Re: Tips: Recovering crashed Old-Windows disks
Rightio this'll have to do, can't quickly find the other low-level MBR stuff but guess I've summarised above the key lacunae of the below links:
Key background info:
* crawling the byte-structure of the various MBRs: https://thestarman.pcministry.com/asm/mbr/Win2kmbr.htm
* files embedding the Stage-1 bootloaders: https://thestarman.pcministry.com/asm/mbr/WTC.htm
Watch out for the endianess swaps.
DiskSig:
* 7E00 was what I was trying to remember this morning:
if looking for single-boot-partition disks, they should start at Offset= 0x7E00 (dec32,256 bytes; 63 sectors skipped)
* the lists (duplicated) are in Registry Key: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\STORAGE\Volume
On a booted Windows, it'll also be in other key(s) but in RAM-only.
I made a mistake earlier re which File has the Hive; it is actually "\WINDOWS\system32\config\SYSTEM"
Tools which actually WORKED (without crashing, being useless, etc):
* Testdisk for partition recovery
* chntpw for Registry reading
* wxHexEditor, being the only hex editor that wasn't catastrophically buggy, useless, or both