computer forensics, computer forensics expert, mobile phone forensics, expert witness

Inside Out

P2V – Will the 2K MBR boot up a non cylinder aligned partition?

I left my last post unsure whether of not a PC can boot into a partition that is not aligned with the beginning of a cylinder boundary. I devised a quick test, employing the same image that I have been using for the last two posts.

In this case, I left the partition table unmodified, but went into the NTFS boot record and adjusted its conception of the hard drive to reflect the Virtual Drive's geometry. I got this:

Error Loading Opertating System.

If the bootable partition was the first on the hard drive, there may have been a chance for it to work, but since it is 73440 sectors in, the CHS values will be all wrong.

Recalling the original partition table as taken from fdisk is:

Disk /dev/ida/c0d0: 8711 cylinders, 255 heads, 32 sectors/track  
Units = sectors of 512 bytes, counting from 0  
  
Device Boot    Start       End   #sectors  Id  System  
/dev/ida/c0d0p1            32     73439      73408  12  Compaq diagnostics  
/dev/ida/c0d0p2   *     73440  20555039   20481600  42  SFS  
/dev/ida/c0d0p3      20555040  71081759   50526720  42  SFS  
/dev/ida/c0d0p4             0         -          0   0  Empty  

We regenerate the new partition table with sfdisk, setting the correct CHS values for the new virtual disk. (sfdisk recalculates the right CHS values for the start and end of the partitions based on geometry specified on the command line, and the sector offsets and sizes):

sfdisk -uS -C 4436 -H 255 -S 63 -f c0d0.dd << EOF  
32,73408,12  
73440,20481600,42,*  
20555040,50526720,42  
EOF  

The image now boots correctly.

So, to answer my initial question. Yes, the MBR boot code WILL boot up a non cylinder aligned partition. Inside the OS the dynamic disk shows up as healthy and exactly as it was in the original physical machine.