Switch to full style
Anything related to computer forensics (new section!)
Post a reply

Windows 8 MBR Partition Information

July 30th, 2015, 15:46

MBR1.jpg


OK. I finally figured out how to use different disk editing tools to find and distinguish between the Master Boot Record and the Volume Boot Record. I have included a screen shot of a MBR for my Windows 8 laptop. I went to the very bottom of the sector to where the partition table is. I can't find the "80" that is supposed to be there for a bootable partition. Can someone please show me where the partition hex code is located for this partition table?

Thanks, Jonathan

Re: Windows 8 MBR Partition Information

July 30th, 2015, 16:22

partition begins @ sector 2048 (1)
partition length 1953456128 sectors (2)
Attachments
MBR1.jpg

Re: Windows 8 MBR Partition Information

July 30th, 2015, 16:31

jermy wrote:partition begins @ sector 2048 (1)
partition length 1953456128 sectors (2)


0x746F6000 = 1 953 456 128

That's the size of the partition, not the end sector.

http://thestarman.pcministry.com/asm/mbr/PartTables.htm

Re: Windows 8 MBR Partition Information

July 30th, 2015, 16:47

fzabkar wrote:That's the size of the partition, not the end sector.

agreed
jermy wrote:partition length 1953456128 sectors (2)

Re: Windows 8 MBR Partition Information

July 30th, 2015, 18:09

jermy, fzabkar, Thank you very much for the guidance.

Two questions:

1) Did the 0x80 value (seen in many examples of earlier partition tables) denoting a bootable volume go away in Windows 8? I don't see it in any of the later MBR snapshots.

2) Are the partition tables like the one in my snapshot from this thread the same for Windows 7 and Vista?

Thanks again.

Jonathan

Re: Windows 8 MBR Partition Information

July 31st, 2015, 4:06

An Examination of the Windows 7 or 8 or 8.1 MBR:
http://thestarman.pcministry.com/asm/mb ... .htm#multi

According to the above page, the System Reserved partition should be made active (boot indicator = 80h) for both Windows 8 and 7. This is the case for new installations where the installer creates separate System Reserved and OS Boot partitions. For upgrade installations, the boot files are written to the existing OS partition rather than to a separate reserved partition, so the OS partition would be active.

I can't understand why your HDD's partition table doesn't have a boot flag, unless you have a second drive (eg SSD) whose reserved partition is set to be active and the first in the boot order. Then the BCD (Boot Configuration Data) on the SSD could be selecting the HDD's C: partition as the boot drive.

Re: Windows 8 MBR Partition Information

July 31st, 2015, 7:03

fzabkar, My laptop is a hybrid HDD and SSD configuration. Would there be a flag for the SSD part of the drive booting first in the partition table?

Re: Windows 8 MBR Partition Information

July 31st, 2015, 11:13

jermy wrote:
fzabkar wrote:That's the size of the partition, not the end sector.

agreed
jermy wrote:partition length 1953456128 sectors (2)

Wow, that was a serious brain fart. Sorry.

jdude45 wrote:fzabkar, My laptop is a hybrid HDD and SSD configuration. Would there be a flag for the SSD part of the drive booting first in the partition table?

I've seen two types of hybrids. There are those where the SSD part is nonvolatile cache, in which case the drive appears as a single physical drive and is indistinguishable from a regular HDD. The second type is where there are actually two physical drives connected via a bridge like a SATA multiplier, eg WD Black2.

In short, I don't know the answer to your question. Sorry.

Re: Windows 8 MBR Partition Information

July 31st, 2015, 18:19

fzabkar, I had read that the values for the "CHS Start" and "CHS End" are not really valid any more even though they are still included in the Partition Table. Is this accurate?

Re: Windows 8 MBR Partition Information

July 31st, 2015, 20:23

CHS notation runs out of bits when the cylinder count hits 1024 (10 bits). That's why Logical Block Addressing was introduced. I don't know to what extent CHS addressing is used today, but I suspect that BIOS might still require it for legacy reasons.
Post a reply