1

I'm learning file system recently. wikipedia says the partition table is located at 0x01BE, but when I check my USB drive(NTFS) by a binary tool, there are some words there "Press Ctrl + Alt + Del to restart". It doesn't look like partition table. Why? Where is the partition table?

Improve this question
7
  • Are you sure the disk is MBR and not GPT?
    – Ramhound
    Jan 6 at 23:42
  • @Ramhound Yes. I checked the property of volume in disk management. It is MBR
    – Ryan
    Jan 6 at 23:45
  • Do you check the whole device (in Linux like /dev/sdc)? Or the partition (in Linux like /dev/sdc1)?
    – Kamil Maciorowski
    Jan 6 at 23:46
  • @KamilMaciorowski I use windows. I check by Disk Designator, such as G: or H:. Is this correct? How could I check the whole device?
    – Ryan
    Jan 6 at 23:52
  • 1
    AFAIK Windows likes to pretend a filesystem is equivalent to the partition it's in; and it likes to pretend a single partition is equivalent to the disk it belongs to. I would say a drive letter is assigned to a filesystem. Most likely what your binary tool read is a partition. The partition table does not belong to any partition (at least it shouldn't).
    – Kamil Maciorowski
    Jan 6 at 23:58

1 Answer 1

Reset to default
1

A picture says more than a thousand words..

enter image description here

64 bytes at offset 0x01BE (446), with room for 4 entries of 16 bytes each. In this case only one entry is used to define a GPT Protective Partition as the partitions are actually defined in the GUID partition table (GPT).

Same sector interpreted as partition table:

enter image description here

This EE type partition typically occupies the entire drive or the 4 bytes for LBA sectors is maxed out (0xFFFFFFFF - 4294967295 - 2TB) as we see on this 4 TB drive so that 'legacy' partition tools and editors perceive the drive as fully allocated. And this is also where the '2 TB' maximum partition size for legacy/MBR partition tables originates.

enter image description here

An awesome resource for this type of stuff is the "The Starman", https://thestarman.pcministry.com/asm/mbr/GPT.htm.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.