This is a very low level disk question, and I have only been working with this stuff for a short time, and it is quite a different learning experience, so pardon any carelessness with terms, definitions, etc.

I have a Self-Encrypting Drive with different "Ranges" defined on it. These ranges are specified in sectors, and they must be matched up with whatever is on the disk which should be encrypted. These ranges can correspond to filesystems or not. For example, my disk has its MBR in a separate "Range" so that it can be accessed at all times.

The disk contains an Extended partition with several Logical partitions. Each of these logical partitions has two Ranges which correspond to it. One Range covers the first 32KB of the Logical Partition, with the second Range covering the remainder.

My first question is: What exactly is in the first 32KB of the Logical Partition? Is this similar to the 32KB reserved at the beginning of the disk for the MBR? Is the EBR located in this area?

My second question is: What harm would come from either locking this area (making it read-only) or allowing it to be open? Specifically, for locking it, are there any functionality risks, and for keeping it open, are there any security risks? (ie. even if the main partition is locked, could a hacker do something with only the first 32KB accessible?)

Not sure if it matters, but my logical partitions consist of FAT32, ext3, and NTFS.

  • Bumping this up. If anyone knows about this, could you provide some documentation/resources? – Kyle Aug 17 '15 at 17:26

Figured I would come back here to answer this. The first sector of an extended partition is the first "EBR" or Extended Boot Record, containing the information about the first logical partition in the extended partition pool, as well as a pointer to/location of the next EBR. Hence, these EBR's form a linked list. Therefore, when the OS enumerates partitions on a disk, it must traverse this linked list, which requires read access to this area. Changing any logical partition will change its EBR, and will therefore require write access to this area.

There is a good explanation on Wikipedia, which for whatever reason didn't show up in my initial searching.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.