These editors will help you in understanding MBR, but there is no magic tool available to to convert hexdump into human readable format (based on my knowledge). You can use any HEX editor, like Hex Editor Neo or Active Disk Editor.
are there any commands or tools to more deep analyzing and convert this hexdump to human readable way?Ī. Small footprint: Hex Fiend does not keep your files in memory. Its been tested on files as large as 118 GB. Work with huge files: Hex Fiend can handle as big a file as youre able to create. Insert, delete, rearrange: Hex Fiend does not limit you to in-place changes like some hex editors. You can read them in detail in Table 1.2 Partition Table Fields, at official site. Hex Fiend is a fast, clever, and free Hex editor that has many unique features.
Sample Partition Table Record: (taken from an MBR, using HEX editor) 80 20 21 00 07 7E 25 19 00 08 00 00 00 38 06 00Įach hexadecimal value has some specific meaning, for instance: 80 => Partition type, ActiveĢ0 21 00 => Partition’s starting sector, Cylinder-Head-Sector (CHS)ħE 25 19 => Partition’s ending sector, CHSĠ0 38 06 00 => Size of the partition, 199 MiB However the partition table gives a lot of information, and it can be used to extract information, in scenarios, where OS is corrupted or not booting and MBR can be used to investigate disk drive and operating system.
The master boot code and disk signatures aren't very useful for someone (investigator). The MBR contains a small amount of executable code called the master boot code, the disk signature, and the partition table for the disk. what are the benefit of getting MBR hex dump and what kind of thing can be done using it?