nerdexam
GIAC

GCFA · Question #80

Which of the following statements are NOT true about volume boot record or Master Boot Record? Each correct answer represents a complete solution. Choose all that apply.

The correct answer is A. The end of MBR marker is h55CC . B. The actual program can be 512 bytes long. Two common inaccuracies about the MBR are an incorrect boot signature value and the false claim that the bootstrap program fills the entire 512-byte sector.

File System & Registry Forensics

Question

Which of the following statements are NOT true about volume boot record or Master Boot Record? Each correct answer represents a complete solution. Choose all that apply.

Options

  • AThe end of MBR marker is h55CC .
  • BThe actual program can be 512 bytes long.
  • CVolume boot sector is present at cylinder 0, head 0, and sector 1 of the default boot drive.
  • DFour 16 bytes master partition records are present in MBR.

How the community answered

(40 responses)
  • A
    80% (32)
  • C
    13% (5)
  • D
    8% (3)

Why each option

Two common inaccuracies about the MBR are an incorrect boot signature value and the false claim that the bootstrap program fills the entire 512-byte sector.

AThe end of MBR marker is h55CC .Correct

The valid MBR boot signature is 0x55AA located at offsets 510 and 511 of the sector, not 0x55CC. The BIOS checks specifically for 0x55AA to identify the sector as bootable, so any other value causes the BIOS to skip that device.

BThe actual program can be 512 bytes long.Correct

The MBR sector is 512 bytes in total, but the bootstrap code occupies only the first 446 bytes. The remaining 66 bytes are divided between the partition table (four 16-byte entries = 64 bytes) and the 2-byte boot signature, so the program cannot use the full 512 bytes.

CVolume boot sector is present at cylinder 0, head 0, and sector 1 of the default boot drive.

The MBR is correctly located at CHS cylinder 0, head 0, sector 1 - which corresponds to LBA 0 - making this a true statement about the Master Boot Record, not a false one.

DFour 16 bytes master partition records are present in MBR.

The MBR partition table does contain exactly four 16-byte partition entries supporting up to four primary partitions, making this a true and accurate statement about MBR structure.

Concept tested: MBR boot signature value and sector layout

Topics

#MBR#volume boot record#boot sector structure#disk layout

Community Discussion

No community discussion yet for this question.

Full GCFA Practice