I am trying to track down the MBR on a scavenged Hard Drive. The hard drive won't boot so I've been trying to change the MBR through DEBUG.exe. The problem starts with my 64 bit machine because debug.exe is a 16-bit program that is no longer supported unless you have DosBox.
I understand that DosBox is an emulator and I have a basic knowledge of the division between User mode and Kernel mode as well as some fragmented research into the NT internal architecture.
My main question is; If I run DosBox and mount the hard drive I'm trying to debug. Am I viewing the memory on the hard drive if I run the Debug.exe from the mounted drive through DosBox or simple viewing the host 64 bit machine which is running DosBox?
I'm using this as a learning opportunity so any help or direction is appreciated.