for current purposes.

At the end of Map with Pointers to Sectors there are the first 8 bytes of 
the string "EndOfListCookie". Thus, only ""EndOfLis" can be seen,
the remainder of the string is truncated. This string has been called
"End_Of_List_Cookie" by Raphael Nabet. Most probably has been inserted
so as to easily spot the Sector Zero Start with a file editor.

FINDING SECTOR ZERO
===================


Sector Zero (VIB=Volume Information Block) starts right after the 
End_Of_List_Cookie. 
Sector Zero Start Address [SZSA] can be easily worked out in the following way:
	1) Get Hard Disk Header Size [HDHS] 	(Bytes >0008 - 000B)
	2) Get Total # of Blocks     [T#OB]	(Bytes >001C - 001F)
	3) Get Sector Length 	     [SL] 	(Bytes >004C - 004F)
	
  SZSA = T#OB * 8 + HDHS + 8
  For instance, SZSA =  >00013380 * 8 + >0000 0050 + 8 = >0009C58
  
SECTOR ZERO STRUCTURE
=====================

- TOTAL NUMBER OF ALLOCATION UNITS
----------------------------------
Offset 10 (first byte being at offset 0).
Lenght: 2 bytes.
Contains the total number of Allocation Units
(AUs) on the disk. If the most significant nibble
at offset 16 is zero, then this number is 
the Total Number of Sectors too. Otherwise
is the power of "2" of that number plus 1. 

For instance, if the total AU found is >99C0
and the most significant nibble at offset 16 
is 1, then the Total Number of Sectors is 
>99C0 * 2 = >013380. This also means that 
each AU = 2 sectors. 

  
  
- "WIN" IDENTIFIER STRING
-------------------------
Offset 13 (first byte being at offset 0).
Lenght: 3 bytes.
In the Mess Hard Disk example file I have (9640News.HD) the 'WIN'
string that supposedly should be found at byte offset 13 
(first byte being at offset 0) is missing. This string is 
found in its place: >20, >01, >3A. I don't know the 
meaning...
However, the 'DIR' string that should be found at the same 
offset in the Directory Descriptor Record is indeed where 
it should be. 

- HARD DISK PARAMETERS - SECTOR PER ALLOCATION UNIT
---------------------------------------------------
Offset 16 (first byte being at offset 0).
Lenght: 2 bytes. 
Only the most significant nibble of byte 
at offset 16 is meaningful. It is the 
Sector per Allocation Unit and determines
how many sectors correspond to an AU. 



      +-------+---------+
      | Value | Sectors |
      +-------+---------+		
	0	1
	1	2
	2	4
	3	8
	4	16
	...	... and  so on
	
See also at Offset 10 (above). 
Also, that value influences all the 
pointers to Filenames and SubDirectories too. 
If more than zero, the pointers must be 
multiplied by the sectors in the above table.

- POINTERS TO SUBDIRECTORIES
----------------------------
Offset 28 (first byte being at offset 0).
Lenght: 2 bytes for each entry, used 
until end of sector. 
Up to 114 Pointers to Subdirectories can be 
stored here. 

To find the real sector address this value 
must be multipled by the Sector per Allocation Unit
(see Table at offset 16).






- POINTER TO TABLE WITH FILE DESCRIPTOR RECORD (FDR)
----------------------------------------------------
Offset 24 (first byte being at offset 0).
Lenght: 2 bytes. 
To find the real sector address where the table 
with all the pointers to FDR starts this value 
must be multipled by the Sector per Allocation Unit
(see Table at offset 16).



Paolo Bagnaresi, 2003 - paolo.bagnaresi@fastwebnet.it



	
	
	



