Anything related to computer forensics (new section!)
January 15th, 2016, 9:37
I had heard from a source that the Master Boot Record would not recognize hard disk drives that are larger than 2 TB in size. I just examined the partition table for my desktop hard disk drive which is 3 TB and the partition table seems to correctly reflect this. Will Master Boot Records currently recognize larger disk sizes, or is mine just displaying the correct number, but not accounting for anything beyond the 2 TB mark?
January 15th, 2016, 16:15
Can you show us what the partition(s) look like in DMDE?
http://dmde.com/
January 15th, 2016, 18:53
I loaded the MBR from the desktop drive into DMDE and took a screen capture. Have Master Boot Records been updated to read more than 2 TB of disk space? It is obvious from this screen capture and from using other tools that the MBR is reading the full size of the hard disk. I am only asking this because I was told that the Master Boot Record had this size restriction. I would like to know if this source was mistaken or if the dynamics of the MBR had changed in recent years. Thanks.
- Attachments
-
January 15th, 2016, 19:21
That's LBA 3, not LBA 0.
Can you show us the Partitions window that you first see when DMDE launches?
January 15th, 2016, 21:05
If I may ask, what is the difference between LBA 3 and LBA 0? Here is the next screen capture.
- Attachments
-
January 15th, 2016, 22:02
LBA 0 (= sector 0) is where the MBR code and partition table are located.
LBA 3 would normally be filled with zeros. In your case it appears to be filled with 0xE5. You can see this if you select Mode -> Hexadecimal/Text.
The following resource has everything you need to know about the subject:
All the Details of many versions of both MBR (Master Boot Records) and OS Boot Sectors (also called Volume Boot Records):
http://thestarman.pcministry.com/asm/mbr/index.htmlIn your case the drive is a WD 3TB My Book. These are configured with a sector size of 4096 bytes rather than the usual 512 bytes. This means that the maximum size for an MBR partition is now 16TiB instead of 2TiB.
732558080 sectors x 4096 bytes per sector = 3.0005579 terabytes
January 16th, 2016, 7:42
fzabkar, thank you for clarifying that for me. I have been using the site that you referenced in your last post. I only wish this same source had a more complete section on GUID Partition Tables.
Powered by phpBB © phpBB Group.