Calculations of NTF...
 
Notifications
Clear all

Calculations of NTFS Partition Table Starting Points

terp
 terp
(@terp)
New Member

Hello everyone. I have a task, which is corrupted image file. However, I have to use only hex editor to carve data. I'm able to see partition start and end values with gparted or another tools. However, I want to calculate them manually. I inserted an image , which showing my disk image partition start and end values. Also, I inserted $MFT file with link. As you see in the picture, my starter point for partition table 2 is : 7968240. How can I determine this number with real calculation ? I tried to dived this value with sector size which is 512. However, results are not fit. I'll appriciate for a formula for it. Start and End Points of Partitions.

 

$MFT File : https://file.io/r7sy2A7itdur

Quote
Topic starter Posted : 24/03/2022 10:47 pm
minime2k9
(@minime2k9)
Active Member

Have you tried looking at sector 7968240?

ReplyQuote
Posted : 27/03/2022 7:51 am
Share:
Share to...