27. Advanced: Disk Geometry Overview

• Go to Disk View in the Table pane.

• Select MBR -- the first sector of the drive (sector 0.)

• First VBR is usually on the 64th sector of the drive, which is sector 63.

• In detail view, switch to Hex.

• In hex view of MBR, go to offset 446. EnCase status bar should indicate:

      PS 0 SO 446 PO 446 LE 64
  

  NOTE: there should be MBR/VBR signature in two bytes that follow the partition table: 55 AA. Basically, the signature is in last two bytes of the 512 bytes of the sector.

• Right-click the selection and click Bookmark Data.

• Select Partition Entry bookmark type.

• See figure 23-5 on page 224 of the EnCase student's guide.