MBR Partitioning Scheme - Practice part

Task 1 - Finding the maximum number of irregularities

When recovering partitions, data recovery technicians have to work with basic partition structures in a disk viewer and be able to spot some peculiarities and irregularities. In partitions utilizing MBR, the main structure is located in the sector zero of a physical disk.

In this task, you are offered to find as many irregularities as possible for a test 1024 MB physical disk working with the Disk Management screenshot and disk viewer screenshot displaying the data of sector zero.

ReclaiMe Pro disk viewer screenshot

Note that the Relative sectors field points to the first sector of the partition.

Disk Management screenshot

Task 2 – Partition recovery by editing MBR

There is a VHD disk image file with several partitions formatted to Windows filesystems. First, we saved ReadMe.txt file to each partition and then edited MBR of the underlying physical disk.

Your task is to make four changes to the MBR using the built-in ReclaiMe Pro disk editor so that Windows will be able to open partitions and provide access to the text files.

You may find it helpful to have on hand a list of partition types - http://en.wikipedia.org/wiki/Partition_type

Additionally, keep in mind that although changes should be made only to MBR, filesystem boot sectors (which are located in the first sector of each partition) give you lots of information useful in partition recovery.

1 disk image file compressed to a ZIP archive, 850 KB

What we did in these situations

For a reference point, see what we did and what we were able to figure out - download PDF with our notes here.