Partition size base...
 
Notifications
Clear all

Partition size based-on MBR and Win_Properties are different

4 Posts
4 Users
0 Likes
390 Views
(@mehranbazgir)
Posts: 1
New Member
Topic starter
 

Hi Guys.
Based on properties of my partitions on Windows 7 machine, sizes of partitions are as follow

C 79,586,914,304 Bytes 155,443,192 Sectors

D 209,715,195,904 Bytes 409,599,992 Sectors

E 210,698,760,192 Bytes 411,521,016 Sectors

Also, based on partition-entries of MBR (four last byte of every partition-entry that specifies the partition size in sector), sizes of partitions are as follow

C 155,443,200 Sectors

D 409,600,000 Sectors

E 411,521,024 Sectors

Now, my question is, why partition size (in sector) based on MBR is exactly 8 sector (1 cluster) more than partition size (in sector) based on the size that Windows partition properties display??
TNX.

 
Posted : 02/05/2016 8:26 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

You are probably looking not in both cases to the same data, it is likely you are looking once at the actual partition size, and the other one to the volume size or to the file system size.

It depends on the file sytem, the number of sectors are the same on some file systems such as FAT but not in the case of NTFS, see
http//reboot.pro/topic/18034-mounting-partition-raw-image-created-with-dsfo/
starting from here
http//reboot.pro/topic/18034-mounting-partition-raw-image-created-with-dsfo/#entry166395

and (only seemingly unrelated)
http//www.forensicfocus.com/Forums/viewtopic/t=9374/

The 8 sector difference is probably one cluster (as most NTFS file system use a 4096 byte cluster size) and it is likely made out of 1 sector of "volume or partition slack" and 7 sectors of "filesystem slack".

jaclaz

 
Posted : 02/05/2016 1:01 pm
(@athulin)
Posts: 1156
Noble Member
 

Hi Guys.
Based on properties of my partitions on Windows 7 machine, sizes of partitions are as follow

Always state from where you get the data. What reporting tool tells you the partition sizes? What release?

Also, based on partition-entries of MBR (four last byte of every partition-entry that specifies the partition size in sector), sizes of partitions are as follow

Again, what tool provides this information?

Now, my question is, why partition size (in sector) based on MBR is exactly 8 sector (1 cluster) more than partition size (in sector) based on the size that Windows partition properties display??

As already explained, you (or your tools) may be confusing partitions and volumes. Unless the same definitions are used everywhere, interpretation will differ. Partitions hold volumes, and volumes can't always utilize ell space in a partitions, so partition size is usually larger than volume size.

Also … partitions don't do clusters. That's a term that applies to file systems, that make up volumes.

On the assumption that your tools do use the same definitions and really are referring to the same things, it may also be the standard fencepost error one of the tools computes the number of clusters wrong by one unit.

That's one of the standard errors that programmers do until they've learned do spot the situations in which it happens. Well-tested tools usually don't show such behaviour, but it's difficult to be categorical. That's why knowing what tool you used is important and why testing tools to ensure that they do get results right is important.

 
Posted : 03/05/2016 10:16 pm
jhup
 jhup
(@jhup)
Posts: 1442
Noble Member
 

[…]
may be confusing partitions and volumes. Unless the same definitions are used everywhere, interpretation will differ. Partitions hold volumes, and volumes can't always utilize ell space in a partitions, so partition size is usually larger than volume size.

Also … partitions don't do clusters. That's a term that applies to file systems, that make up volumes. […]

You bring tears of joy into my eyes… sniff… you … you made my day…

Do you know how hard it is to explain this to paper forensicators, specially with just-gained PhDs? mrgreen

 
Posted : 13/05/2016 12:40 am
Share: