How to find where data is stored?

Announcements, advice, random banter, unrelated discussion, et cetera.

How to find where data is stored?

Postby Zup » 2018-7-12 @ 18:18

I've got a disk that holds some data used by a program. It has a partition table and a FAT16 partition that seems empty (no files, even hidden).

I've made a disk image (using dd) before and after using that program, so I know what bytes were altered between runs. How can I know where are those bytes stored (i.e.: MBR, boot sector, between MBR and the first partition, at unused data blocks)? Is there a program that can help me find it out?

I have traveled across the universe and through the years to find Her.
Sometimes going all the way is just a start...

I'm selling some stuff!
User avatar
Posts: 1196
Joined: 2003-10-04 @ 12:16

Re: How to find where data is stored?

Postby tegrady » 2018-7-13 @ 20:38

Possibly ISO Buster.
User avatar
Posts: 148
Joined: 2017-11-24 @ 23:52

Re: How to find where data is stored?

Postby vladstamate » 2018-7-13 @ 23:42

If you are on Linux you can hexdump the files you obtained with dd and then use any diff tool you want. If the diff is in the first 512 bytes then it updated the MBR for example.

In Windows a good free visual diff tool is WinMerge.
User avatar
Posts: 879
Joined: 2015-8-23 @ 01:43

Re: How to find where data is stored?

Postby oeuvre » 2018-7-17 @ 03:41

data is stored in the balls
NetVista Sleeper i7 3770, 16GB, GTX750, 2xSSD + HD, XP/7/MacOS 10.13.6
ThinkCentre Sleeper Ryzen 7 2700, 32GB, RX580 8GB, NVMe SSD + HD, 10
User avatar
Posts: 2277
Joined: 2015-3-31 @ 13:31
Location: USA

Return to Milliways

Who is online

Users browsing this forum: SirNickity and 2 guests