Hi, David Christensen wrote: > Examining a Windows XP disk, the first partition (C:\) starts at block 63 > (track 1): > [...] > Number Start End Size Type File system Flags > 1 63s 156296384s 156296322s primary ntfs boot
That's an oldfashioned layout. Bad for disks with blocksize larger than 512 bytes, because of the odd block count. > 000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa This is the end of the MBR. The first partition slot is at address 000001be. > 00007c00 12 91 f2 60 90 a0 2f 19 01 00 00 00 85 00 67 68 |...`../.......gh| > 00007c10 46 44 23 cc 22 52 1d ac 22 52 32 4e 6f 72 74 6f |FD#."R.."R2Norto| > 00007c20 6e 20 47 68 6f 73 74 20 32 30 30 33 00 00 00 00 |n Ghost 2003....| That's in the last block before partition 1 begins. No idea whether it is trash or whether Norton Ghost dumped a tag there. (In this case it belongs to GiaThnYgeia's list of occasions which change the unclaimed disk area.) > Examining a Jesse system drive, the first partition starts at block 2048 (1 > MB = 2**20 bytes): That's the modern layout. I wonder how long it will last until 1 MiB are considered too small. > 0000c990 b0 b3 2c fa a4 38 f1 f8 77 f0 2d dd c2 4a a4 a9 |..,..8..w.-..J..| > What is in blocks 1-101? Could be GRUB program code. Do you see cleartext messages in the first 100 blocks ? With dd if=/dev/sda bs=512 count=100 | strings | less i get from my system disk ZRr= `|f \|f1 GRUB Geom Hard Disk Read Error loading Geom and much more text salad. Have a nice day :) Thomas