Master Boot Record (MBR) A Forensic Perspective Villanova - - PowerPoint PPT Presentation
Master Boot Record (MBR) A Forensic Perspective Villanova University Department of Computing Sciences D. Justin Price Spring 2014 Master Boot Record Occupies the first 512-byte sector Boot Code Assembly Language
Villanova University – Department of Computing Sciences – D. Justin Price – Spring 2014
Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014
– Boot Code
– Disk Signature – Partition Table
– Each entry had the following » Starting LBA address » Number of sectors in partition » Type of partition » Flags – Signature Value
Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014
Byte Range Description 000-439 Boot Code 440-443 Disk Signature 446-461 Partition Entry #1 462-477 Partition Entry #2 478-493 Partition Entry #3 494-509 Partition Entry #4 510-511 Signature Value (0xAA55)
Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014
Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014
– Who Cares?
Villanova University – Department of Computing Sciences – D. Justin Price – Digital Forensics - Spring 2014
Partition Types = www.datarecovery.com/hexcodes.asp
Byte Range Description Example 00-00 Bootable Flag (0x80 = Active) 0x80 = Active & Bootable 01-03 Starting CHS Address 04-04 Partition Type 0x07 = NTFS 05-07 Ending CHS Address 08-11 Starting LBA Address 0x0800 = 2,048 (Sector) 12-15 Size in Sectors 0x077FF000 = 125,825,024 Sectors