Am 16.02.23 um 15:17 schrieb Mike Maslenkin: > Does additional comparison make a sense here: check for LBA == 0 and > then check MBR signature bytes. > Additionally it’s easy to check buffer_is_zero() result or even print > FIS contents under these conditions. > Data looks like a part of guest memory of 64bit Windows.
Thank you for the suggestion! I'll think about adding such a check and dumping of FIS contents in a custom build for affected users. But in general it would be too much noise for non-MBR cases: e.g. on a disk formatted with ext4 (without any partitions), Linux will write to sector 0 on every startup and shutdown. Best Regards, Fiona
