Now open the 1st64sectors file with TinyHexer and select 'Tools > Scripts > PT view by jaclaz' from the menu.
As we can see there is one partition with the following details:
Type: 07 (NTFS)
Boot: 80 (means the parition is marked as active)
You probably notice that the eCyl value (ending cylinder) is 1023 instad of 38912.
This is correct, because the partition table can't store any cylinder values greater than 1023 as there are only 10 bits reserved for it inside the partition table entry structure.
You can find some infos about the MBR and Partition Table structure here: http://en.wikipedia....ter_boot_record
The important values are the SartSector and NumSectors which are the LBA values for the partition. Windows will use those values to access the partition.
As we can see everything is correct here
Now let's go to step 4 (fix NTFS boot sector)!
First of all you should know how the structure of the NTFS boot sector (aka partition boot sector, volume boot sector) looks like:http://www.ntfs.com/...boot-sector.htm
Now scroll down to 0x7E00 which is where sector 63 (remember sectors start to count at 0, so it's the 64th sector) begins.
Open the Structure viewer and choose 'NTFS boot structure'.
If we look at the values everything is looking pretty good, except for the OEM (ID) which is blank. We need to fix that now.
The OEM ID starts at position 0x03 of the boot sector and the boot sector starts at 0x7E00. So the location of the OEM ID is 0x7E03.
The ID is 8 bytes long and should be 'NTFS
' for a NTFS file system.
Please note that there are 4 blank spaces
after NTFS to fill all 8 bytes.
Now we know what to change and where to change it!
Value: 'NTFS ' (without the quotes)
But before you change that make sure you disable the insert mode in Tiny Hexer (uncheck View > Insert mode)
So far any questions?