±Forensic Focus Partners

Become an advertising partner

±Your Account


Forgotten password/username?

Site Members:

New Today: 0 Overall: 36290
New Yesterday: 2 Visitors: 124

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Windows MBR installed over Apple MBR

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts

Senior Member

Windows MBR installed over Apple MBR

Post Posted: Apr 06, 12 22:24

I got a driver for recovery that was originally an Apple drive, but was hooked up to a Windows machine. The client inadvertently told the Windows machine to write a new MBR to it and it looks like it has been formatted. I'm a little stumped as to how to 1) get the data back, and 2) get the drive back into working order.  

Senior Member

Re: Windows MBR installed over Apple MBR

Post Posted: Apr 29, 12 16:09

Apple uses GPT to format disks. All start with a protective MBR which has a record of OS type 0xEE. LBA 0 is the location for this protective MBR. When OSX or any other GPT compatible OS reads the drive, it checks if LBA 0 has a protective MBR. If MBR not OS type 0xEE or has more than one partition entry, it stops there. If protective MBR is OK, OS goes to check for LBA 1 and the last LBA on the disk.

LBA1 and the last LBA are GPT headers, the last LBA is a backup copy of the GPT header located at LBA1. So, you basically have to restore protective MBR and see if it helps. Then you have a backup GPT header followed by backup GPT partition entires at the back of the drive. Recreate the protective MBR to have its 64-byte area to contain a single 0xEE type Primary partition entry defined over the entire size of the disk and go from there. I think I saw some tools on the net (gdisk or similar) that can fix it automatically if you are not comfortable with a hexeditor. I would make a bit by bit copy of the drive before playing with the disk though.  

Senior Member

Re: Windows MBR installed over Apple MBR

Post Posted: Apr 29, 12 20:02

Work '1' first Get the data first BEFORE you try and get the drive back to working order. If nothing else, as ecophobia says, make a disk image.

If it is just the MBR, then any decent data recovery program should cope and will find the relevant start of the Mac partition - often at sector 0x64028. Some Mac disks do start with a FAT partition first though
Michael Cotgrove

Page 1 of 1