Calculations of NTF...
 
Notifications
Clear all

Calculations of NTFS Partition Table Starting Points

2 Posts
2 Users
0 Reactions
1,736 Views
 terp
(@terp)
New Member
Joined: 3 years ago
Posts: 1
Topic starter  

Hello everyone. I have a task, which is corrupted image file. However, I have to use only hex editor to carve data. I'm able to see partition start and end values with gparted or another tools. However, I want to calculate them manually. I inserted an image , which showing my disk image partition start and end values. Also, I inserted $MFT file with link. As you see in the picture, my starter point for partition table 2 is : 7968240. How can I determine this number with real calculation ? I tried to dived this value with sector size which is 512. However, results are not fit. I'll appriciate for a formula for it. Start and End Points of Partitions.

 

$MFT File : https://file.io/r7sy2A7itdur


   
Quote
minime2k9
(@minime2k9)
Honorable Member
Joined: 14 years ago
Posts: 481
 

Have you tried looking at sector 7968240?


   
ReplyQuote
Share: