MBR (NTFS) Partition Table Entry

In the previous example the MBR from a drive that only had one partition, was demonstrated. So where is the information stored if there are multiple partitions?

The information is stored in the remaining bytes within the MBR – from 462 to 510. i.e All of the partition information is from 446 to 510 – a total of 64 bytes. The final two bytes (511 and 512) in the MBR are the “magic numbers”. (Remember that the MBR is 1 sector, which is 512 bytes)

Below is the location of the partition information, within the MBR. Attached is the same  information in about the MBR in PDF format

Partition Table #1

Offset (within MBR) Information Length
446 Active (80=Active) 1
450 Partition Type 1
454 Sectors Preceding Partition 1 4
458 Sectors in Partition 1 4

Partition Table #2

Offset (within MBR) Information Length
462 Active (80=Active) 1
466 Partition Type 1
470 Sectors Preceding Partition 2 4
474 Sectors in Partition 2 4

Partition Table #3

Offset (within MBR) Information Length
478 Active (80=Active) 1
482 Partition Type 1
486 Sectors Preceding Partition 3 4
490 Sectors in Partition 3 4

Partition Table #4

Offset (with MBR) Information Length
494 Active (80=Active) 1
490 Partition Type 1
502 Sectors Preceding Partition 4 4
506 Sectors in Partition 4 4

Tags:
Advertisements

4 Responses to “MBR (NTFS) Partition Table Entry”

  1. MBR - EnCase Video | ESI Says:

    […] on from the previous articles on the MBR (MBR Partition Tables and MBR NTFS […]

  2. Video: Locating MFT from Volume Boot | ESI Says:

    […] on from the previous articles on the Master Boot Record (MBR Partition Tables and a guide to the MBR for an NTFS […]

  3. Video: The MBR « Data - Where is it? Says:

    […] – Where is it? Where is your data? Who collects, controls, and searches it? « MBR (NTFS) Partition Table Entry Video – Locating the First Partiton from the MBR […]


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: