[ Forensic ] MBR

Hyeonjin Lee·2023년 4월 9일
0

[ Forensic ] File system

목록 보기
6/8
post-custom-banner

MBR (Master Boot Record)


MBR은 저장매체의 첫 번째 섹터(LBA 0)에 위치하는 512 bytes 크기의 영역이다. 처음 446 bytes는 부트 코드(Boot Code) 영역, 64 bytes는 파티션 테이블(Partition Table), 마지막 2 bytes는 시그니처를 나타낸다.

운영체제가 부팅 될 때 POST(Power On Self-Test) 과정을 마친 후 저장매체의 첫 번째 섹터를 호출하게 되는데 이 때 MBR의 부트 코드가 수행된다.

부트 코드(Boot Code)는 파티션 테이블에서 부팅 가능한 파티션을 찾아 해당 파티션의 부트 섹터를 호출해주는 역할을 한다. 만약, 부팅 가능한 파티션이 없을 경우에는 미리 정의된 에러 메시지를 출력한다.

다음 표는 MBR의 각 영역에 대한 세부적인 데이터구조를 나타낸다.

범위 (Byte Range) 설명 (Decription) 크기 (Size)
0x0000 – 0x01BD Boot code 446 bytes
0x01BE – 0x01CD Partition table entry #1 16 bytes
0x01CE – 0x01DD Partition table entry #2 16 bytes
0x01DE – 0x01ED Partition table entry #3 16 bytes
0x01EE – 0x01FD Partition table entry #4 16 bytes
0x01FE – 0x01FF Signature (0x55AA) 2 bytes

파티션 테이블은 각각 16 bytes씩 4개의 엔트리를 가지고 있다. 따라서 하나의 볼륨에서 부팅 가능한 주 파티션은 4개 밖에 생성할 수 없다.


파티션 테이블(Partition Table)


다음은 16bytes 파티션 테이블 엔트리의 세부적인 구조이다.

범위 (Byte Range) 설명 (Decription) 크기 (Size)
0x00 – 0x00 Boot Indicator
00 = do not use for booting
80 = system partition
1 byte
0x01 – 0x03 Starting CHS address 3 bytes
0x04 – 0x04 Partition type 1 byte
0x05 – 0x07 Ending CHS address 3 bytes
0x08 – 0x0B Starting LBA address 4 bytes
0x0C – 0x0F Total sectors 4 bytes

부트 식별자(Boot Indicator)는 해당 파티션이 부팅 가능한 파티션인지를 나타낸다. 0x80을 가질 경우 부팅 가능한 파티션을 나타내고, 0x00을 가질 경우 부팅이 가능하지 않은 파티션을 나타낸다.

그리고 CHS 주소 값이 나오는데 현재는 대부분 LBA 모드를 사용하므로 사용되지 않고 있다. 그 다음으로 해당 파티션의 시작 위치를 가리키는 LBA 주소 값과 파티션 전체의 섹터 수가 나온다. CHS와 다르게 LBA 주소의 마지막을 표시하지 않는 이유는 시작 주소에 섹터의 크기를 더하면 마지막 주소를 알 수 있기 때문이다.

파티션 유형(partition type)은 파티션에 포함된 파일 시스템을 지정한다. System ID와 Partition Type으로 구분하는 경우도 있지만 여기서는 파티션 타입으로 모두 정의한다.

16진수 설명 (Description)
00h Empty
01h DOS 12-bit FAT
02h XENIX root file system
03h XENIX /usr file system (obsolete)
04h DOS 16-bit FAT (up to 32M)
05h DOS 3.3+ extended partition
06h DOS 3.31+ Large File System (16-bit FAT, over 32M)
07h Advanced Unix
07h exFAT
07h OS/2 HPFS
07h Windows NT NTFS
08h OS/2 (v1.0-1.3 only)
08h AIX bootable partition, SplitDrive
08h Commodore Dos
08h DELL partition spanning multiple drives
09h AIX data partition
0Ah OPUS
0Ah Coherent swap partition
0Ah OS/2 Boot Manager
0Bh Windows 95 with 32-bit FAT
0Ch Windows 95 with 32-bit FAT (using LBA-mode INT 13 extensions)
0Eh VFAT logical-block-addressable VFAT (same as 06h but using LBA)
0Fh Extended LBA partition (same as 05h but using LBA)
10h OPUS
11h FAT12 OS/2 Boot Manager hidden 12-bit FAT partition
12h Compaq Diagnostics partition
14h FAT16 OS/2 Boot Manager hidden sub-32M 16-bit FAT partition
16h FAT16 OS/2 Boot Manager hidden over-32M 16-bit FAT partition
17h OS/2 Boot Manager hidden HPFS partition
17h hidden NTFS partition
18h ASTSuspend AST special Windows swap file (“Zoro-Volt Suspend” partition)
19h Willowtech Willowtech Photon coS
1Bh Windows hidden Windows95 FAT32 partition
1Ch Windows hidden Windows 95 FAT32 partition (LBA-mode)
1Eh Windows hidden LBA VFAT partition
20h Willowsoft Overture File System (OFS1)
21h [reserved] officially listed as reserved
21h FSo2
23h [reserved] officially listed as reserved
24h NEC MS-DOS 3.x
26h [reserved] officially listed as reserved
31h [reserved] officially listed as reserved
33h [reserved] officially listed as reserved
34h [reserved] officially listed as reserved
36h [reserved] officially listed as reserved
38h Theos
3Ch PowerQuest PartitionMagic recovery partition
40h VENIX 80286
41h Personal RISC Boot
41h PowerPC boot partition
42h SFS(Secure File System) by Peter Gutmann
45h EUMEL/Elan
46h EUMEL/Elan
47h EUMEL/Elan
48h EUMEL/Elan
4Fh Obron boot/data partition
50h OnTrack Disk Manager, read-only partition
51h OnTrack Disk Manager, read/write partition
51h NOVELL
52h CP/M
52h Microport System V/386
53h OnTrack Disk Manager, write-only partition
54h OnTrack Disk Manager (DDO)
55h EZ-Drive (see also INT 13/AH=FFh “EZ-Drive”)
56h GoldenBow VFeature
5Ch Priam EDISK
61h SpeedStor
63h Unix SysV/386, 386/ix
63h Mach, MtXinu BSD 4.3 on Mach
63h GNU-HURD
64h Novell Netware 286
64h SpeedStore
65h Novell NetWare (3.11)
67h Novell
68h Novell
69h Novell NSS Volume
70h DiskSecure Multi-Boot
71h [reserved] officially listed as reserved
73h [reserved] officially listed as reserved
74h [reserved] officially listed as reserved
75h PC/IX
76h [reserved] officially listed as reserved
7Eh F.I.X
80h Minix v1.1 – 1.4a
81h Minix v1.4b+
81h Linux
81h Mitac Advanced Disk Manager
82h Linux Swap partition
82h Prime
82h Solaris (Unix)
83h Linux native file system (ex2fs/xiafs)
84h DOS OS/2-renumbered type 04h partition (hiding DOS C: drive)
85h Linux EXT
86h FAT16 volume/stripe set (Windows NT)
87h HPFS Fault-Tolerant mirrored partition
87h NTFS volume/stripe set
93h Amoeba file system
94h Amoeba bad block table
98h Datalight ROM-DOS SuperBoot
99h Mylex EISA SCSI
A0h Phoenix NoteBIOS Power Management “Save-to-Disk” partition
A1h [reserved] officially listed as reserved
A3h [reserved] officially listed as reserved
A4h [reserved] officially listed as reserved
A5h FreeBSD, BSD/386
A6h OpenBSD
A9h NetBSD
B1h [reserved] officially listed as reserved
B3h [reserved] officially listed as reserved
B4h [reserved] officially listed as reserved
B6h [reserved] officially listed as reserved
B6h Windows NT mirror set (master), FAT16 file system
B7h BSDI file system (secondarily swap)
B7h Windows NT mirror set (master), NTFS file system
B8h BSDI swap partition (secondarily file system)
BEh Solaris boot partition
C0h CTOS
C0h DR-DOS/Novell DOS secured partition
C1h DR-DOS6.0 LOGIN.EXE-secured 12-bit FAT partition
C4h DR-DOS6.0 LOGIN.EXE-secured 16-bit FAT partition
C6h DR-DOS6.0 LOGIN.EXE-secured 12-bit Huge partition
C6h corrupted FAT16 volume/stripe set (Windows NT)
C6h Windows NT mirror set (slave), FAT16 file system
C7h Syurinx Boot
C7h corrupted NTFS volume/stripe set
C7h Windows NT mirror set (slave), NTFS file system
CBh DR-DOS/OpenDOS secured FAT32
CCh DR-DOS secured FAT32 (LBA)
CEh DR-DOS secured FAT16 (LBA)
D0h Multiuser DOS secured FAT12
D1h Old Multiuser DOS secured FAT12
D4h Old Multiuser DOS secured FAT16 (<=32M)
D5h Old Multiuser DOS secured extended partition
D6h Old Multiuser DOS secured FAT16 (>32M)
D8h CP/M-86
DBh Concurrent CP/M, Concurrent DOS
DBh CTOS (Convergent Technologies OS)
E1h SpeedStor 12-bit FAT extended partition
E2h DOS read-only (Florian Painke’s XFDISK 1.0.4)
E3h DOS read-only
E3h Storage Dimensions
E4h SpeedStor 16-bit FAT extended partition
E5h [reserved] officially listed as reserved
E6h [reserved] officially listed as reserved
EBh BeOS BFS (BFS1)
F1h Storage Dimensions
F2h DOS 3.3+ secondary partition
F3h [reserved] officially listed as reserved
F4h SpeedStor
F4h Storage Dimensions
F5h Prologue
F6h [reserved] officially listed as reserved
FBh VMware partition
FEh LANstep
FEh IBM PS/2 IML (Initial Microcode Load) partition
FFh Xenix bad block table
FMh VMware raw partition
profile
요즘 행복해요
post-custom-banner

0개의 댓글