Understand the Partition Table within Master Boot Record (MBR) | Digital Forensics | File System

The Master Boot Record (MBR) is the first sector of the hard disk. The BIOS boot code looks to the first sector of the default drive, which contains the MBR. The MBR contains three components,
1. executable code called the master boot code.
2. The partition table for the disk.
3. The disk signature.
The boot loader looks for the active partition in the table and loads the first sector in that partition.
That sector is known as the Partition Boot Record. The Partition Boot Record will then start the process of loading the operating system.
The last two sectors of the MBR contain a two-byte structure called a signature word or end-of-sector marker, which is always set to 0x55AA.

Please consider sharing my videos.
Digital Forensic Investigation Case in OpenText EnCase 23 | Part 1 How to add evidence files
Discover Cybersecurity Degree in the UK 2024 | Uncover the Secrets to Choosing the Right University
How to Write Project Proposal using ChatGPT for UG, MSc, and PhD | Full Tutorial
Penetration Testing & Ethical Hacking | XMAS scan Vs SYN scan | Understand them U Nmap and WireShark
How to get network connection information ( telnet ) from RAM memory? Using volatility 3. Password ?
How to make a Forensic Image with FTK Imager | Forensic Acquisition in Windows | Physical Disk Image

[BluEye-xu]

Hey! Thank you for the video, i wanna see more stuff on file carving, GPT analysis and extended partition analysis. I am actually just getting starting into forensics and found your video really helpful to understand the structure of DOS|MBR partitioned drives, furthermore i have downloaded the raw disk images you mentioned and have examined the second partition entry metadata.
1- first byte set to 0x00 indicating this as non-bootable partition
2- partition type value to 0x07, indicating NTFS partition(FS type is NTFS)
3- starting LBA address -> 0x32800 = 206, 848 -> starting in-file offset ->
4-size of the partition in sectors 0x27CD000 -> size of the partition in bytes 21367881728 =~21GB

[BufferTheHutt]

good explanation. I prefer the Active Disk Editor for MBR analysis, because of the templates and color segmentation.

[CyDig]

Hi All, I hope you enjoy my videos. Could I ask you to support my channel by sharing my videos to help it grow? Don't forget to like and subscribe. Also, if you'd like me to create a new video on any topic related to cyber security and digital forensics, just let me know.