1

I have full formatted a 1TB hard disk in Windows using NTFS format. Then in linux I run the following command to see what happend to the disk blocks!

dd if=/dev/sdf1 | hexdump

I expected to see hex codes for partition info in the first blocks and zero for all the next blocks because I unchecked quick format in format partition dialog.

But hexdump shows the codes like below for first 4GB of the disk. What are these?!

If these are reserved for partition table, why there is zero blocks between them?

c003f000 4946 454c 0030 0003 1c67 0200 0000 0000
c003f010 0001 0000 0038 0000 0040 0000 0400 0000
c003f020 0000 0000 0000 0000 0000 0000 00fc 0000
c003f030 0002 0000 0000 0000 ffff ffff 0000 0000
c003f040 0000 0000 0000 0000 0000 0000 0000 0000
*
c003f1f0 0000 0000 0000 0000 0000 0000 0000 0002
c003f200 0000 0000 0000 0000 0000 0000 0000 0000
*
c003f3f0 0000 0000 0000 0000 0000 0000 0000 0002
c003f400 4946 454c 0030 0003 1c7a 0200 0000 0000
c003f410 0001 0000 0038 0000 0040 0000 0400 0000
c003f420 0000 0000 0000 0000 0000 0000 00fd 0000
c003f430 0002 0000 0000 0000 ffff ffff 0000 0000
c003f440 0000 0000 0000 0000 0000 0000 0000 0000
*
c003f5f0 0000 0000 0000 0000 0000 0000 0000 0002
c003f600 0000 0000 0000 0000 0000 0000 0000 0000
*
c003f7f0 0000 0000 0000 0000 0000 0000 0000 0002
c003f800 4946 454c 0030 0003 1c8d 0200 0000 0000
c003f810 0001 0000 0038 0000 0040 0000 0400 0000
c003f820 0000 0000 0000 0000 0000 0000 00fe 0000
c003f830 0002 0000 0000 0000 ffff ffff 0000 0000
c003f840 0000 0000 0000 0000 0000 0000 0000 0000
*
c003f9f0 0000 0000 0000 0000 0000 0000 0000 0002
c003fa00 0000 0000 0000 0000 0000 0000 0000 0000
*
c003fbf0 0000 0000 0000 0000 0000 0000 0000 0002
c003fc00 4946 454c 0030 0003 1ca0 0200 0000 0000
c003fc10 0001 0000 0038 0000 0040 0000 0400 0000
c003fc20 0000 0000 0000 0000 0000 0000 00ff 0000
c003fc30 0002 0000 0000 0000 ffff ffff 0000 0000
c003fc40 0000 0000 0000 0000 0000 0000 0000 0000
*
c003fdf0 0000 0000 0000 0000 0000 0000 0000 0002
c003fe00 0000 0000 0000 0000 0000 0000 0000 0000
*
c003fff0 0000 0000 0000 0000 0000 0000 0000 0002
c0040000 0000 0000 0000 0000 0000 0000 0000 0000
*
2

1 Answer 1

3

They are MFT records.

Your expectations are wrong in several respects.

Firstly: The partition table isn't stored within individual partitions. You won't see anything to do with the partition table by dumping the contents of one individual partition.

Secondly: Empty formatted volumes have structure. They're not just runs of zero-filled blocks. On a FAT volume there'll be a FAT and a root directory. On an EXT2 volume there'll be inodes, superblocks, and bitmaps. On an NTFS volume there'll be the Master File Table, the root directory, the free space bitmap, and various other things. These things have various "magic numbers", flags, offsets, "end" markers, and whatnot which don't have zero as their initial, formatted, values.

What you're seeing here is, per the 4-byte signature at the start of each record and the record numbers, records 252 to 255 in the Master File Table. Those MFT records are 4KiB each.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .