1

I'm learning file system recently. wikipedia says the partition table is located at 0x01BE, but when I check my USB drive(NTFS) by a binary tool, there are some words there "Press Ctrl + Alt + Del to restart". It doesn't look like partition table. Why? Where is the partition table?

7
  • Are you sure the disk is MBR and not GPT?
    – Ramhound
    Jan 6, 2023 at 23:42
  • @Ramhound Yes. I checked the property of volume in disk management. It is MBR
    – Ryan
    Jan 6, 2023 at 23:45
  • Do you check the whole device (in Linux like /dev/sdc)? Or the partition (in Linux like /dev/sdc1)? Jan 6, 2023 at 23:46
  • @KamilMaciorowski I use windows. I check by Disk Designator, such as G: or H:. Is this correct? How could I check the whole device?
    – Ryan
    Jan 6, 2023 at 23:52
  • 1
    AFAIK Windows likes to pretend a filesystem is equivalent to the partition it's in; and it likes to pretend a single partition is equivalent to the disk it belongs to. I would say a drive letter is assigned to a filesystem. Most likely what your binary tool read is a partition. The partition table does not belong to any partition (at least it shouldn't). Jan 6, 2023 at 23:58

1 Answer 1

1

A picture says more than a thousand words..

enter image description here

64 bytes at offset 0x01BE (446), with room for 4 entries of 16 bytes each. In this case only one entry is used to define a GPT Protective Partition as the partitions are actually defined in the GUID partition table (GPT).

Same sector interpreted as partition table:

enter image description here

This EE type partition typically occupies the entire drive or the 4 bytes for LBA sectors is maxed out (0xFFFFFFFF - 4294967295 - 2TB) as we see on this 4 TB drive so that 'legacy' partition tools and editors perceive the drive as fully allocated. And this is also where the '2 TB' maximum partition size for legacy/MBR partition tables originates.

enter image description here

An awesome resource for this type of stuff is the "The Starman", https://thestarman.pcministry.com/asm/mbr/GPT.htm.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .