Is there a date in ...
 
Notifications
Clear all

Is there a date in the MBR?

11 Posts
4 Users
0 Likes
1,478 Views
(@mscotgrove)
Posts: 938
Prominent Member
Topic starter
 

All I have is a dump of a MBR (sector 0). It contains the normal string 'Invalid partition table….'

The sector has been written to the disk and I would like to know when.

I do not currently have access to the rest of the disk.

Does anyone know if the date is ever embedded within the general code area?

I know that only bytes 0x1be to 0x1ff are actually defined, the rest are often standard

http//thestarman.pcministry.com/asm/mbr/W7MBR.htm

The link above gives lots of info but does not mention a date, so I fear the answer to my question is no.

 
Posted : 21/04/2012 3:37 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

I found multiple sites on Google that describe the code in the MBR, even go so far as decode it (or provide someone with the ability to do so)…yet I don't see where there's a date listed.

 
Posted : 21/04/2012 3:55 pm
joakims
(@joakims)
Posts: 224
Estimable Member
 

Not in the mbr, but whenever you get access to the rest of the disk, there may be traces from the OS having redetected a "new" disk (or in this case the same one but with a possibly different disk signature). Or not if the signature was the same.

 
Posted : 22/04/2012 4:06 am
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

For some useful info about what IS in the MBR, check Google, and try Jamie's code
http//gleeda.blogspot.com/2012/04/mbr-parser.html

 
Posted : 22/04/2012 5:42 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

The ONLY data in a MBR (beside the partition table entries) that varies between two "same OS" installs is the Disk Signature. (4 bytes at offset 440)
The Disk Signature is "randomly generated" when the disk is "initialized" (i.e. first time it is accessed by disk manager and/or during initial partitioning and/or silently if by any chance the disk signature is set to 00000000) as soon as the disk is connected to a NT system) and bears NO info of any kind about date/time.

jaclaz

 
Posted : 23/04/2012 3:25 pm
joakims
(@joakims)
Posts: 224
Estimable Member
 

Maybe some explanantion to my not so brilliant post would be necessary. I was assuming that only the mbr was rewritten, and that the disk signature may or may not have changed during that operation. If the disk signature was changed, then it should be possible to make some assumptions as to when it occurred. For instance through the registry, by mapping the disk guid from MountedDevices to MountPoints2 and retrieving the last write timestamp. Should at least reflect the boottime of the next boot after the signature was changed. But of course pointless if the signature was kept during the rewrite. Just a shame no timestamps exists in the mbr itself.

Assumtion Windows system (which I drew because of the reference back to disassembly of a Windows 7 based mbr).

 
Posted : 23/04/2012 11:47 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

I may have something for you on this tomorrow…while it doesn't fit with the MBR that you're referring to, I may have something more along the lines of the MountedDevices/MountPoints2 key references.

 
Posted : 24/04/2012 12:02 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I am pretty sure that finding a date into \MountPoints2 that ONLY makes (loosely) sense IF Disk Signature was changed will be of great help to the OP that ONLY has the MBR

All I have is a dump of a MBR (sector 0).

Carpenter's example
Q I have ONLY a hammer, NO nails and two wooden planks. How do I join the two planks together?.
A1You should have some nails.
A2You could use some screws and glue.

8)

jaclaz

 
Posted : 24/04/2012 2:42 pm
(@mscotgrove)
Posts: 938
Prominent Member
Topic starter
 

I should explain that the disk(s) in question actually come from an HP MediaVault Raid. The disk are Reiser and at some time the boot sectors have been modified to be a 'standard' Windows type boot sector, with no partition information.

I hoped that by finding the time I could isolate when it was done, and why the boot sectors were modified.

Fortunately, sector 1 has not been changed as this stores the critical Broadcom raid information, so recovery should be possible

I did once have a job on a deleted DVD-RW which had been reformatted again. I established the time of the last format to be the time the DVD was at a 'local' PC repair shop. In this case the formating overwrote the original data.

 
Posted : 24/04/2012 3:44 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

I should explain that the disk(s) in question actually come from an HP MediaVault Raid. The disk are Reiser and at some time the boot sectors have been modified to be a 'standard' Windows type boot sector, with no partition information.

What have "the boot sectors" have to do with the MBR? 😯
There is no such thing as a 'standard' Windows bootsector (and no, not even a 'standard' MBR) some are common between different versions of Windows, some are not.

What MAY have happened is the following (though there is NO way to know WHEN from the data on the MBR)

  • *something* corrupted the 55AA Signature of the MBR
  • the disk was connected to a Windows NT OS and accessed through Disk Management

this behaviour has been documented, basically besides disk signature, a NT OS also "needs" a 55AA, if it finds it not the disk is assumed to be needing "initializing" and IF ths is carried on, the partition table is WIPED.
http//reboot.pro/12253/

jaclaz

 
Posted : 24/04/2012 6:19 pm
Page 1 / 2
Share: