Windows Forensics: The Field Guide for Corporate Computer Investigations
| | ||
| | ||
| | ||
| VALUE | TYPE | VALUE | TYPE |
|---|---|---|---|
| 00h | Empty | 20h | Not used |
| 01h | FAT12 | 21h | Reserved |
| 02h | XENIX root | 22h | Not used |
| 03h | XENIX usr | 23h | Reserved |
| 04h | FAT16 (up to 32MB) | 24h | NEC DOS |
| 05h | DOS Extended | 25h | Not used |
| 06h | FAT16 (more than 32MB) | 26h | Reserved |
| 07h | NTFS (or OS/2 HPFS) | 27h | Not used |
| 08h | AIX boot | 28h | Not used |
| 09h | AIX data | 29h | Not used |
| 0Ah | OS/2 Boot Manager | 2Ah | Not used |
| 0Bh | FAT32 | 2Bh | Not used |
| 0Ch | FAT32 (LBA) | 2Ch | Not used |
| 0Dh | Not used | 2Dh | Not used |
| 0Eh | FAT16 (LBA) | 2Eh | Not used |
| 0fh | Extended (LBA) | 2Fh | Not used |
| 10h | OPUS | 30h | Not used |
| 40h | VENIX | 50h | OnTrack |
| 41h | Personal RISC | 51h | OnTrack (or Novell) |
| 42h | Windows 2000 Dynamic | 52h | CP/M |
| 43h | Linux | 53h | Disk Manager |
| 44h | GoBack | 54h | Disk Manager |
| 45h | EUMEL/Elan | 55h | EZ-Drive |
| 46h | EUMEL/Elan | 56h | AT&T DOS |
| 47h | EUMEL/Elan | 57h | DrivePro |
| 48h | EUMEL/Elan | 58h | Not used |
| 49h | Not used | 59h | Not used |
| 4Ah | ADAOS | 5Ah | Not used |
| 4Bh | Not used | 5Bh | Not used |
| 4Ch | Oberon | 5Ch | Priam Edisk |
| 4Dh | QNX | 5Dh | Not used |
| 4Eh | QNX | 5Eh | Not used |
| 4Fh | QNX | 5Fh | Not used |
| 60h | Not used | 70h | DiskSecure |
| 61h | SpeedStor | 71h | Reserved |
| 62h | Unix System V | 72h | Not used |
| 63h | Netware | 73h | Reserved |
| 64h | Netware | 74h | Reserved |
| 65h | Netware | 75h | IBM PC/IX |
| 66h | Netware | 76h | Not used |
| 67h | Netware | 77h | M2FS |
| 68h | Netware | 78h | XOSL FS |
| 69h | Netware | 79h | Not used |
| 6Ah | Not used | 7Ah | Not used |
| 6Bh | Not used | 7Bh | Not used |
| 6Ch | Not used | 7Ch | Not used |
| 6Dh | Not used | 7Dh | Not used |
| 6Eh | Not used | 7Eh | Not used |
| 6Fh | Not used | 7Fh | Not used |
| 80h | MINIX | 90h | FreeDOS FAT16 |
| 81h | MINIX | 91h | FreeDOS Extended |
| 82h | Linux swap | 92h | FreeDOS FAT16 |
| 83h | Linux ext2/3 | 93h | Amoeba (or Linux Hidden) |
| 84h | OS/2 Hidden | 94h | Amoeba |
| 85h | Linux Extended | 95h | MIT EXO |
| 86h | NTFS Volume Set | 96h | Not used |
| 87h | NTFS Volume Set | 97h | FreeDOS FAT32 |
| 88h | Not used | 98h | FreeDOS FAT32 (LBA) |
| 89h | Not used | 99h | DCE376 |
| 8Ah | Not used | 9Ah | FreeDOS FAT16 |
| 8Bh | FAT32 Fault Tolerant | 9Bh | FreeDOS FAT16 (LBA) |
| 8Ch | FAT32 (LBA) Fault Tolerant | 9Ch | Not used |
| 8Dh | FreeDOS FAT12 | 9Dh | Not used |
| 8Eh | Linux Volume Manager | 9Eh | Not used |
| 8Fh | Not used | 9Fh | BSD/OS |
| A0h | Laptop Save-to-Disk | B0h | BootStar |
| A1h | Laptop Save-to-Disk | B1h | Reserved (or HPVE) |
| A2h | Not used | B2h | Reserved |
| A3h | HPVE | B3h | Reserved |
| A4h | HPVE | B4h | Reserved |
| A5h | BSD | B5h | Not used |
| A6h | OpenBSD | B6h | Reserved |
| A7h | NeXT | B7h | BSD fs |
| A8h | Mac OS-X | B8h | BSD swap |
| A9h | NetBSD | B9h | Not used |
| AAh | FAT12 (Olivetti) | BAh | Not used |
| ABh | GO! | BBh | Boot Wizard |
| ACh | Not used | BCh | Not used |
| ADh | Not used | BDh | Not used |
| AEh | ShagOS fs | BEh | Solaris 8 boot |
| AFh | ShagOS swap | BFh | Not used |
| C0h | DRDOS | D0h | Real/32 |
| C1h | DRDOS | D1h | Multi- user DOS FAT12 |
| C2h | Hidden Linux | D2h | Not used |
| C3h | Hidden Linux swap | D3h | Not used |
| C4h | DRDOS | D4h | Multi-user DOS FAT16 (up to 32MB) |
| C5h | DRDOS | D5h | Multi-user DOS Extended |
| C6h | Windows NT Corrupted FAT16 Volume Set | D6h | Multi-user DOS FAT16 (more than 32MB) |
| C7h | Windows NT Corrupted NTFS Volume Set | D7h | Not used |
| C8h | DRDOS | D8h | CP/M-86 |
| C9h | DRDOS | D9h | Not used |
| CAh | DRDOS | DAh | Not used |
| CBh | DRDOS FAT32 | DBh | CP/M |
| CCh | DRDOS FAT32 (LBA) | DCh | Not used |
| CDh | Not used | DDh | Not used |
| CEh | DRDOS FAT16 (LBA) | DEh | Dell |
| CFh | DRDOS Extended | DFh | DG/UX |
| E0h | Not used | F0h | Linux/PA-RISC boot loader |
| E1h | SpeedStor | F1h | SpeedStor |
| E2h | Not used | F2h | Unisys DOS |
| E3h | SpeedStor | F3h | Reserved |
| E4h | SpeedStor | F4h | Prologue (or SpeedStor) |
| E5h | Reserved | F5h | Prologue |
| E6h | Reserved | F6h | Reserved |
| E7h | Not used | F7h | Not used |
| E8h | Not used | F8h | Not used |
| E9h | Not used | F9h | Not used |
| EAh | Not used | FAh | Bochs |
| EBh | BeFS | FBh | VMWare fs |
| ECh | Not used | FCh | VMWare swap |
| EDh | Sptrytix | FDh | FreeDOS |
| EEh | Intel EFI | FEh | Windows NT Disk Admin |
| EFh | Intel EFI | FFh | Xenix Bad Block |
| | ||
| | ||
| | ||