2

I'm using a hex editor (wxHexEditor) to explore a hard drive content. I'm looking for where the label of a partition is stored.

So the drive I'm exploring is a GPT drive formatted in NTFS. With Gparted I changed the name and the label of the partition. The name is easy to find, it's a GPT specificity, it is stored in the partition table. However I can't find where the label is stored.

My NTFS Boot Sector is on the sector 2048. I'm looking at the Wikipedia page of NTFS that quotes :

In NTFS, all file, directory and metafile data — file name, creation date, access permissions (by the use of access control lists), and size — are stored as metadata in the Master File Table (MFT).

And the paragraph Metafiles contains a list of metafiles :

$Volume : Contains information about the volume, namely the volume object identifier, volume label […]

So logically the label of the partition is stored in this Master File Table.
Right above in the paragraph Partition Boot Sector it is indicated that at the byte offset 0x30, 8 bytes indicate the cluster that contains the Master File Table. For me it's 0x0000000000000004. However at the cluster 4 I have nothing, the block is completely empty.

Where does the NTFS filesystem store the label of a partition then ?

1 Answer 1

4

The information is correct.

After formatting, on a NTFS larger than a few GB, you’ll find the MFT usually at cluster 0xC0000. With the normal cluster size of 8 sectors, this amounts to 0xC0000 × 8 = 0x600000 = Sector 6291456 The value 0x0000...004, given in Wikipedia as "typical", is not common at all.

You can post a dump of the partition boot sector, so we can check it.

Also, in the hex editor, simply search for the string "FILE0", this string is found in every MFT entry. Usually, you will find the mirror copy of the first 24 MFT entries near the beginning, and then you simply have to find the MFT entry that somewhere has the name $Volume (written in UCS2, that means, "$.V.o.l.u.m.e." in the hex view), there you should be able to find the partition label.

5
  • Ok so I found the MFT table. The first file is at sector 2080. And as you said I found the file $Volume containing the label. The thing is my partition boot sector indicates 0x0000000000000004 (converted from little-endian) just like Wikipedia does. So I really don't understand why my MFT is at sector 2080. Here's a dump of the partition boot sector. If you don't want to download a file here's a paste.
    – Nicryc
    Jan 30, 2020 at 14:27
  • 1
    You write "The First File is at sector 2080". This makes perfect sense: The NTFS boot sector is at sector 2048. One cluster is 8 sectors in size. So add 4 clusters to 2048 you get 2048 + 4 * 8 = 2080: voilà You have to remember 1) that your hex editor shows the entire disk with the 2048 sectors offset of the partition 2) that all offsets in the NTFS are given in clusters (1 cluster = 8 sectors). Try opening the partition node instead (e.g. /dev/sda1 instead of /dev/sda), and you don’t have to deal with offsets.
    – Ro-ee
    Jan 30, 2020 at 23:12
  • Oh ok I didn't understand that it was byte offset, I thought it was a sector address. i was confused with the words. I tried to change the cluster size to 2097152 bytes, the partition boot sector indicated 0x0000000000000002. And as your calculations suggested I found the MFT at sector 10240. Thank you !
    – Nicryc
    Jan 31, 2020 at 22:13
  • no, it’s not a byte offset. The MFT start address is in clusters, but relative to the NTFS boot sector (in your case, 2048).
    – Ro-ee
    Feb 1, 2020 at 0:24
  • Yes I got it, I meant cluster offset from NTFS boot sector.
    – Nicryc
    Feb 2, 2020 at 1:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .