hey dreamaco
and hey all
i use hxd editor to look at a backup of my mbr of my harddrive and then i look at a copy of c: drive .
why are they different? my backup works and the other is the ntfs boot sector
thanks one is logical view and the other is physical view are they the same?
I can answer that, it's really simple.
When you look at "physical devices" as many software refers, they really mean the true, thing, sector 0 really IS sector 0.
So you're actually looking at true sector 0.
When you look at "logical devices" as many software refer to, they really mean the PARTITIONS.
So looking at sector 0 on a logical, you look at first sector of that PARITION, that is, you're looking at that paritions first sector, its bootsector.
It's that simple
So when you're viewing somehting logical, you never actually see the WHOLE drive, no you see that single parititon only. And first sector "seem" to be sector 0, but its instead the first sector of that one paritition. I was confused as hell first time I saw this in my life having noone telling me what I actually saw.
Try an expremint! view the physical drive, as here you see everything, look sector 0 .. you find MBR.. now try something like viewing sector 63 which is often the first sector of first parititon meaning.. the bootsector of first partition..
You end up seeing that sector 63 of physical is THE SAME as viewing the first sector of the logical..Remember that's there's either a bootsector or a MBR on a drive. And, if there's a MBR .. there's always one bootsector PER existing partition (the first sector of that particular partition).
EDIT: Want to mention a sidenote to be more clear
No partitions means no logical devices.. Eg. If you stick an USB-key perhaps thinking it has no partitions, that it's just one solid thing.. Think again. It has probably been formatted FAT16/32/64/NTFS meaning it HAS an MBR and a single partition at least". Which makes up the drive. So even things with "no apperent paritions" will show up of course as a logical device as any partition should.Because they DO have partitions. Even if only one. Just a few FAT12-formatted ones has no MBR, does not today. And even those might have MRB if you wish. Long story short; expect to meet many MBR's and therefore see many "logical devices", but the physical view.. is the interesting one, you see eveything there including all parititons, check the MBR LBA fields to see where they are.It's not hard at all, sorry if my explanation is abit messy. Just ask if wondering something , okay?
BTW great choice of tools; HxD is amazingly good.