我有一个 512B 的标头,我知道它要么是 MBR,要么是像保护性 MBR 这样的假 MBR。通过查看它们的原始字节,我如何识别它们?例如
fab800108ed0bc00b0b800008ed88ec0fbbe007cbf0006b90002f3a4ea21060000bebe
073804750b83c61081fefe0775f3eb16b402b001bb007cb2808a74018b4c02cd13ea00
7c0000ebfe000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000000000
0000000000000000000000000000000000000000000000000000000000000000000000
000000000000000000000000000000000000000069d0e83000000020210083fec2ff00
0800000060f62400fec2ff07fec2ff0068f62400684552000000000000000000000000
000000000000000000000000000000000000000055aa
保护性 MBR 在 EE 类型的分区表中有一个条目,占据整个驱动器。
保护性 MBR:
'正常 MBR:
在您的案例中,我们看到一个带有两个条目的传统 MBR,一个指向类型 83 分区 (ExtFS),另一个指向 07 (Exfat) 分区。请注意,07 还可以代表 IFS、HPFS、NTFS、exFAT、QNX(根据维基百科)