Main » Forums home » Forensics

All times are UTC - 5 hours [ DST ]



Post new topic Reply to topic  Page 1 of 1
  [ 5 posts ] 
  Previous topic | Next topic 
Author Message
jdude45
 Post subject: Volume Serial Number Date/Time
PostPosted: January 19th, 2016, 9:57 
Offline

Joined: July 19th, 2015, 10:05
Posts: 24
Location: Forida
I read that the volume serial number is a combination of the date and time that the volume was formatted. I have tried a number of sources to find out how to convert the VSN into the date and time, but I have not been able to find any information. The only tool that I can find is one which allows you to change the volume serial number. I tried a tool called "DCODE" but it doesn't work. Here is my volume serial number:

E210BAB019BAB004

Is there a way to convert this to date and time?

I know that when I used the "volume" command at the DOS prompt, it gave me a 32-bit number as the serial number. I used Active@DiskEditor and it gave me this larger number as the volume serial number.
Top
 Profile  
 
jermy
 Post subject: Re: Volume Serial Number Date/Time
PostPosted: January 19th, 2016, 10:33 
Offline

Joined: March 19th, 2015, 15:01
Posts: 1406
Location: isreal
forget about 64 bit, the volume serial no. is designed in the 1950s
read chapter 28 here
note: if the date and time on the local computer was incorrect you will not able to get it right, i.e. you'll get the local date and time it was on the computer at the time of formating the drive
Top
 Profile  
 
jdude45
 Post subject: Re: Volume Serial Number Date/Time
PostPosted: January 19th, 2016, 11:57 
Offline

Joined: July 19th, 2015, 10:05
Posts: 24
Location: Forida
Thank you for the reply. Here is what it said concerning the volume serial number:

To read the Volume Serial Number, use the IOCTL call, Int 21h function
440dh Minor Code 66h, Get Media ID. To write the Volume Serial Number,
use the IOCTL call, Int 21h function 440dh Minor Code 46h, Set Media ID.

I do not understand what this means. Could you explain what the author is saying here as far as reading the serial number? Thanks.
Top
 Profile  
 
einstein9
 Post subject: Re: Volume Serial Number Date/Time
PostPosted: January 19th, 2016, 12:21 
Offline
User avatar

Joined: May 13th, 2010, 11:17
Posts: 2546
Location: Kuwait
jdude45 wrote:
Thank you for the reply. Here is what it said concerning the volume serial number:

To read the Volume Serial Number, use the IOCTL call, Int 21h function
440dh Minor Code 66h, Get Media ID. To write the Volume Serial Number,
use the IOCTL call, Int 21h function 440dh Minor Code 46h, Set Media ID.

I do not understand what this means. Could you explain what the author is saying here as far as reading the serial number? Thanks.


Assembly Lang.

_________________
Kuwait Data Recovery - UNIX GTC
The only reason for time is so that everything doesn't happen at once. By: Albert Einstein
Top
 Profile  
 
fzabkar
 Post subject: Re: Volume Serial Number Date/Time
PostPosted: January 19th, 2016, 13:08 
Offline
User avatar

Joined: September 8th, 2009, 18:21
Posts: 11825
Location: Australia
The original DOS/Win9x boot record (FAT16/FAT32) had a 32-bit Volume Serial Number at offset 0x43.

An Examination of the MSWIN4.1 OS Boot Record:
http://thestarman.pcministry.com/asm/mbr/MSWIN41.htm

The NTFS boot record has a 32-bit Volume Serial Number at offset 0x48.

An Examination of the NTFS Volume Boot Record Of Microsoft Win 2000 and Win XP:
http://thestarman.pcministry.com/asm/mbr/NTFSBR.htm

Quote:
NOTE: When you use the DIR command and others inside of a CMD/DOS-box under Windows 2000/XP, it will show a Volume Serial Number composed of only the last four bytes of this Long Long Word [B4A4E199A4E15DFC]!

Example:

    C:\>dir
    Volume in drive C is Win2000
    Volume Serial Number is A4E1-5DFC

Obviously, we must look into this further to find out how all these bytes are being used by the Operating System!

It is interesting to note how the (3rd and 4th) and (6th and 7th) bytes repeat here!
Do you have a Serial Number where these two sets of bytes are not the same?

You can use a disc editor such as DMDE (freeware) to view and edit the boot sector.

http://dmde.com/

_________________
A backup a day keeps DR away.
Top
 Profile  
 
Display posts from previous:  Sort by  
Post new topic Reply to topic  Page 1 of 1
  [ 5 posts ] 

Main » Forums home » Forensics

All times are UTC - 5 hours [ DST ]

Who is online

Users browsing this forum: No registered users and 1 guest

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Switch to mobile style
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group