清除可移动媒体设备的扇区零

发布于 2024-09-24 14:05:10 字数 976 浏览 0 评论 0原文

我需要清除可移动媒体设备(自定义 USB 存储设备)的扇区 0,我一直试图在 WPF/C# 应用程序中清除该设备。我的第一次尝试是使用 DD,但遇到了问题。在设备制造过程中,MBR 在扇区 0 处创建,卷(逻辑?)从扇区 40 开始。当我发出以下命令时,它会清除扇区 40 而不是扇区 0:

dd bs=512 count=1 if=/dev/zero of=\.\E:

我在此处找到了 DD 的另一个版本,其中包含擦除实用程序。我尝试了这个版本,并且看到了相同的行为。我同时使用 HxD 和 Runtime 的 DiskExplorer,正在清除扇区 40,而不是扇区 0。我可以使用 HxD 或 Runtime 的 DiskExplorer,但这需要可编写脚本。

有谁知道 Windows XP SP2 中清除(填充)扇区 0 的任何其他方法吗?任何帮助将不胜感激。谢谢。

标记

解决方案:我的解决方案使用 WMI 根据逻辑驱动器号查找物理驱动器。首先,查询 Win32_LogicalDiskToPartition 类以查找我要查找的逻辑驱动器。这提供了 Antecedent 字段,其中包含类似“...DeviceID=”Disk #X, Partition #Y”的内容。接下来,我查询 Win32_DiskDriveToDiskPartition 类,同时搜索 Dependent 字段,以查找 Win32_LogicalDiskToPartition 类中 Antecedent 字段的匹配项。一旦找到,Win32_LogicalDiskToPartition 中的 Antecedent 字段将生成物理驱动器。我选择了 atzz,因为它最接近我的解决方案。我想采用尤金的建议,但我只有几个小时的时间来实现这一点,所以我选择了两者中更容易的一个。不过,我稍后需要重新审视这一点。

I need to clear sector 0 for removable media devices (custom USB memory devices) which I have been trying to clear within a WPF/C# application. My first attempt was to use DD, but I ran into problems. During the manufacturing of the devices a MBR is created at sector 0 and the volume (logical?) starts at sector 40. When I issue the following command it clears sector 40 and not sector 0:

dd bs=512 count=1 if=/dev/zero of=\.\E:

I found another version of DD here which includes a wipe utility. I tried this version and I am seeing the same behavior. I am using both HxD and Runtime's DiskExplorer that sector 40 is being cleared and not sector 0. I could use HxD or Runtime's DiskExplorer, but this needs to be scriptable.

Does anyone know of any other methods of clearing (filling) sector 0 within Windows XP SP2?? Any help would be greatly appreciated. Thanks.

Mark



Solution: My solution used WMI to find the physical drive based upon the logical drive letter. First, query the Win32_LogicalDiskToPartition class to find the logical drive I am looking for. This provides the Antecedent field which constains something like '...DeviceID="Disk #X, Partition #Y"'. Next, I query Win32_DiskDriveToDiskPartition class while searching against the Dependent field to find the match for the Antecedent field within the Win32_LogicalDiskToPartition class. Once found, the Antecedent field from Win32_LogicalDiskToPartition will yield the physical drive. I selected atzz since it is the closes to my solution. I wanted to use Eugene's suggestion, but I only had a few hours to implement this so I selected the easier of the two. I will need to revisit this at a later time though.

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(2

你的笑 2024-10-01 14:05:10

从 Windows 的角度来看,格式化 USB 驱动器有两种方法:

  • 作为软盘。在这种情况下,整个 USB 驱动器包含一个文件系统,其引导记录位于扇区 0。

  • 作为硬盘驱动器。在本例中,扇区 0 包含带有分区表的 MBR。实际的文件系统及其各自的引导记录位于驱动器的更远位置。

我认为你正在观察第二种情况。使用 \.\E: 来识别设备,最终会访问文件系统的引导记录而不是 MBR。

以下是访问 USB 驱动器的扇区 0 的方法。

  1. 此处加载 WinObj。
  2. 在 WinObj 中的 GLOBAL?? 下,找到 E:。它将是一个指向 \Device\Harddisk2\DP(1)0-0+30 之类的符号链接。
  3. GLOBAL?? 下,找到一个 PhysicalDrive# 符号链接,该符号链接引用您在步骤 2 中找到的同一 Harddisk#。它很可能具有与 Harddisk# 相同的数字后缀。例如:SymbolicLink PhysicalDrive2 指的是 \Device\Harddisk2\DR47
  4. 使用您在 DD 命令中找到的物理驱动器#:

    dd bs=512 count=1 if=\\.\PhysicalDrive2 of=mbr.dat

There are two ways to format a USB drive, from Windows standpoint:

  • As a floppy disk. In this case entire USB drive contains a single file system, and its boot record is located in sector 0.

  • As a hard drive. In this case, sector 0 contains MBR with partition table. Actual file system(s) with their individual boot records are located further on the drive.

I think you are observing the second case. Using \.\E: to identify the device, you end up accessing file system's boot record instead of MBR.

Here is how you can access sector 0 of the USB drive.

  1. Load WinObj from here.
  2. In WinObj, under GLOBAL??, find E:. It will be a SymbolicLink pointing to something like \Device\Harddisk2\DP(1)0-0+30.
  3. Under GLOBAL??, find a PhysicalDrive# symlink referring to the same Harddisk# that you found on step 2. Most probably it will have the same numeric suffix as Harddisk#. E.g.: SymbolicLink PhysicalDrive2 refers to \Device\Harddisk2\DR47.
  4. Use the PhysicalDrive# you've found in DD command:

    dd bs=512 count=1 if=\\.\PhysicalDrive2 of=mbr.dat

乱了心跳 2024-10-01 14:05:10

您正在尝试清除逻辑设备 E: 而不是物理设备。尝试执行以下操作:

调用 CreateFile() WinAPI 函数打开“\\.\PhysicalDriveX”,其中 X 是设备编号(有关如何正确打开物理设备的信息,请参阅 CreateFile 函数描述中的备注)。然后使用WriteFile API函数在打开的设备的偏移0处写入512字节。

如果您在打开设备进行写入时遇到权限被拒绝的错误,您可以使用我们的 RawDisk 产品(试用版)对你来说效果很好),这可以让人们绕过 Windows 的这一安全措施。

upd:至于从C#调用CreateFile,请参见PInvoke.net

You are trying to clear logical device E: and not physical device. Try doing the following:

call CreateFile() WinAPI function to open "\\.\PhysicalDriveX" where X is the number of the device (see Remarks in description of CreateFile function for information about how to open the physical device properly). Then use WriteFile API function to write 512 bytes at offset 0 of the opened device.

If you get permission denied error when opening the device for writing, you can take our RawDisk product (trial version will work fine for you) which lets one bypass this security measure of Windows.

upd: As for calling CreateFile from C#, see PInvoke.net.

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文