±Forensic Focus Partners
±Your Account

![]() |
![]() |
![]() |
![]() |
±Latest Articles
±Latest Videos
±Latest Jobs
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
What have "the boot sectors" have to do with the MBR?
There is no such thing as a 'standard' Windows bootsector (and no, not even a 'standard' MBR) some are common between different versions of Windows, some are not.
What MAY have happened is the following (though there is NO way to know WHEN from the data on the MBR):
reboot.pro/12253/
jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. -
Is there a date in the MBR?
Page Previous 1, 2-
jaclaz - Senior Member
Re: Is there a date in the MBR?
I am pretty sure that finding a date into \MountPoints2 that ONLY makes (loosely) sense IF Disk Signature was changed will be of great help to the OP that ONLY has the MBR:
Carpenter's example:
Q: I have ONLY a hammer, NO nails and two wooden planks. How do I join the two planks together?.
A1:You should have some nails.
A2:You could use some screws and glue.
jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. -
- mscotgroveAll I have is a dump of a MBR (sector 0).
Carpenter's example:
Q: I have ONLY a hammer, NO nails and two wooden planks. How do I join the two planks together?.
A1:You should have some nails.
A2:You could use some screws and glue.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. -
-
mscotgrove - Senior Member
Re: Is there a date in the MBR?
I should explain that the disk(s) in question actually come from an HP MediaVault Raid. The disk are Reiser and at some time the boot sectors have been modified to be a 'standard' Windows type boot sector, with no partition information.
I hoped that by finding the time I could isolate when it was done, and why the boot sectors were modified.
Fortunately, sector 1 has not been changed as this stores the critical Broadcom raid information, so recovery should be possible
I did once have a job on a deleted DVD-RW which had been reformatted again. I established the time of the last format to be the time the DVD was at a 'local' PC repair shop. In this case the formating overwrote the original data.
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk
I hoped that by finding the time I could isolate when it was done, and why the boot sectors were modified.
Fortunately, sector 1 has not been changed as this stores the critical Broadcom raid information, so recovery should be possible
I did once have a job on a deleted DVD-RW which had been reformatted again. I established the time of the last format to be the time the DVD was at a 'local' PC repair shop. In this case the formating overwrote the original data.
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk
-
jaclaz - Senior Member
Re: Is there a date in the MBR?
- mscotgroveI should explain that the disk(s) in question actually come from an HP MediaVault Raid. The disk are Reiser and at some time the boot sectors have been modified to be a 'standard' Windows type boot sector, with no partition information.
What have "the boot sectors" have to do with the MBR?

There is no such thing as a 'standard' Windows bootsector (and no, not even a 'standard' MBR) some are common between different versions of Windows, some are not.
What MAY have happened is the following (though there is NO way to know WHEN from the data on the MBR):
- *something* corrupted the 55AA Signature of the MBR
- the disk was connected to a Windows NT OS and accessed through Disk Management
reboot.pro/12253/
jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. -
-
joakims - Senior Member
Re: Is there a date in the MBR?
What kind of OS was actually on this disk in case it was a boot volume, or connected to it in case not?
_________________
Joakim Schicht
github.com/jschicht
_________________
Joakim Schicht
github.com/jschicht