Re: I'm having an image problem...

From: <James.Holley(at)ey.com>
Date: Fri Feb 14 2003 - 23:03:11 EST

James said:

/*
Any help with the possible drive geometry or the possible cause of this effect
would be much appreciated.
*/

Check the partition table in the Master Boot Record to get a rough idea of the drive geometry. A partition entry includes starting and ending cylinder, head, sector info as well as other very useful data.

Here's the format of a 512 byte MBR - sector 0 - for a Windows/DOS compatible system:

        HEX Offset      Stuff
        000h            446 bytes = boot code
        1BEh            16 bytes - 1st partition entry
        1CEh            16 bytes - 2nd partition entry
        1DEh            16 bytes - 3rd partition entry
        1EEh            16 bytes - 4th partition entry
        1FEh            2 bytes - 55 AA - Boot Record Signature

Each partition entry has the following structure:

        HEX Offset      Stuff
        00h             1 byte - Current State = 00h for not Bootable or 
80h for Bootable
        01h             1 byte - Starting Head = Beginning of Partition
        02h             1 Word - Beginning Cylinder/Sector
        04h             1 byte - Partition Type/File System Indicator Byte 
- 0C = FAT32 - 07 = NTFS
        05h             1 byte - Ending head of Partition
        06h             1 Word - End of Partition - Cylinder and Sector
        08h             1DWord - # of Sectors Between MBR and 1st Sector 
in Partition
        0Ch             1DWord - # of Sectors in the Partition

James

---

James O. Holley
Ernst & Young
Litigation Advisory Services &
Computer Forensic Services
http://litigation.ey.com

Office: 703.747.1059

Fax:       703.747.0104
Lab:       703.747.0253

Pager: 888.620.5275
Pager email: 6205275 "AT" skytel.com

---

---

The information contained in this message may be privileged and confidential and protected from disclosure. If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please notify us immediately by replying to the message and deleting it from your computer. Thank you. Ernst & Young LLP

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Fri Feb 14 23:56:05 2003