Scribd Logo
Upload

Welcome to Scribd!

  • MBR Analysis #1 Completed

    Uploaded by

    Alien Cipher /
    27 views2 pages
    The document analyzes the master boot record (MBR) of a hard drive and identifies 4 partitions. Partition 1 is a 2GB FAT32 system partition starting at sector 63. Partition 2 is a hidden 2GB FAT16 partition used for boot files. Partition 3 is a 49.34MB FAT16B partition starting at sector 7807590. Partition 4 is a 3.70GB FAT32 partition starting at sector 7903980. Links are provided for more information on MBR and common partition types.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document analyzes the master boot record (MBR) of a hard drive and identifies 4 partitions. Partition 1 is a 2GB FAT32 system partition starting at sector 63. Partition 2 is a hidden 2GB FAT16 partition used for boot files. Partition 3 is a 49.34MB FAT16B partition starting at sector 7807590. Partition 4 is a 3.70GB FAT32 partition starting at sector 7903980. Links are provided for more information on MBR and common partition types.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    27 views2 pages

    MBR Analysis #1 Completed

    Uploaded by

    Alien Cipher /
    The document analyzes the master boot record (MBR) of a hard drive and identifies 4 partitions. Partition 1 is a 2GB FAT32 system partition starting at sector 63. Partition 2 is a hidden 2GB FAT16 partition used for boot files. Partition 3 is a 49.34MB FAT16B partition starting at sector 7807590. Partition 4 is a 3.70GB FAT32 partition starting at sector 7903980. Links are provided for more information on MBR and common partition types.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    of 2

    Learn It: Digital Forensics - Master Boot Record (MBR) Analysis #1

    # Flag Type Starting LBA Address Size (Total Sectors, written in little
    (Boot (Sys ID) (Relative Sectors) endian)
    ind)
    1 0x00 0x0C 0x3F 0x3B90F4
    2 0x00 0x1C 0x3B9133 0x3B9133
    2 0x00 0x06 0x772266 0x17886
    4 0x00 0x0B 0x789AEC 0x6E2514

    1. Partition 1
    a. Non bootable
    b. FAT32 LBA
    c. 0x3F = 63
    d. 0x3B90F4 = 3903732 decimal
    3903732 x 512 = 1,998,710,784 bytes = ~2 GB
    2. Partition 2
    a. Non bootable
    b. Hidden FAT16 partition used during boot sequence to calculate the absolute offset to the root
    directory and data areas.
    c. 0x3B9133 = 3,903,795 decimal
    d. 0x3B9133 = 3903795 x 512 = 1,998,743,040 bytes = ~2 GB
    3. Partition 3
    a. Non bootable
    b. FAT16B
    c. 0x772266 = 7807590 decimal
    d. 0x17866 = 96358 x 512 = 49,335,296 bytes = ~49.34 MB
    4. Partition 4
    a. Non bootable
    b. FAT32 CHS
    c. 0x789AEC = 7903980 decimal
    d. 0x6E2514 = 7218452 x 512 = 3,695,847,424 bytes = ~3.70 GB

    MBR Explanation: https://thestarman.pcministry.com/asm/mbr/PartTables.htm

    MBR Cheat Sheet: http://www.writeblocked.org/resources/MBR_GPT_cheatsheet.pdf

    Google Byte Converter: https://www.google.com/search?


    source=hp&ei=nnwiXcKuJYHMvwSDqbmoBw&q=bytes+to+GB&oq=bytes+to+GB&gs_l=psy-
    ab.3..0l10.1127.3634..3931...0.0..0.278.2810.2-11......0....1..gws-wiz.....0..0i131.aJsjoV-t5eU

    Common Partition Values: https://en.wikipedia.org/wiki/Partition_type

    Common Partition Values 2: https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-xp/


    bb457122(v=technet.10)

    You might also like