How to find where data is stored? \ VOGONS

How to find where data is stored?

Topic actions

Post a reply

First post, by Zup

Posted on 2018-07-12, 18:18

Zup Offline

Rank Oldbie

Rank: Oldbie
Posts: 1636
Joined: 2003-10-04, 12:16

I've got a disk that holds some data used by a program. It has a partition table and a FAT16 partition that seems empty (no files, even hidden).

I've made a disk image (using dd) before and after using that program, so I know what bytes were altered between runs. How can I know where are those bytes stored (i.e.: MBR, boot sector, between MBR and the first partition, at unused data blocks)? Is there a program that can help me find it out?

Thanks.

I have traveled across the universe and through the years to find Her.
Sometimes going all the way is just a start...

I'm selling some stuff!

Reply 1 of 3, by tegrady

Posted on 2018-07-13, 20:38

tegrady Offline

Rank Member

Rank: Member
Posts: 249
Joined: 2017-11-24, 23:52
Location: East Coast, USA

Possibly ISO Buster.

Reply 2 of 3, by vladstamate

Posted on 2018-07-13, 23:42

vladstamate Offline

Rank Oldbie

Rank: Oldbie
Posts: 967
Joined: 2015-08-23, 01:43

If you are on Linux you can hexdump the files you obtained with dd and then use any diff tool you want. If the diff is in the first 512 bytes then it updated the MBR for example.

In Windows a good free visual diff tool is WinMerge.

YouTube channel: https://www.youtube.com/channel/UC7HbC_nq8t1S9l7qGYL0mTA
Collection: http://www.digiloguemuseum.com/index.html
Emulator: https://sites.google.com/site/capex86/
Raytracer: https://sites.google.com/site/opaqueraytracer/