Cixert

This program in this post, Which is? https://msfn.org/board/topic/177176-mbr-gpt-drive-dissection/page/2/#findComment-1146865

My experience with openAI GPT-4 is that it invents most things. Just as it predicts the most logical word in natural language, it also predicts the most logical technical data, which leads us to mix philosophy with mathematics. If humanity relies on this without cross-checking the information, it will clearly lead to an evolutionary regression, in my opinion. I've managed to extract a lot of information from it, but after a lot of fighting, telling GPT-4 that it's false, that it's not like that, etc. Perhaps years ago I wouldn't have been able to obtain the information it has provided, and now I find myself needing to use it... because I have 3 computers, each with 4 operating systems, 10 browsers on each operating system, and 1,500 open tabs on each one, waiting to be read. Of course, I can't open a thousand more tabs to search for more information, so I struggle with chatGPT until it loops or I reach the point where chatGPT first tells me one thing, then another, and then tells me the first thing again. Since I realized everything was false regarding the sectors, here we are in this forum, reading starman's website, which is certainly more useful. The worst part is when I pass it machine code, it tells me to read it, but in reality, it's searching the internet for the result of reading a code different from mine. On starman's website, I read that both MBR and VBR are dynamic and modifiable by the operating system, so that question is resolved; I just need to know when they are modified. From what I read, in Windows there is a file with the MBR code called "dmadmin exe." I used the Active Disk Editor program, and it gave me the meaning of all the bytes in sector 0 MBR and sector 0 VBR. But it doesn't give any information about sectors 1 and beyond. I've seen a screenshot of another program on this forum that gives information about the bytes in sectors, but I don't know its name and I'd like someone to tell me. Wait a minute, I can't find the link now. I'll reboot with another operating system where I have this tab open. I'm currently on 7 because Active Disk Editor resets the disks when I open it in XP, even though the website says it's XP compatible. I'll reboot with XP and post back.

Which do you consider to be the best LLM for technical questions? Do you know of any programs that translate the binary/hexadecimal code of boot sectors? Thank you. I read that Sector Inspector and Active Disk Editor might do this.

The solution may be to install a PCI card with SATA adapters. Those based on the ASMedia 1061 chip have a switch to choose "No boot," "IDE mode," or "AHCI." This might work with other chipsets, but they don't have a switch to choose the mode. I haven't tested them yet, so I can't comment further...

Yes, but it's well known that Microsoft isn't entirely truthful, and the AI is 95% a liar, in my opinion. That's why I'm asking if anyone has tested 4Kn drives in real mode. My suspicion is that they should work in XP and in MBR mode would have a 16 TiB limit, at least as data disks. In GPT mode, they would need the Paragon driver to exceed 2 TiB. Those patches for 4K drives were made since Windows Vista; they don't exist for Windows XP, and again, my suspicion is that the patches only work to overcome the 2 TiB limit with full LBA-48. Without the patches, 2000, XP, Vista, and Seven all work correctly with 4K-512e hard disks up to 2 TiB with LBA-32 limit.

Ok, so to the point 1- Does the content of the sectors depend on the program used to create the hard disk and the partitions? 2- Why do some MBRs have a copy of sector 0 in sector 1? 3- Why do some FAT tables start at logical sector 32, others at 33, 34, or 37? 4- Some partitioning programs don't create spaces between partitions. Doesn't this prevent proper alignment? 5- The truth is, I can't interpret the binary code; I only recognize the boot signature 55AA in bytes 510 and 511. Is there a table to guide me? Some programs list the VBR OEM name as MSDOS5.0, while others say MSWIN4.1. Although the names are the same, the content varies greatly on different hard disks. 6- When I create an MBR disk with the same program, all the FAT32 partitions appear to have the same content. But in the partitions I've previously created on other disks, I see completely different binary codes. It seems like the boot partitions only have -Jump instruction? To where? -OEM Name -EBPB? In which sector? -FSInfo? What does FSInfo contain? Sector 1 contains almost nothing. -What does sector 2 contain? -What does sector 12 contain that is only present in boot partitions? -Why is backup sector 6 empty in logical partitions? -What do sectors 0, 1, and 2 contain in logical partitions? I will give the example of two different sectors No. 12: Disk 0: Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 000001800 66 0F B6 46 10 66 8B 4E 24 66 F7 E1 66 03 46 1C f ¶F f‹N$f÷áf F 000001810 66 0F B7 56 0E 66 03 C2 66 89 46 FC 66 C7 46 F4 f ·V f Âf‰FüfÇFô 000001820 FF FF FF FF 66 8B 46 2C 66 83 F8 02 0F 82 A6 FC ÿÿÿÿf‹F,fƒø ‚¦ü 000001830 66 3D F8 FF FF 0F 0F 83 9C FC 66 50 66 83 E8 02 f=øÿÿ ƒœüfPfƒè 000001840 66 0F B6 5E 0D 8B F3 66 F7 E3 66 03 46 FC BB 00 f ¶^ ‹óf÷ãf Fü» 000001850 82 8B FB B9 01 00 E8 87 FC 38 2D 74 1E B1 0B 56 ‚‹û¹ è‡ü8-t ± V 000001860 BE 70 7D F3 A6 5E 74 1B 03 F9 83 C7 15 3B FB 72 ¾p}ó¦^t ùƒÇ ;ûr 000001870 E8 4E 75 DA 66 58 E8 65 00 72 BF 83 C4 04 E9 55 èNuÚfXèe r¿ƒÄ éU 000001880 FC 00 20 83 C4 04 8B 75 09 8B 7D 0F 8B C6 66 C1 ü ƒÄ ‹u ‹} ‹ÆfÁ 000001890 E0 10 8B C7 66 83 F8 02 0F 82 3A FC 66 3D F8 FF à ‹Çfƒø ‚:üf=øÿ 0000018A0 FF 0F 0F 83 30 FC 66 50 66 83 E8 02 66 0F B6 4E ÿ ƒ0üfPfƒè f ¶N 0000018B0 0D 66 F7 E1 66 03 46 FC BB 00 00 06 8E 06 81 80 f÷áf Fü» Ž € 0000018C0 E8 1D FC 07 66 58 C1 EB 04 01 1E 81 80 E8 0E 00 è ü fXÁë €è 0000018D0 0F 83 02 00 72 D0 8A 56 40 EA 00 00 00 20 66 C1 ƒ rЊV@ê fÁ 0000018E0 E0 02 E8 11 00 26 66 8B 01 66 25 FF FF FF 0F 66 à è &f‹ f%ÿÿÿ f 0000018F0 3D F8 FF FF 0F C3 BF 00 7E 66 0F B7 4E 0B 66 33 =øÿÿ ÿ ~f ·N f3 000001900 D2 66 F7 F1 66 3B 46 F4 74 3A 66 89 46 F4 66 03 Òf÷ñf;Fôt:f‰Fôf 000001910 46 1C 66 0F B7 4E 0E 66 03 C1 66 0F B7 5E 28 83 F f ·N f Áf ·^(ƒ 000001920 E3 0F 74 16 3A 5E 10 0F 83 AB FB 52 66 8B C8 66 ã t :^ ƒ«ûRf‹Èf 000001930 8B 46 24 66 F7 E3 66 03 C1 5A 52 8B DF B9 01 00 ‹F$f÷ãf ÁZR‹ß¹ 000001940 E8 9D FB 5A 8B DA C3 00 00 00 00 00 00 00 00 00 èûZ‹Úà 000001950 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000001960 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000001970 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000001980 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 000001990 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA Uª Disk 4: Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F 000001800 0D 0A 41 6E 20 6F 70 65 72 61 74 69 6E 67 20 73 An operating s 000001810 79 73 74 65 6D 20 77 61 73 6E 27 74 20 66 6F 75 ystem wasn't fou 000001820 6E 64 2E 20 54 72 79 20 64 69 73 63 6F 6E 6E 65 nd. Try disconne 000001830 63 74 69 6E 67 20 61 6E 79 20 64 72 69 76 65 73 cting any drives 000001840 20 74 68 61 74 20 64 6F 6E 27 74 0D 0A 63 6F 6E that don't con 000001850 74 61 69 6E 20 61 6E 20 6F 70 65 72 61 74 69 6E tain an operatin 000001860 67 20 73 79 73 74 65 6D 2E FF 00 00 00 00 00 00 g system.ÿ 000001870 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 66 f 000001880 0F B6 46 10 66 8B 4E 24 66 F7 E1 66 03 46 1C 66 ¶F f‹N$f÷áf F f 000001890 0F B7 56 0E 66 03 C2 66 89 46 FC 66 C7 46 F4 FF ·V f Âf‰FüfÇFôÿ 0000018A0 FF FF FF 66 8B 46 2C 66 83 F8 02 0F 82 47 FC 66 ÿÿÿf‹F,fƒø ‚Güf 0000018B0 3D F8 FF FF 0F 0F 83 3D FC 66 50 66 83 E8 02 66 =øÿÿ ƒ=üfPfƒè f 0000018C0 0F B6 5E 0D 8B F3 66 F7 E3 66 03 46 FC BB 00 82 ¶^ ‹óf÷ãf Fü» ‚ 0000018D0 8B FB B9 01 00 E8 28 FC 38 2D 74 1E B1 0B 56 BE ‹û¹ è(ü8-t ± V¾ 0000018E0 6D 7D F3 A6 5E 74 1B 03 F9 83 C7 15 3B FB 72 E8 m}ó¦^t ùƒÇ ;ûrè 0000018F0 4E 75 DA 66 58 E8 65 00 72 BF 83 C4 04 E9 F6 FB NuÚfXèe r¿ƒÄ éöû 000001900 00 20 83 C4 04 8B 75 09 8B 7D 0F 8B C6 66 C1 E0 ƒÄ ‹u ‹} ‹ÆfÁà 000001910 10 8B C7 66 83 F8 02 0F 82 DB FB 66 3D F8 FF FF ‹Çfƒø ‚Ûûf=øÿÿ 000001920 0F 0F 83 D1 FB 66 50 66 83 E8 02 66 0F B6 4E 0D ƒÑûfPfƒè f ¶N 000001930 66 F7 E1 66 03 46 FC BB 00 00 06 8E 06 00 81 E8 f÷áf Fü» Ž è 000001940 BE FB 07 66 58 C1 EB 04 01 1E 00 81 E8 0E 00 0F ¾û fXÁë è 000001950 83 02 00 72 D0 8A 56 40 EA 00 00 00 20 66 C1 E0 ƒ rЊV@ê fÁà 000001960 02 E8 11 00 26 66 8B 01 66 25 FF FF FF 0F 66 3D è &f‹ f%ÿÿÿ f= 000001970 F8 FF FF 0F C3 BF 00 7E 66 0F B7 4E 0B 66 33 D2 øÿÿ ÿ ~f ·N f3Ò 000001980 66 F7 F1 66 3B 46 F4 74 3A 66 89 46 F4 66 03 46 f÷ñf;Fôt:f‰Fôf F 000001990 1C 66 0F B7 4E 0E 66 03 C1 66 0F B7 5E 28 83 E3 f ·N f Áf ·^(ƒã 0000019A0 0F 74 16 3A 5E 10 0F 83 4C FB 52 66 8B C8 66 8B t :^ ƒLûRf‹Èf‹ 0000019B0 46 24 66 F7 E3 66 03 C1 5A 52 8B DF B9 01 00 E8 F$f÷ãf ÁZR‹ß¹ è 0000019C0 3E FB 5A 8B DA C3 00 00 00 00 00 00 00 00 00 00 >ûZ‹Úà 0000019D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0000019F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA Uª

Note: I don't know how to name the space between partitions; I'll name them relative physical sector 0. And I'll say that the partitions start at relative physical sector 63/64. I point out in blue what I have no knowledge about or the information available is not the same as what is seen with a binary editor like WinHex. MBR HARD DISK DIVISION WITH FAT32 PARTITIONS MBR Physical sector LBA 0 --> MBR (Master Boot Record) -Disk boot code (includes disk signature) -Partition table Entry 1 -Partition table Entry 2 -Partition table Entry 3 -Partition table Entry 4 -Boot signature 55AA Physical sector LBA 1 --> MBR copy on some hard disks, not on others. Physical sector LBA 2 --> Reserved boot sectors (empty space if using the original MBR) -Other boot loaders may occupy part of this space Note: On FAT12 disks, there is no MBR, only a primary partition. On hard drives, the VBR boot partition is the active partition specified in the partition table. PRIMARY PARTITIONS Physical sector LBA 63/64 --> 1st primary partition on hard drives. (Starting LBA) Logical Sector 0 --> VBR (Volume Boot Record) - Jump Instruction - OEM Name - EBPB (Extended BIOS Parameter Block) - Partition Boot Code - Boot Signature 55AA Logical Sector 1 --> FSInfo (File System Information) - FSInfo - Boot Signature 55AA Logical Sector 2 --> - "I don't know" - Boot Signature 55AA Logical Sector 3 --> Reserved Empty Space Logical Sectors 6, 7, and 8 --> VBR Copy Logical Sector 6 --> - Sector 0 Copy (VBR) Logical Sector 7 --> - Sector 1 Copy (FSInfo) Logical Sector 8 --> - Sector 2 Copy Logical Sector 9 --> Reserved empty space Logical sector 12 --> Only on boot partitions - "I don't know" Logical Sector 13 --> Reserved Empty Space Logical Sector 32? 33? 34? 38? --> FAT Tables -FAT 1 -FAT 1 slack -FAT 2 (copy of FAT 1) -FAT 2 slack Cluster 2 --> File System Volume -Root Directory Cluster 3 --> Files and directorys Last Logical Sector --> Slack Volume Relative Physical Sector 0 --> Optional Partition Gap (Empty Space) EXTENDED PARTITION (only one with multiple logical partitions) Relative Physical Sector 63/64 --> 1st Logical Partition (Starting LBA) Logical Sector 0,1, 2? --> EBR (Extended Boot Record) or EPBR (Extended Partition Boot Record) - Jump Instruction - OEM Name - EBPB (Extended BIOS Parameter Block) - Partition Boot Code - Partition table Entry 1 -> Current Logical Partition - Partition table Entry 2 -> Next Logical Partition (if any) (entries 3 and 4 empty) - Boot Signature 55AA (required) Logical Sectors 6, 7, and 8 --> EBR Copy Logical Sector 6 --> Empty in my partitions Logical Sector 7 --> Sector 1 Copy (FSInfo) Logical Sector 8 --> Sector 2 Copy Logical Sector 32 --> FAT Tables -FAT 1 -FAT 1 slack -FAT 2 (copy of FAT 1) -FAT 2 slack Cluster 2 --> File System Volume -Root Directory Cluster 3 --> Files and directorys Last Logical Sector --> Slack Volume

For educational purposes, I've been trying to define the structure of an MBR disk with FAT partitions for some time now. I'm finding it increasingly difficult; each offset I note in the structure later reveals that it doesn't correspond to a pattern in different FAT32 and exFAT partitions. I'd like to initially focus on FAT32 partitions and then define the exFAT structure. Let's begin: Every source of information I find on the Internet is contradictory; I'm currently still examining official Microsoft information. The biggest doubt I have is regarding logical sector number 12; I can't find any information about it. The best clue I found was in this 2012 thread in which @DiracDeBroglie @jaclaz @Tripredacus discusses its contents. How to repair the BOOTSECTOR of a FAT32X active partition? https://msfn.org/board/topic/157262-how-to-repair-the-bootsector-of-a-fat32x-active-partition/ Which brings us to Starman's website, which claims that this sector 12 is only used when installing Windows XP. https://thestarman.pcministry.com/asm/mbr/ntFAT32brHexEd.htm https://thestarman.pcministry.com/asm/mbr/FAT32brcomp.htm I have to discuss this, as I don't install Windows XP; I copy the folders and files from an installation on another computer and paste them into my current installation using a generic chipset configuration. It's true that sometimes I do this with an image, but other times I simply unzip the files and folders to another hard drive, and the system works perfectly, and I do have sector 12 occupied. So, who creates sector 12, when, and for what purpose? Regarding VBR logical sectors 0, 1, and 2, these change depending on whether the partition is bootable or contains data. "A bootable partition can only have NTLR or contain an operating system". This is my current MBR disk structure: Disk 0 Primary Partition 1 -> FAT32 -> Boot Only, NTLDR, NTDETECT.COM, BOOT.INI Primary Partition 2 -> FAT32 -> Windows 2000 Primary Partition 3 -> FAT32 -> Windows XP Primary Partition 4 -> FAT32 -> Data Disk 1 Primary Partition 1 -> FAT32 -> Boot Only, BOOTMGR, and third-party loader. Primary Partition 2 -> NTFS -> Windows 7 Primary Partition 3 -> NTFS -> Windows 10 Primary Partition 4 -> FAT32 -> Data Disk 2, Disk 3... Three primary partitions and one extended partition with several logical partitions on disks with 512e logical sectors and 4096 logical sectors. In the following post I write what I have written down and more or less verified.

Finally I have graphically fixed them with the always versatile Diskgenius. In the lower part of the information of each partition there is a button that says Analyce. In this way I can know the initial sector of each region of a partition and go directly to it with Winhex

I would like to find a program that graphically shows the space occupied by the starting sector, the FAT table, the copy of this with the reserved sectors and the location of the data area. With file defragmers I can see the area occupied by the MFT in NTFS, but there is no information about FAT. Do you know any program that shows this data graphically specifying the size they occupy and in what sectors are they? Edit: I'd also find a program that compiles a columnar list indicating the contents of the physical sectors helpful. For example: Sector 0 --> Boot Sector Sector 1-63 --> Empty Sector 64-2048 --> FAT Table Sector 2048-4000 --> Copy FAT Table I guess showing the fragmented location of each file in a list would be too much...

Sorry, that I have not explained well. I know Windows XP can work as data disk with hard drives with 4K physical sector and logical sector 512E (not for booting). My question is whether Windows XP can work with hard drives with 4K physical sector and also 4KN logical sector. The majority of hard drives that exceed the 2 TIB are 4K-512E, but some are 4K-4KN which would supposedly imply breaking the 2 Tib barrier of the Master Boot Record and also of GPT with the Windows 2003 drivers. Does any user have a 4K-4KN hard disk? how to recognize a hard disk before buying.... https://support-en.wd.com/app/answers/detailweb/a_id/20968/

According to Microsoft specifications, native 4K drives with logical sectors of 4096 bytes (not 512e) are only supported starting with Windows Eight. However, if I'm currently working with MBR +2 TiB hard drives with USB adapters that convert the logical sector from 512e to 4096 bytes, why won't Windows XP read native 4K drives as SATA-connected data drives? I understand that the BIOS will have to be prepared to recognize them, but otherwise, I don't understand the problem. Although it is true that GPT drives with the Paragon driver report logical sectors as 512 bytes and physical sectors as 512 bytes, even though their physical sectors are 4096 bytes. Official Microsoft info: https://learn.microsoft.com/en-us/troubleshoot/windows-server/backup-and-storage/support-policy-4k-sector-hard-drives I also have to say that in theory FAT16x was supported by Windows NT 4.0 with logical sectors up to 8192 bytes to increase its capacity up to 16 GiB

According to what a user with hard disks larger than 16 Tb told me in the following Spanish forum... https://foro.elhacker.net/hardware/tamano_limite_de_particiones_fat32_exfat_y_ntfs-t523346.0.html;msg2283776#msg2283776 In GPT, the partition size limit depends on the cluster size, regardless of whether the logical/physical sector size is 512 bytes or 4096 bytes. At least up to 8 ZiB (2^64 sectors×512 bytes=8 ZiB). Therefore, the 2 TiB limit would not be conditioned by a physical sector size of 512 bytes, although manufacturers may find it more convenient to create 4096 byte sectors to reduce the physical volume of the disk. I'm updating the first post with this information.

erase

I concluded a while ago that to recover files, the ideal solution is to create an image of the partition to be recovered and work on it, saved on another hard disk. Now, trying to put this idea into practice, I see that it's not so easy. It's true that many file recovery programs have this option built in; the problem is working with that same image from other file recovery programs. The first quality that the created image must have is that it was created with a sector-by-sector copy of the partition. (Otherwise, it wouldn't copy the deleted files.) Then I mount the image with the ImDisk program so that it appears as a virtual hard drive with its own drive letter. (Other programs can simulate a CD drive instead of a hard drive.) The problem is that when I start a file recovery program, it doesn't show that drive letter because it doesn't belong to a real hard disk, the programs only show the real hard drives that exist. How can I emulate that virtual drive as belonging to a real hard disk?