Re: MBR partitioning, and content after partition table but before first partition

["Thomas Schmitt" <scdbackup@gmx.net>]

Hi,

David Christensen wrote:
> Examining a Windows XP disk, the first partition (C:\) starts at block 63
> (track 1):
> [...]
> Number  Start  End         Size        Type     File system  Flags
>  1      63s    156296384s  156296322s  primary  ntfs         boot

That's an oldfashioned layout. Bad for disks with blocksize larger than
512 bytes, because of the odd block count.


> 000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa

This is the end of the MBR. The first partition slot is at address
000001be.


> 00007c00  12 91 f2 60 90 a0 2f 19  01 00 00 00 85 00 67 68 |...`../.......gh|
> 00007c10  46 44 23 cc 22 52 1d ac  22 52 32 4e 6f 72 74 6f |FD#."R.."R2Norto|
> 00007c20  6e 20 47 68 6f 73 74 20  32 30 30 33 00 00 00 00 |n Ghost 2003....|

That's in the last block before partition 1 begins.
No idea whether it is trash or whether Norton Ghost dumped a tag there.
(In this case it belongs to GiaThnYgeia's list of occasions which change
the unclaimed disk area.)


> Examining a Jesse system drive, the first partition starts at block 2048 (1
> MB = 2**20 bytes):

That's the modern layout. I wonder how long it will last until 1 MiB are
considered too small.


> 0000c990  b0 b3 2c fa a4 38 f1 f8  77 f0 2d dd c2 4a a4 a9 |..,..8..w.-..J..|
> What is in blocks 1-101?

Could be GRUB program code. Do you see cleartext messages in the first
100 blocks ?

With
  dd if=/dev/sda bs=512 count=100 | strings | less
i get from my system disk
  ZRr=
  `|f     
  \|f1
  GRUB 
  Geom
  Hard Disk
  Read
  Error
  loading
  Geom
and much more text salad.


Have a nice day :)

Thomas