Disk Signatures


Hard disks contain a signature within the MBR starting from address 0x01B8 (through to 0x01BB). Using a hex editor, Tinyhexer for example, it is possible to view the disk signature of a physical device or a hard disk image. If viewing a disk image I recommend that you extract the first sector and open that in Tinyhexer - opening a full disk image will take some time.

To extract the first sector of a disk image file or physical disk use dsfo.exe (part of the dsfok). Open a command prompt in the directory containing dsfo.exe and -

To view the disk signature open C:\mbr.bin in tinyhexer and goto Edit > Goto... and enter 0x01B8. The disk signature is a four byte value starting from this address - see table below.

0001 0203 0405 0607 0809 0A0B 0C0D 0E0F
0x01A0 0000 0000 0000 0000 0000 0000 0000 0000
0x01B0 0000 0000 002C 4463 F6B2 F6B2 0000 8001
0x01C0 0100 1BFE 7F87 3F00 0000 4917 6000 0000

When creating a disk image using the method described here (using mbrbatch.cmd) the disk signature will be empty (zero byte value 00 00 00 00). It is possible to add a disk signature by overwriting four bytes from hex address 0x01B8 in tinyhexer and saving the changes, then writing the extracted sector back to the disk image.

For a detailed breakdown of the Windows 2000/XP Master Boot Record (including disk signature) see here.