Restoring MBR, VBR, and MFT, as well as the Data Area structure.

I. Overview

I plan to practice restoring MBR and VBR using disk sample images. After restoring, I will practice finding the data areas of FAT and NTFS and examine their structure.

II. Disk Practice - MBR and VBR Restoration

I plan to use HxD with a sample disk image to attempt to restore the MBR and VBR through VBR backup.

Looking at the two images, you can see that the MBR and VBR have been corrupted. Typically, the first sector contains MBR information, but in this case, the last partition-related information of the 512-byte MBR has been lost. This recovery exercise will focus on finding the backup sector of the VBR. Secondly, it will determine whether the partition in the VBR is NTFS or FAT. Thirdly, it will calculate the total sector size of the partition in the VBR to determine the original location of the VBR. Finally, it will copy the backup VBR sector to the original VBR location and recover the MBR partition information based on the related information. This process will be carried out in this order.

1. Locating VBR backup sectors

There are several ways to find the backup sector of a VBR (Virtual Blu-ray). I would like to introduce a method using "Signature" within HxD. Search for the hexadecimal value 55 AA in HxD.

It looks like this. By going through each of the search results one by one,

The last two bytes are 55 AA, which is the signature. It's important to remember that 55 AA is the signature, rather than just seeing the characters. You can identify NTFS by looking at the red section above. There are many blog posts about NTFS VBR structure, so I recommend checking those for a better understanding.

2. Restoring NTFS VBR (Volume Shadow Copy)

In the case of NTFS, the backup sector typically represents the very last sector of the NTFS partition. Therefore, if you can determine the size of the partition sector from the backup sector, you can identify the location of the original backup sector.

Looking at this structure, you can see that the 8-15 byte range of VBR's 0x20 contains a total of 8 bytes of information representing the "Total Sectors."

Therefore, in the image above, A67FF represents the total number of sectors in that partition. When calculated, the value is '681,983'. Since the current location of the backup sector is '682,111', subtracting this value from the total number of sectors results in '128', which corresponds to the starting sector of the original VBR.

Simply copy the VBR backup and paste it into sector 128, then save it.

3. Restoring the MBR of the NTFS partition

Now, we will use these values to restore the MBR.

[SK Secure, SeSAC, Dongjak Branch 1] ZIP structure, DISK

As mentioned in previous posts, the MBR contains partition information in 16-byte increments, starting from byte 446 to byte 510. The process will involve applying the necessary information to the first 16 bytes of the MBR, which corresponds to the NTFS partition starting from the 128th sector. Specifically, the 1-byte Boot Flag will be changed to 80, and the 4-byte file system type will be set to 07, indicating NTFS. The 8-11-byte partition starting address will be set to 80, which is the 128th sector converted to hexadecimal. Finally, the last 12-16 bytes will be set to A67FF, representing the partition size.

※ Please note that while we've been referring to it as "Littleendian" so far, the actual way it's written is "Bigendian."

Once you've inserted and saved the data, and verified that it was successfully recovered using FTK Imager,

We can see how well this restoration process works. If that's the case, then FAT should also be processed in the same way.

4. FAT (File Allocation Table) recovery in progress.

First, locate the VBR file you want to back up. Then, move to the corresponding location and copy the VBR file, appending "-6" to the filename.

After that, if you try to restore the MBR again, you simply need to enter the correct boot flag (80), the type (0B or 0C), and the starting address, which is "682,112", along with the sector size.

FAT32 File System Structure

Based on the structure, we can calculate that the entire partition sector size is 4 bytes, starting from 0x20. Now, let's try entering this value into the MBR.

This is how it should be entered. Now, after saving, check it again using FTK Imager.

This is a remarkable restoration.

Ⅲ. Disk Practice - Locating the Data Area

First, while I briefly mentioned a tip on how to find the DataArea in FAT32 in a previous post, it's important to remember that FAT32 has a structure consisting of VBR (Volume Boot Record) - Reserved Area - FAT1. & FAT2 – The MFT appears. If so, the reserved area and FAT1 are located in the beginning sector of VBR. & If the FAT2 sector size is increased, would that reveal the location of the Data Area?

Calculating the number of reserved sectors, we find that the range is 0x0E to 0xF, which is 14. The size of each FAT sector is 0x24 to 0x7, resulting in 16. However, since there are FAT1 and FAT2, we multiply by 2, giving us 32. Adding these values together, we get 32 + 16 + 682,112 (the starting sector of FAT - VBR) = 682,168. Now, let's go to those sectors.

I was able to locate the Data Area of the FAT32 file system. The structure of the Data Area in FAT32 is:

[File System] FAT32 - Part 3 (Data Area, restore)

This is how it works. It's important to distinguish between SFN (Short File Name) and LFN (Long File Name) structures, and this can be done using a 12-byte value. The reason for distinguishing between these two is because their structures are different.

Directory Entry Analysis – SFN, LFN

Essentially, the structure is divided into 32-byte segments. While the SFN structure is as follows, the LFN structure introduces additional considerations. First, if the value of 11 bytes out of the 32-byte segment is 0x0F, then that 32-byte segment represents an LFN. Furthermore, examining the byte at position 0 reveals a "Sequence Number," which is an important factor.

As shown in the image, the starting SeqNum is 42, and the 12-byte value is 0x0F. This indicates that the two lines displayed above are structured according to the LFN (Long File Name) format. The 32-byte value below also follows this pattern, with a SeqNum of 1. Therefore, the conclusion is that the file is structured with two LFN formats. The method to determine this is by examining the SeqNum. In the case of multiple LFN formats, the last 32-byte SeqNum is typically 0x40 or a calculated value. The remaining LFN SeqNums increase from 0x01, so values greater than 0x40 indicate the number of LFN formats in the file. For example, if we perform another XOR operation on 0x42, we find that the result is 2, confirming that the file has two LFN formats.

As with the example image, this can also be calculated, and it confirms that the file has three LFN structures.

NTFS is slightly different. An NTFS partition typically contains a VBR (Volume Boot Record), an MFT (Master File Table), and a Data Area. If we examine these components in more detail, we find that there is one VBR and one MFT. The MFT is essentially a collection of multiple MFT entries. Each MFT entry corresponds to a specific file or directory. The signature of an MFT entry, when viewed in more detail, reveals the "FILE" header structure.

That's how it is.

Therefore, I would like to introduce a method for finding the MFT entry. Referencing the NTFS VBR structure mentioned above, we need to determine the number of bytes per sector, the number of sectors per cluster, and the starting cluster location of the MFT entry.

In this example, the three required values are as follows: first, 200, meaning that each sector requires 512 bytes. Second, 8, indicating that each cluster contains 8 sectors. Finally, 6F00, which is an integer value representing the starting cluster for the MFT entry. So, what is the actual location of the MFT entry's starting sector? Since each cluster contains 8 sectors, we need to multiply the starting cluster location by 8. This results in 227,328. Since we are currently starting from sector 128, adding 128 to that gives us 227,456. Now, let's move to that sector,

You can see the signature of the MFT entry here. Now, let's examine the header section of this MFT entry, which consists of 48 bytes in total.

First, looking at these two values, the first section, 24-27 bytes, represents the actual size of the MFT entry, and the subsequent 28-31 bytes represent the size allocated to the MFT entry, totaling 1,024 bytes (this is a common configuration). An MFT entry corresponds to a single file or directory. Moving two sectors (1,024 bytes) further...

It's clear that MFT Entry entries are starting again. The MFT Entry structure places the "Fixup" section after the MFT Entry header to enhance reliability. The 4-5 byte and 5-6 byte values represent the starting point and length of the Fixup array, respectively. Since these are 30 and 3 in hexadecimal, the Fixup value starts at 48 bytes and occupies 2 bytes, resulting in a 6-byte space for storing the value replaced by the Fixup value. This Fixup value is used to detect and correct abnormal changes in sector content or errors before interpreting data. Finally, we have the "attribute header" and "content" sections, which I'll share a helpful blog post about.

[File System] NTFS - Part 3 (Attributes)

Review

I suspect this will be the final post for this week. While I'm still a bit disappointed that I haven't fully grasped the structure of properties within the NTFS MFT entry, I feel compelled to continue learning and expanding my knowledge in this area.