The method of judging +mbr+dbr+ebr in Winhex

BR,EBR,DBRThey are all based on55AAEnd
in theWinhexSearch in 16 binary:55AAoffset 512=510
(1) SearchDBRthe Logo:
FAT16of theDbr:eb 3c90 　　 no backup.DBR
FAT32of theDbr:eb(Backup of DBR)in that partitionThe 6th Sector
NTFSof thedbr:eb52(Backup of DBR)in the last sector of the partition
discriminantMBRmethod of:
MBRjust inLBAfirst sector, openPhysical Hard Disk, the first sector is just the one.MBRthe partition TableIn1BEshift backwards to1FD, a total -bytes, each of the -a byte. 1fe-1ffis that"AA"
Abc[/hide]discriminantEBRmethod of:
EBRthe structure andMBRthe structure is the same,the second-to-last byte in the bottom fifth line should be About, and the former446bytes should be a0[/hide]

(2) FindDBRyou can search for a sub-region by searchingEBRto findDBR.

can searchEBR,positioningDBR.
DBRrelative toEBRrear 63rd sector.
(3)when a partition'sDBRif it's broken, just hint.: Not formatted
this time withWinhexOpen the logical disk and it will not open.
we only have to open the physical drive and then jump to that partition.
will be able to viewDBRwhether it was destroyed ....
the mode of the removable physical driveis from"0"sector begins to describe the system
while the logical drive mode is from the systemDBRstart describing the system(from the first -Sector start Description).

Winhex Tutorials + Application + Data Recovery -doc File Recovery -mbr , EBR , DBR

byte position	Content and Meaning
1th Byte	The boot flag. A value of 80H indicates the active partition, and a value of 00H indicates an inactive partition.
2nd, 3, 4 bytes	First magnetic number, sector area code, cylinder number of this partition
5th bytes	partition type: 00h-- 06h--fat16 basic partition 0bh--fat32 basic partition 05h-- Span style= "color: #6D6D6D;" > extended partition 07h--ntfs partition 0fh-- (LBA mode) Extended partition 83h--linux partition
6th, 7, 8 bytes	The end of this section magnetic number, Sector code, cylinder number
9th, 10, 11, 12 bytes	Number of sectors that have been used before this partition
13th, 14, 15, 16 bytes	Total number of sectors in this partition

1 , what is a logical drive?

2 , what is a physical drive?

3 , how to search MBR , EBR , DBR ?

MBR , EBR , DBR They are all based on 55AA End

in the Winhex Search in 16 binary: 55AA offset 512=510

(1) Search DBR the Logo:

FAT16 of the DBR : EB 3C no backup. DBR

FAT32 of the DBR : EB (backed-up DBR ) in the 6th sector of the partition

NTFS of the DBR : EB (backed-up DBR ) in the last sector of the partition

discriminant MBR method of:

MBR just in LBA first sector, open Physical Hard Disk , the first sector is just the one. MBR partition table at 1BE offset back to 1FD, a total of four bytes, each a byte. 1fe-1ff is "AA."

discriminant EBR method of:

EBR the structure and MBR the structure is the same, the second-to-last byte in the bottom fifth line should be About , and the former 446 bytes should be a 0

(2) Find DBR you can search for a sub-region by searching EBR to find DBR .

can search EBR, positioning DBR .

DBR relative to EBR rear 63rd sector.

(3) when a partition's DBR bad, just hint: unformatted

this time with Winhex Open the logical disk and it will not open.

We only have to open the physical drive and then jump to that partition.

will be able to view DBR whether it was destroyed ....

the mode of the physical drive is from "0" sector begins to describe the system
while the logical drive mode is from the system DBR start describing the system ( described from the first sector ).

with Winhex do U Disk Immunity AUTO. INF

withWinHexmake a change that cannot be modifiedAutorun.inffile
in our daily work, it is often necessary to use flash memory (also known asUDiskor USB drive) is mainlyAutorun.infthe file is in effect and we can useWinHexSolvethis issue. First, format the flash, filesystemSelect the defaultFAT32format (due to the versatility of the format is good, so the best choiceFAT32). Then manually create a new name under the Flash stub directory namedAutorun.inffile (You can create a new file and then rename it toAutorun.infyou can do it. ), and then openWinHex, press theF9function keys, or from"Tools"menu Under Select"Disk Editor", open the flash you need to process (if you have more than one, identify the drive letter for that Flash), navigate toAutorun.inffile, you can see that there is a space in the middle of the file name, and a space behind the filename, now leave the following space()directly modified to"E5", you can save and exit after confirmation.

looksAutorun.infthe file name has not changed, but at this time, no one can open it or modify it. Alternatively, you can add"a"Change to"E2", so you can addAutorun.infThe file is hidden so that you don't see it every time you wonder.

The method of judging +mbr+dbr+ebr in Winhex