The other entries that I got from sigfind, have boot code 0'd out. I found only 2 entries that have hex values in boot code.
What is this "boot code" you're referring to?
How do I know which entry is correct (I used sigfind to look for boot signature on the disk)
If by "boot signature", you mean "AA55", I found that signature at the same location in not only the MBR of an image acquired from a physical disk, but also near the beginning of the first partition, at the same offset (0x01fe). However, in your case, the "NTFS" at offset 0x03 is pretty much a dead giveaway.
You mentioned that you found two such signatures…try looking at/parsing the other one…
A few tools to help you
Winhex open as a disk then from the main menu View > Template Manager (there is an MBR template available)
VFC You can also use VFC to select the disk and click View Log which will give detail.
010 editor there is a MBR view option too.
You can get demos for all of these, all should give you the same values to compare against your own workings.
Any free hex editor will work, as well. I used FTK Imager, which is also free.
A few tools to help you
Winhex open as a disk then from the main menu View > Template Manager (there is an MBR template available)
+1 Winhex rocks.
Watching hmorgan and winhex is just like the matrix, he don't even see the code. All he see's is Blonde, Brunette, Redhead…..
55AA are the "standard" "Magic Bytes".
They are last two bytes of
- the MBR (master boot record FIRST sectore on a disk)
- the EPBR (Extended Partition Boot Record)
- any PBR or VBR (Partition or Volume Boot Record or "bootsector")
In the case of NTFS formatted volumes it is also in the backup copy of the bootsector (last sector of partition space, first sector AFTER filesystem end).
In the case of FAT32 there is also a backup bootsector on sector 6 of the volume.
To read, contents of
http//
Just for the fun of it
http//
Since a number of files in a "normal" NT install contain bootsectors or MBR's verbatim, searching for 55AA is one of the most unuseful search byte sequence you could have chosen.
You will have a number of false hits!
But if you are looking for the MBR it is the first sector of the disk image. (NO need to search for it)
If you have a drive (i.e. partition or volume) image instead it is simply NOT there. (again NO need to search for it)
jaclaz
An attempt to merge the two threads
stop using sigfind its a painful way to do things.
This is how I do it when I'm rebuilding a partition table. I've done a few.
10 Load image into a hex editor (WinHex)
20 scan up the disk looking for sectors beginning with strings like NTFS, FAT or FAT32 at the start (or failing that 0x55AA at the end) you should (hopefully) see one at about 63.
30 analyse the boot sector according to its type. If its NTFS use the offsets in the link I gave earlier, if FAT then this will do
40 read the number of sectors using the data from the boot sector
50 using the start offset from 20 and the volume size from 40 mount the file system.
60 Extract the files
70 add the volume size to the partition offset to get an idea of where the next volume is.
80 If not at the end of the disk THEN GOTO 20