Notifications
Clear all
Topic starter
24/03/2022 11:47 pm
Hello everyone. I have a task, which is corrupted image file. However, I have to use only hex editor to carve data. I'm able to see partition start and end values with gparted or another tools. However, I want to calculate them manually. I inserted an image , which showing my disk image partition start and end values. Also, I inserted $MFT file with link. As you see in the picture, my starter point for partition table 2 is : 7968240. How can I determine this number with real calculation ? I tried to dived this value with sector size which is 512. However, results are not fit. I'll appriciate for a formula for it. Start and End Points of Partitions.
Â
$MFT File : https://file.io/r7sy2A7itdur
27/03/2022 7:51 am
Have you tried looking at sector 7968240?