![]() (4) Let's start interpreting this partition entry. The very first byte in this entry tells us whether this partition is bootable or not. That means whether this partition contains an operating system or not. ![]() That means, no this is not a bootable partition. (5) Another useful information is what type of file system is available on this partition. That information is available in the offset 0x04 location in the partition entry. Our reference document tells us that this value means, our partition is a FAT32 partition. So we will be able to explore this partition. (6) Next question that arises is where is this FAT32 partition in the disk image? How to locate it? Again our reference document tells us that the offset 0x08 of the partition entry contains 4 bytes which specify the starting sector of this partition. When you look at the partition entry, you can see that this value is 00 08 00 00. So, this value represents the starting sector of the FAT32 partition. We need to interpret this number carefully. This is a number stored in little-endian format. ![]() ![]() That means, the last byte is the most significant byte. We have to reverse the order of these bytes before interpreting. The number you get once you revert it from little-endian format is 00 00 08 00. Let's use the calculator to convert this hexadecimal number to decimal. That means This FAT32 partition begins at the sector number 2048. Let's go there and see this partition.īut, wait! Our hex editor shows offsets in bytes, not in sector numbers. ![]()
0 Comments
Leave a Reply. |