分区信息暂时未完
MBR结构,在数据库恢复中,若要手工填写分区表的话,只注意四个重要的地方,其它的可随便填。
#pragma pack(1) //字节对齐
typedef struct _PARTITION_ENTRY//分区表结构
{
UCHAR active; //状态(是否被激活) 重要
UCHAR StartHead; //分区起始磁头号
//UCHAR StartSector; //分区起始扇区和柱面号,高2位为柱面号的第 9,10 位, 高字节为柱面号的低 8 位
//UCHAR StartCylinder; // 起始磁盘柱面
USHORT StartSecCyli; //与63相位与得出的是开始扇区,把它右移6位就是开始柱面
UCHAR PartitionType; // 分区类型 重要
UCHAR EndHead; //分区结束磁头号
//UCHAR EndSector; //分区结束扇区
//UCHAR EndCylinder; // 结束柱面号
USHORT EndSecCyli; //与63相位与得出的就是结束扇区,把它右移6位就是结束柱面
ULONG StartLBA; // 扇区起始逻辑地址 重要
ULONG TotalSector; // 分区大小 重要
} PARTITION_ENTRY, *PPARTITION_ENTRY;
//引导区512BYTE结构
typedef struct _MBR_SECTOR
{
UCHAR BootCode[440];//启动记录440 Byte
ULONG DiskSignature;//磁盘签名
USHORT NoneDisk;//二个字节
PARTITION_ENTRY Partition[4];//分区表结构64 Byte
USHORT Signature;//结束标志2 Byte 55 AA
} MBR_SECTOR, *PMBR_SECTOR;
#pragma pack()
扩展分区暂时未写,代码基本上copy+理解,主要是学习并理解分区表
运行如图
void _ReadMbrPartiton(CListBox *listbox)
{
TCHAR szDevicename[64]={0};
char *drive = "1";
MBR_SECTOR _ReadMbr;
wsprintf(szDevicename,"\\\\.\\PHYSICALDRIVE%c",*drive);
HANDLE hDevice=CreateFile(szDevicename,
GENERIC_READ|GENERIC_WRITE,
FILE_SHARE_READ|FILE_SHARE_WRITE,
NULL,
OPEN_EXISTING,
0,
NULL);
if(hDevice == INVALID_HANDLE_VALUE)
{
//MessageBox("打开设备出错");
return;
}
memset(&_ReadMbr,0,sizeof(MBR_SECTOR));
DWORD leng = 512;
DWORD count;
DeviceIoControl(hDevice,FSCTL_LOCK_VOLUME,NULL,0,NULL,0,&count,NULL);
BOOL bcheck = ReadFile(hDevice,&_ReadMbr,512,&leng,NULL);
if (bcheck==FALSE || leng<512)
{
//MessageBox("读取MBR出错!");
DeviceIoControl(hDevice, FSCTL_UNLOCK_VOLUME, NULL, 0, NULL, 0, &count, NULL);
CloseHandle(hDevice);
return;
}
listbox->ResetContent();//清除
TCHAR * szTemp = new TCHAR[64];
//char * Temp = new char[64];
//for
for (int i=0;i<4;i++)
{
if (_ReadMbr.Partition[i].PartitionType==0)
{
continue;
}
memset(szTemp,0,64);
//memset(Temp,0,64);
if (_ReadMbr.Partition[i].active == 128)
{
strcat(szTemp,"Active ");
} else
{
strcat(szTemp,"NotActive ");
}
if (_ReadMbr.Partition[i].PartitionType==5 || _ReadMbr.Partition[i].PartitionType==15 )
{
strcat(szTemp,"Extended ");
}
listbox->AddString(szTemp);
memset(szTemp,0,64);
wsprintf(szTemp,"80=active partition:%02X",_ReadMbr.Partition[i].active);
listbox->AddString(szTemp);
memset(szTemp,0,64);
wsprintf(szTemp,"Start head:%d",_ReadMbr.Partition[i].StartHead);
listbox->AddString(szTemp);
memset(szTemp,0,64);
int temp = _ReadMbr.Partition[i].StartSecCyli;
wsprintf(szTemp,"Start sector:%d",temp & 63);
listbox->AddString(szTemp);
memset(szTemp,0,64);
wsprintf(szTemp,"Start cylinder:%d",temp>>6);
listbox->AddString(szTemp);
memset(szTemp,0,64);
wsprintf(szTemp,"Partition type indicator (hex):%02d",_ReadMbr.Partition[i].PartitionType);
listbox->AddString(szTemp);
memset(szTemp,0,64);
wsprintf(szTemp,"End head:%d",_ReadMbr.Partition[i].EndHead);
listbox->AddString(szTemp);
memset(szTemp,0,64);
temp = _ReadMbr.Partition[i].EndSecCyli;
wsprintf(szTemp,"End sector:%d",temp & 63);
listbox->AddString(szTemp);
memset(szTemp,0,64);
wsprintf(szTemp,"End cylinder:%d",temp>>6);
listbox->AddString(szTemp);
memset(szTemp,0,64);
wsprintf(szTemp,"Sectors preceding partition 1:%d",_ReadMbr.Partition[i].StartLBA);
listbox->AddString(szTemp);
memset(szTemp,0,64);
wsprintf(szTemp,"Sectors in partition 1:%d",_ReadMbr.Partition[i].TotalSector);
listbox->AddString(szTemp);
//若是扩展分区
if (_ReadMbr.Partition[i].PartitionType=15 || _ReadMbr.Partition[i].PartitionType==5)
{
BOOL bcon = TRUE;
//第一次进来保存 0扇区到扩展分区的绝对扇区
while (bcon)
{
//未完
}
}
}
//for
DeviceIoControl(hDevice, FSCTL_UNLOCK_VOLUME, NULL, 0, NULL, 0, &count, NULL);
CloseHandle(hDevice);
}