Nick Holland wrote:
the "Use entire disk" question changes no more than 512 bytes on your
disk. That's the good news. The significance of that 512 bytes is the
problem. (and while 512 bytes doesn't sound that bad, that's
2^(512*8) combinations...so we still gotta do somewhat better than
random guessing)
Nick, one question I have reading lots of stuff on google results and
that I want to be sure as my understanding is kind of vague here.
This action replace only the sector for 512 Bytes and would leave the
rest of the cylinder intact right? Or not?
I am asking as I am may making some progress. I found that the GPT, what
ever that is that Apple use form the Intel standard have two copy of it.
One at the start of the disk and one at the end of the disk and that the
GPT also include the MBR details. A bit more here:
http://blog.csdn.net/hotsolaris/archive/2008/12/23/3589039.aspx
The primary GPT with I understand would have been what this OpenBSD
process replace is gone, but then the secondary GPT most likely still
intact.
Not sure how to read it or even if possible. SO, I will continue the
research on this, but to be sure, only the first 512 bytes and nothing
at all would have been modified right?
So, if I can find a way to read the secondary GPT, I might be able to
see what the primary should be and may be recreate it. No clue how yet,
but that appear logical right?
Best,
Daniel
