MBR Partitioning Scheme - Practice part
Task 1 - Finding the maximum number of irregularities
When recovering partitions, data recovery technicians have to work with basic partition structures in a disk viewer and be able to
spot some peculiarities and irregularities. In partitions utilizing MBR, the main structure is located in the sector zero of a physical disk.
In this task, you are offered to find as many irregularities as possible for a test 1024 MB physical disk working with the
Disk Management screenshot and disk viewer screenshot displaying the data of sector zero.
ReclaiMe Pro disk viewer screenshot
Note that the Relative sectors
field points to the first sector of the partition.
Disk Management screenshot
Task 2 – Partition recovery by editing MBR
There is a VHD disk image file with several partitions formatted to Windows filesystems.
First, we saved ReadMe.txt file to each partition and then edited MBR of the underlying physical disk.
Your task is to make four changes to the MBR using the built-in ReclaiMe Pro disk editor so that Windows will be able to
open partitions and provide access to the text files.
You may find it helpful to have on hand a list of partition types -
Additionally, keep in mind that although changes should be made only to MBR,
filesystem boot sectors (which are located in the first sector of each partition) give you lots of information useful in partition recovery.
Download disk image file
1 disk image file compressed to a ZIP archive, 850 KB
What we did in these situations
For a reference point, see what we did and what we were able to figure out - download PDF with our notes
Continue to test