Partition with bloc...
 
Notifications
Clear all

Partition with blocked hex values?

5 Posts
5 Users
0 Reactions
567 Views
(@d1g14n6)
Active Member
Joined: 14 years ago
Posts: 12
Topic starter  

I have an image of a hard drive, and when I look at the hex values for a partition, all the values are 00. My first thought is that the drive was wiped, until I scroll down and come across a block segment with F6 values, then a block with 01 values. I am only a student and this is something I've never seen before, and have also been unable to find the cause doing research on the internet. Anyone have any ideas?


   
Quote
(@Anonymous 6593)
Guest
Joined: 17 years ago
Posts: 1158
 

I have an image of a hard drive, and when I look at the hex values for a partition, all the values are 00.

What kind of partitions are you referring to? I'm assuming MBR.

My first thought is that the drive was wiped, until I scroll down and come across a block segment with F6 values, then a block with 01 values.

Sounds like it might be a case of partitions being deleted from the partition table, but the partitions are still on the disk.

If you can locate VBR data you may be able to produce reasonably good hypothesis about what the wiped partition table used the contain.


   
ReplyQuote
(@jtrajewski)
New Member
Joined: 15 years ago
Posts: 1
 

I have an image of a hard drive, and when I look at the hex values for a partition, all the values are 00. My first thought is that the drive was wiped, until I scroll down and come across a block segment with F6 values, then a block with 01 values. I am only a student and this is something I've never seen before, and have also been unable to find the cause doing research on the internet. Anyone have any ideas?

What you're describing is consistent with seeing a formatted floppy. When you format a floppy the FAT is initialized (0'ed out) and the data area will be F6'ed. I don't know why you're seeing 01 values after that though.

Do you have equipment to test this?

I'm in Burlington, VT as well if you want me to review what you're looking at.

Good luck.

Jonathan Rajewski


   
ReplyQuote
(@rbunnell)
New Member
Joined: 16 years ago
Posts: 2
 

Do you have a source for your information on low level formating with x00's and xf6's?

Thanks.


   
ReplyQuote
(@mscotgrove)
Prominent Member
Joined: 17 years ago
Posts: 940
 

Can you actually see any data

Key sectors to try and look in include 0x3f, 0x60003f, 0x60800. 0x6402a (Mac)

Better still, scan the disk to find any remaining partition headers (BPB)

Michael


   
ReplyQuote
Share: