Calculations of NTF...
Clear all

Calculations of NTFS Partition Table Starting Points

2 Posts
2 Users
0 Reactions
Posts: 1
New Member
Topic starter

Hello everyone. I have a task, which is corrupted image file. However, I have to use only hex editor to carve data. I'm able to see partition start and end values with gparted or another tools. However, I want to calculate them manually. I inserted an image , which showing my disk image partition start and end values. Also, I inserted $MFT file with link. As you see in the picture, my starter point for partition table 2 is : 7968240. How can I determine this number with real calculation ? I tried to dived this value with sector size which is 512. However, results are not fit. I'll appriciate for a formula for it. Start and End Points of Partitions.


$MFT File :

Posted : 24/03/2022 11:47 pm
Posts: 481
Honorable Member

Have you tried looking at sector 7968240?

Posted : 27/03/2022 7:51 am