Home

An important part of data recovery is being able to recognise important system sectors.  For an experienced investigator this becomes second nature, but for anyone starting with data recovery it can be rather daunting.  This section gives sample dumps of critical sectors and indicates where there will be found, and their function.

With the exception of the Master Boot Record each sector type is specific to an operating system, although there can be similarities

Master Boot Record

GUID Sectors - as on many Macintosh systems

BIOS Parameter Block

FAT directory entry

NTFS Directory entry, MFT

Disk clusters - how to work out their size

VMFS sectors