Calculations of NTF...
 
Notifications
Clear all

Calculations of NTFS Partition Table Starting Points

2 Posts
2 Users
0 Likes
1,609 Views
 terp
(@terp)
Posts: 1
New Member
Topic starter
 

Hello everyone. I have a task, which is corrupted image file. However, I have to use only hex editor to carve data. I'm able to see partition start and end values with gparted or another tools. However, I want to calculate them manually. I inserted an image , which showing my disk image partition start and end values. Also, I inserted $MFT file with link. As you see in the picture, my starter point for partition table 2 is : 7968240. How can I determine this number with real calculation ? I tried to dived this value with sector size which is 512. However, results are not fit. I'll appriciate for a formula for it. Start and End Points of Partitions.

 

$MFT File : https://file.io/r7sy2A7itdur

 
Posted : 24/03/2022 11:47 pm
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

Have you tried looking at sector 7968240?

 
Posted : 27/03/2022 7:51 am
Share: