|
Look first (top 32 Bytes)
|
00000000
|
54
|
45
|
53
|
54
|
34 20 20
|
20
|
54
|
58
|
54 20 18
|
1D
|
27
|
5D
|
TEST4 TXT ..']
|
|
00000010
|
6B
|
3B
|
6B
|
3B
|
00 00 28
|
5D
|
6B
|
3B
|
00 00 00
|
00
|
00
|
00
|
k;k;..(]k;......
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Set into the table, offset 0x0A data 0x20, is a file, the file name is TEST4.TXT, file length is 0 bytes, empty file.
Last one:
|
000001E0
|
E5
|
49
|
52
|
31
|
31 20
|
20
|
20
|
20
|
20
|
20 10 08
|
2A
|
F7
|
5D
|
錓 R11
|
..*鱙
|
|
000001F0
|
6B
|
3B
|
6B
|
3B
|
00 00
|
F8
|
5D
|
6B
|
3B
|
16 00 00
|
02
|
00
|
00
|
k;k;..鴀 k;......
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Section 0 Byte is 0xE5, said that has been deleted. Look at paragraph 11:
|
00000140
|
44
|
49
|
52
|
31
|
20 20 20
|
20
|
20
|
20
|
20
|
10 08
|
C6
|
11
|
5D
|
DIR1
|
..?]
|
|
00000150
|
6B
|
3B
|
6C
|
3B
|
00 00 12
|
5D
|
6B
|
3B
|
0C
|
00 00
|
00
|
00
|
00
|
k;l;...]k;......
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Data offset 0x0A 0x10, is a subdirectory (folder), the name is DIR1, starting cluster number is 0x0C. Want to see the contents DIR1, we should jump to the cluster 0x0C position.
Here are the contents of a cluster 0x0C of Sector:
|
00000000
|
2E
|
20
|
20
|
20
|
20 20 20
|
20
|
20
|
20
|
20 10 00 C6
|
11
|
5D
|
.
|
|
..?]
|
|
00000010
|
6B
|
3B
|
6B
|
3B
|
00 00 12
|
5D
|
6B
|
3B
|
0C 00 00 00
|
00
|
00
|
k;k;
|
...
|
]k;......
|
|
|
00000020
|
2E
|
2E
|
20
|
20
|
20 20 20
|
20
|
20
|
20
|
20 10 00 C6
|
11
|
5D
|
..
|
|
..?]
|
|
00000030
|
6B
|
3B
|
6B
|
3B
|
00 00 12
|
5D
|
6B
|
3B
|
00 00 00 00
|
00
|
00
|
k;k;...
|
|
]k;......
|
|
|
00000040
|
E5
|
74
|
00
|
00
|
00 FF FF FF
|
FF FF FF 0F 00 20 FF FF
|
錿...
|
..
|
|
|
00000050
|
FF FF FF FF FF FF FF FF
|
FF FF 00 00 FF FF FF FF
|
..
|
|
00000060
|
E5
|
B0
|
65
|
FA 5E 28 00 59
|
00
|
29
|
00 0F 00 20
|
20
|
00
|
灏 e 鷁(.Y.)...
|
.
|
|
00000070
|
87
|
65
|
2C
|
67
|
87 65 63
|
68
|
2E
|
00
|
00 00 74 00
|
78
|
00
|
噀,g 噀 ch....
|
t.x.
|
|
00000080
|
E5
|
C2
|
BD A8 28 59 7E 31
|
54
|
58
|
54 20 00 22
|
2E
|
4F
|
迓建(Y~1TXT .".O
|
|
00000090
|
6C
|
3B
|
6C
|
3B
|
00 00 2F
|
4F
|
6C
|
3B
|
00 00 00 00
|
00
|
00
|
l;l;../Ol;......
|
|
|
000000A0
|
E5
|
31
|
46
|
31
|
20 20 20
|
20
|
54
|
58
|
54 20 18 22
|
2E
|
4F
|
?F1
|
|
TXT .".O
|
|
000000B0
|
6C
|
3B
|
6C
|
3B
|
00 00 51
|
4F
|
6C
|
3B
|
17 00 00 02
|
00
|
00
|
l;l;..QOl;......
|
|
|
000000C0
|
42
|
74
|
00
|
78
|
00 74 00
|
00
|
00
|
FF FF 0F 00 52 FF FF
|
Bt.x.t...
|
..R
|
|
000000D0
|
FF FF FF FF FF FF FF FF
|
FF FF 00 00 FF FF FF FF
|
..
|
|
|
000000E0
|
01
|
73 00 75 00 62 00 64
|
00 69 00 0F 00 52 72 00
|
.s.u.b.d.i...
|
Rr.
|
|
|
000000F0
|
31
|
00 66 00 69 00 6C 00
|
65 00 00 00 31 00 2E 00
|
1.f.i.l.e...
|
1...
|
|
|
00000100
|
53
|
55 42 44 49 52 7E 31
|
54 58 54 20 00 22 2E 4F
|
SUBDIR~1TXT .".O
|
|
|
00000110
|
6C
|
3B 6D 3B 00 00 E9 84
|
6D 3B 14 00 00 0E 00 00
|
l;m;..閯 m;......
|
|
|
|
00000120
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
00000130
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
00000140
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
00000150
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
00000160
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
00000170
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
00000180
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
00000190
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
000001A0
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
000001B0
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
000001C0
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
000001D0
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
000001E0
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
000001F0
|
00
|
00 00 00 00 00 00 00
|
00 00 00 00 00 00 00 00
|
................
|
|
|
|
