Some easy ways to understand MBR info and disk geometry:
Linux: dd + file commands
dd can be used to acquire the first sector of the bootable disk:
$ sudo dd if=/dev/sda of=mbr count=512
512+0 records in
512+0 records out
262144 bytes (262 kB) copied, 0.00553819 s, 47.3 MB/s
Information about partitions is obtained with file utility, that recognizes the dump as an MBR dump (by the MBR signature 0x55AA):
$ file mbr
mbr: x86 boot sector;
partition 1: ID=0x83, starthead 32, startsector 2048, 39061504 sectors;
partition 2: ID=0x7, active, starthead 254, startsector 39070080, 44998065 sectors;
partition 3: ID=0x83, starthead 254, startsector 84068145, 13671315 sectors;
partition 4: ID=0x5, starthead 254, startsector 97739460, 214837245 sectors, code offset 0x63
In Windows:
Acquiring the MBR can be done with dd command (from UnxUtils):
>dd if=\\.\PhysicalDrive0 of=mbr count=1
1+0 records in
1+0 records out
Then, a small python script can be used to extract information, similar with file utility.
Other useful tools in Windows:
Information regarding disk geometry (Total Cylinders/Sectors/Tracks, Sectors per Track, Tracks per cylinder) can be obtained with System Information utility from Windows:
The WinHex editor prints information about the first sector of every partition (provided also by file command):
The WinHex editor prints information about the first sector of every partition (provided also by file command):
No comments:
Post a Comment