98SE Posted October 24, 2017 Share Posted October 24, 2017 (edited) MBR / GPT Drive Dissection NOTE: This INFORMATION is a WORK IN PROGRESS !!! [SUPER CAPACITIES] 1YB 1ZB 1EB [EXTENDED CAPACITIES] 1PB 512TB 256TB - CURRENT NTFS/exFAT LIMIT 128TB 64TB 32TB [MODERN CAPACITIES] 20TB 18TB - POSSIBLE MBR LIMIT WITH ADAPTERS 16TB 12TB 10TB 8TB 6TB 5TB 4TB 3TB [COMMON CAPACITIES] 2.0TB - (2.2TB CLASSIC MBR LIMIT) 1.5TB 1.0TB 750GB 500GB 320GB 250GB 200GB 160GB [LEGACY BARRIER] 128GB - (LEGACY LBA 28-BIT BARRIER) 120GB Edited November 7, 2017 by 98SE Link to comment Share on other sites More sharing options...
98SE Posted October 24, 2017 Author Share Posted October 24, 2017 (edited) [SUPER CAPACITIES] - RESERVED FOR FUTURE ANALYSIS 1YB 1ZB 1EB Edited October 24, 2017 by 98SE Link to comment Share on other sites More sharing options...
98SE Posted October 24, 2017 Author Share Posted October 24, 2017 (edited) [EXTENDED CAPACITIES] - RESERVED FOR FUTURE ANALYSIS 1PB 512TB 256TB - CURRENT NTFS/exFAT WINDOWS LIMIT 128TB 64TB 32TB Edited October 24, 2017 by 98SE Link to comment Share on other sites More sharing options...
98SE Posted October 24, 2017 Author Share Posted October 24, 2017 (edited) [MODERN CAPACITIES] 20TB 18TB - POSSIBLE MBR LIMIT WITH ADAPTERS 16TB 12TB 10TB ═══════════════════════════════════════════════════════════════════════════════════ 8TB Brand Western Digital Model # WD80EFZX https://www.wdc.com/products/internal-storage/wd-red.html#WD80EFZX Specifications: Form Factor 3.5" Capacity Interface RPM Class Cache 8TB SATA 6Gb s 5400RPM 128MB Advanced Format AF 512-byte emulation (512e) Installation Type: USB External HDD with 32-Bit Address Translation Adapter Partitioning: XP Professional 32-Bit with SP3 MBR Single NTFS Partition 64KB Allocation Unit Size ╔═════════════╗ ║wmic diskdrive get ║ ╚═════════════╝ Caption,DeviceID,Size Caption 98SE 8TB MBR EXTERNAL USB Device DeviceID \\.\PHYSICALDRIVE0 Size 8001552384000 ╔═════════════╗ ║fsutil fsinfo ntfsinfo ║ ╚═════════════╝ NTFS Volume Serial Number : ------------------ Version : 3.1 Number Sectors : 0x0000000074701ac0 Total Clusters : 0x00000000074701ac Free Clusters : 0x0000000000000001 Total Reserved : 0x0000000000000000 Bytes Per Sector : 4096 Bytes Per Cluster : 65536 Bytes Per FileRecord Segment : 4096 Clusters Per FileRecord Segment : 0 Mft Valid Data Length : 0x00000000080c0000 Mft Start Lcn : 0x000000000000c000 Mft2 Start Lcn : 0x0000000003a380d6 Mft Zone Start : 0x00000000009fe980 Mft Zone End : 0x00000000009fe9a0 ╔════════════════╗ ║ DOS MBR EXTRACTION ║ ╚════════════════╝ -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0 B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2C 44 63 6A 91 23 4F 83 7D 00 01 01 00 07 FE FF FF 3F 00 00 00 C1 1A 70 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ═══════════════════════════════════════════════════════════════════════════════════ 6TB 5TB 4TB 3TB Edited November 7, 2017 by 98SE Link to comment Share on other sites More sharing options...
98SE Posted October 24, 2017 Author Share Posted October 24, 2017 (edited) [COMMON CAPACITIES] 2.0TB - (2.2TB CLASSIC MBR LIMIT) 1.5TB 1.0TB 750GB 500GB 320GB 250GB 200GB 160GB Edited October 24, 2017 by 98SE Link to comment Share on other sites More sharing options...
98SE Posted October 24, 2017 Author Share Posted October 24, 2017 (edited) [LEGACY BARRIER] 128GB - (LEGACY LBA 28-BIT BARRIER) 120GB Edited October 24, 2017 by 98SE Link to comment Share on other sites More sharing options...
98SE Posted October 24, 2017 Author Share Posted October 24, 2017 (edited) [FORMER LEGACY BARRIERS] Edited October 24, 2017 by 98SE Link to comment Share on other sites More sharing options...
98SE Posted October 24, 2017 Author Share Posted October 24, 2017 (edited) [PARTITIONING] Edited October 24, 2017 by 98SE Link to comment Share on other sites More sharing options...
98SE Posted October 24, 2017 Author Share Posted October 24, 2017 (edited) RESERVED SLOT Edited October 24, 2017 by 98SE Link to comment Share on other sites More sharing options...
98SE Posted October 24, 2017 Author Share Posted October 24, 2017 (edited) FINAL RESERVED SLOT Edited October 24, 2017 by 98SE Link to comment Share on other sites More sharing options...
jaclaz Posted October 25, 2017 Share Posted October 25, 2017 (edited) And the MBR you posted is a PBR or VBR or volume boot sector, NOT a Master Boot Record. . 15 hours ago, 98SE said: ╔══════════════╗ ║Master Boot Record ║ ╚══════════════╝ 00000000 EB 52 90 4E 54 46 53 20 20 20 20 00 10 10 .R.NTFS ... 0000000E 00 00 00 00 00 00 00 F8 00 00 3F 00 FF 00 ..........?... 0000001C 3F 00 00 00 00 00 00 00 80 00 80 00 C0 1A ?............. 0000002A 70 74 00 00 00 00 00 C0 00 00 00 00 00 00 pt............ 00000038 D6 80 A3 03 00 00 00 00 F4 00 00 00 F4 00 .............. 00000046 00 00 2E B0 5B 1C DC 5B 1C 5C 00 00 00 00 ....[..[.\.... 00000054 FA 33 C0 8E D0 BC 00 7C FB B8 C0 07 8E D8 .3.....|...... 00000062 E8 16 00 B8 00 0D 8E C0 33 DB C6 06 0E 00 ........3..... 00000070 10 E8 53 00 68 00 0D 68 6A 02 CB 8A 16 24 ..S.h..hj....$ 0000007E 00 B4 08 CD 13 73 05 B9 FF FF 8A F1 66 0F .....s......f. 0000008C B6 C6 40 66 0F B6 D1 80 E2 3F F7 E2 86 CD ..@f.....?.... 0000009A C0 ED 06 41 66 0F B7 C9 66 F7 E1 66 A3 20 ...Af...f..f. 000000A8 00 C3 B4 41 BB AA 55 8A 16 24 00 CD 13 72 ...A..U..$...r 000000B6 0F 81 FB 55 AA 75 09 F6 C1 01 74 04 FE 06 ...U.u....t... 000000C4 14 00 C3 66 60 1E 06 66 A1 10 00 66 03 06 ...f`..f...f.. 000000D2 1C 00 66 3B 06 20 00 0F 82 3A 00 1E 66 6A ..f;. ...:..fj 000000E0 00 66 50 06 53 66 68 10 00 01 00 80 3E 14 .fP.Sfh.....>. 000000EE 00 00 0F 85 0C 00 E8 B3 FF 80 3E 14 00 00 ..........>... 000000FC 0F 84 61 00 B4 42 8A 16 24 00 16 1F 8B F4 ..a..B..$..... 0000010A CD 13 66 58 5B 07 66 58 66 58 1F EB 2D 66 ..fX[.fXfX..-f 00000118 33 D2 66 0F B7 0E 18 00 66 F7 F1 FE C2 8A 3.f.....f..... 00000126 CA 66 8B D0 66 C1 EA 10 F7 36 1A 00 86 D6 .f..f....6.... 00000134 8A 16 24 00 8A E8 C0 E4 06 0A CC B8 01 02 ..$........... 00000142 CD 13 0F 82 19 00 8C C0 05 20 00 8E C0 66 ......... ...f 00000150 FF 06 10 00 FF 0E 0E 00 0F 85 6F FF 07 1F ..........o... 0000015E 66 61 C3 A0 F8 01 E8 09 00 A0 FB 01 E8 03 fa............ 0000016C 00 FB EB FE B4 01 8B F0 AC 3C 00 74 09 B4 .........<.t.. 0000017A 0E BB 07 00 CD 10 EB F2 C3 0D 0A 41 20 64 ...........A d 00000188 69 73 6B 20 72 65 61 64 20 65 72 72 6F 72 isk read error 00000196 20 6F 63 63 75 72 72 65 64 00 0D 0A 4E 54 occurred...NT 000001A4 4C 44 52 20 69 73 20 6D 69 73 73 69 6E 67 LDR is missing 000001B2 00 0D 0A 4E 54 4C 44 52 20 69 73 20 63 6F ...NTLDR is co 000001C0 6D 70 72 65 73 73 65 64 00 0D 0A 50 72 65 mpressed...Pre 000001CE 73 73 20 43 74 72 6C 2B 41 6C 74 2B 44 65 ss Ctrl+Alt+De 000001DC 6C 20 74 6F 20 72 65 73 74 61 72 74 0D 0A l to restart.. 000001EA 00 00 00 00 00 00 00 00 00 00 00 00 00 00 .............. 000001F8 83 A0 B3 C9 00 00 55 AA However it is interesting a 14 byte wide visualization. jaclaz Edited October 25, 2017 by jaclaz Link to comment Share on other sites More sharing options...
98SE Posted October 25, 2017 Author Share Posted October 25, 2017 (edited) 5 hours ago, jaclaz said: And the MBR you posted is a PBR or VBR or volume boot sector, NOT a Master Boot Record. . This was what would be the MBR according to Hex Workshop. Remember this is via the USB external adapter so if this alters what you wanted to see you better explain in detail the program and method you use to acquire the MBR. I already stated prior that anyone who wanted the opportunity to make suggestions of tools you wanted used for any information gathering rather than complain about not seeing the MBR which you didn't care about. But given you identify this as a PBR/VBR what interesting tid bits did you decipher and salivate upon MR. MBR/PBR/VBR analyst? Quote However it is interesting a 14 byte wide visualization. No kidding. It was meant to preserve the data so someone like you or anyone into analyzing this could copy and analyze the information rather than a static photo snapshot. Edited October 25, 2017 by 98SE Link to comment Share on other sites More sharing options...
jaclaz Posted October 26, 2017 Share Posted October 26, 2017 15 hours ago, 98SE said: This was what would be the MBR according to Hex Workshop. Remember this is via the USB external adapter so if this alters what you wanted to see you better explain in detail the program and method you use to acquire the MBR. I already stated prior that anyone who wanted the opportunity to make suggestions of tools you wanted used for any information gathering rather than complain about not seeing the MBR which you didn't care about. But given you identify this as a PBR/VBR what interesting tid bits did you decipher and salivate upon MR. MBR/PBR/VBR analyst? No kidding. It was meant to preserve the data so someone like you or anyone into analyzing this could copy and analyze the information rather than a static photo snapshot. Naah. First physical sector of the disk (or \\.\PhtsicalDrive) is the MBR. What you posted is NOT the MBR, it is the PBR (and starts on sector 63 of the disk, i.e. on first sector of the volume). You somehow chose the Volume instead of the \\.\PhysicalDrive in Hex Workshop. I posted an image of the data with its common interpretation, and from it you can easily see which tools I used. By convention these data is visualized in 16 byte wide format, not 14. jaclaz Link to comment Share on other sites More sharing options...
98SE Posted October 26, 2017 Author Share Posted October 26, 2017 (edited) On 10/26/2017 at 12:08 AM, jaclaz said: Naah. First physical sector of the disk (or \\.\PhtsicalDrive) is the MBR. What you posted is NOT the MBR, it is the PBR (and starts on sector 63 of the disk, i.e. on first sector of the volume). You somehow chose the Volume instead of the \\.\PhysicalDrive in Hex Workshop. I posted an image of the data with its common interpretation, and from it you can easily see which tools I used. By convention these data is visualized in 16 byte wide format, not 14. 8TB DOS MBR extraction "www.msfn.org/board/topic/177176-mbr-gpt-drive-dissection/?do=findComment&comment=1146507" Edited November 7, 2017 by 98SE Link to comment Share on other sites More sharing options...
Tripredacus Posted October 26, 2017 Share Posted October 26, 2017 The default formatting on the forum is messy, you should try using a code box with no syntax highlighting. Relevant: http://thestarman.pcministry.com/asm/mbr/MSWin41BRinHexEd.htm Link to comment Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now