This article is more or less the follow-up to my article on: „Exploring the IBM MFM standard track format“ with the Deluxe Option Board and the „Transition Editor“ (TE).
What does an IBM standard MFM track with the KryoFlux look like? The following figures can be created directly with the KryoFlux while reading the RAW stream.
Exploring an IBM standard MFM track of a floppy disk
In all figures you always see the first track of the floppy disk, track 0.
First of all, I picked out a 5.25" (360K) floppy disk that had never been used and was not preformatted. You can see the result of the data flow in figure 1.
Then I formatted this disk on a true 360K floppy disk drive (TEAC FD-55BR) with DOS (DS, DD/MFM, 9 sectors, 40 tracks, 512 bytes/sector). You can see the result in figure 2. Clearly visible is the boot sector.
In order to locate an exact DATA area (see figure 1), I manually wrote the character „A“ exactly 512 times into the DATA sector 3 with a normal HEX editor. The result you can see in figure 3.
Figure 4 shows the scheme for the standard IBM MFM format of a floppy track.
The figure can be roughly divided into three parts. The first is the INDEX FIELD field, which appears only once at the beginning of a track. Then follows the repetition of ID FIELD and DATA FIELD. Finally a track is completed by the GAP 4B field.
In each sector there are always two characteristic address marks (AM). They start after SYNC 2 or 3 with 3 times A1h followed by a FEh or FBh. If the byte sequence is A1A1A1 FE, then it is the ID address mark (IDAM) and the ID with the CHSB information (4 bytes: Cylinder, Head, Sector, Bytes/Sector) follows. If the byte sequence is A1A1A1 FB, then it is the data address mark (DAM) and the actual data area of 512 bytes follows immediately.
Of particular importance is the DATA sector (yellow) of 512 bytes. Only in this area, the data/information itself is stored under DOS.
In figure 5 you can see two GRAPH's placed one on top of the other. GRAPH 1 from figure 3 and GRAPH 2.
The special thing about GRAPH 2 is that I used the „Deluxe Option Board Transition Editor (TE)“ to overwrite the whole area of sector 5 from address mark A1A1A1FE with the character „D“; without exception every byte! Of course the floppy is now defective! I did this to see the exact beginning and end of the sector.
You can NOT do this writing with a normal HEX editor. You also need an „Option Board“ for overwriting the bytes „between“ the DATA areas!
In figure 5 you can also see the different SYNC's; 12 times of 00h. There is always a tiny gap in the graph.
A very good essay on this topic can be found in: Forensic Computing, A practitioner's guide, Tony Sammes and Brian Jenkinson, Springer-Verlag London Limited 2000, 5th printing 2004, page 94-96, Floppy Disk Low Level Format.
- Fig. 4: IBM standard MFM track format (pdf)
- Fig. 5: KryoFlux Graph with IBM standard MFM track format (pdf)
By the way: While working with the HEX Editor I had the idea of an "invisible" diary. Just write your diary with a HEX editor into the 512 byte areas (DATA). But start with the 12th sector, because there are Boot, FAT and DIR areas in the sectors 0 to 11. Then you can use the logical sectors from 12 to 719 for your diary; this corresponds to a little more than 350,000 characters. If you check this floppy with DIR, it is completely blank. The floppy disk is also in perfect order, no errors. Of course, this is no surprise to a professional hacker or forensic expert! Now then.