MBR, File system, boot sector, partition table

[djake]

Someone know where are on the disk these:

partition table,
boot sector,
MBR,
fat or ntfs table

And how can i find them with a disk hex viewer?
How much bytes their are long?

Thanks

 

[Zvi Netiv]

Someone know where are on the disk these:

partition table,

The 64 bytes from offset 406, in the MBR.

boot sector,

May be located anywhere on the disk. Its location is pointed by the active
partition entry in the MBR. Usually, the boot sector will be found in logical
sector 63 (011 in CHS notation) but don't count on it.

MBR,

The very first sector on the hard drive (logical sector 0, or CHS 001).

fat or ntfs table

The FAT can be found after the boot sector. With FAT-32, the FAT usually begins
on the 33rd sector from the boot sector, but that number may vary, depending on
how the FAT-32 partition was created.

By NTFS table I suppose you mean MFT (master file table). The MFT starts
somewhere at the beginning of the NTFS partition (NTFS has no FAT) at a location
that is specified in the boot sector.

And how can i find them with a disk hex viewer?

Try any of the many disk viewers available - some are free, like PTEDIT. You
may also try the free version of RESQDISK. Norton DiskEdit is a commercial disk
viewer and editor. Be careful with changing data as from your questions, you
have a great deal to learn before you can manipulate these elements without
doing harm to your data, or lose it.

How much bytes their are long?

Disk sectors are 512 bytes in size, and that applies to the MBR and boot sector.
The boot sector of a FAT-32 partition actually consists of three adjacent
sectors (aka "extended boot sector") and there are two copies thereof with the
mirror at seven sectors apart. The size of the FAT depends on the partition's
size and varies from hundreds of sectors for FAT-16 (256 max) to thousands of
sectors per FAT copy (there are always two) for FAT-32. The MFT size varies
according to the number of entries it contains.

May I suggest that you read about the subject on the web. Start with a google
search on "file system disk structures" (just a little over one million hits)
then narrow down your search per subject.

Thanks

Regards, Zvi

 

[Zvi Netiv]

The 64 bytes from offset 406, in the MBR.

Correct that to "The 64 bytes from offset 446, in the MBR"

Regards

 

[Folkert Rienstra]

The 64 bytes from offset 406, in the MBR.


May be located anywhere on the disk.

In theory.

Its location is pointed by the active partition entry in the MBR.

Or the EPBR for extended partitions.

Usually, the boot sector will be found in logical sector 63

LBA 63. That would be the first partition boot sector. Others will be at
offset 64 to the start of the EPBR (which is pointed to from the MBR).
And from a partition perspective the bootsector is sector 0.

(011 in CHS notation)

Then that would be 0/1/1 in CHS notation, not 011.
And only with 63 sectors per logical track.

but don't count on it.

Right, primary vs without primary partitions and sectors per track and so on.

The very first sector on the hard drive (logical sector 0, or CHS 0/0/1).


The FAT can be found after the boot sector. With FAT-32, the FAT usually begins
on the 33rd sector from the boot sector, but that number may vary, depending on
how the FAT-32 partition was created.

By NTFS table I suppose you mean MFT (master file table). The MFT starts
somewhere at the beginning of the NTFS partition (NTFS has no FAT) at a location
that is specified in the boot sector.


Try any of the many disk viewers available - some are free, like PTEDIT.

Well, that isn't a disk editor.

You may also try the free version of RESQDISK.

Norton DiskEdit is a commercial disk viewer and editor.

So is WinHex (sort of) but it can be used in Trial mode.
It lets you navigate to the partitions and to the bootsector, FATs and root-
directory within the partition(s).