Master Boot Record Missing Component
Fill in the missing Master Boot Record component. 1. Master boot code 2. Partition table 3. ____________
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The MBR consists of three parts: boot code, partition table, and disk signature. A common trap is confusing the disk signature with the boot signature (0x55AA).
This question tests knowledge of the Master Boot Record (MBR) structure, specifically identifying the component located at the end of the record. The correct answer is D, Disk Signature.
Many learners choose 'Signature word' because they confuse it with the boot signature (0x55AA), which is technically a marker rather than a named structural component in some contexts, whereas the ECC curriculum explicitly lists 'Disk Signature' as the third part.
Community Discussion (5 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The Master Boot Record (MBR) is a standard used by IBM PC-compatible computers to indicate the location of a computer operating system, the start of active partitions, and other information. According to the EC-Council CHFI curriculum and general Windows forensics documentation, the MBR structure comprises three distinct parts: the Master Boot Code (446 bytes), the Partition Table (64 bytes), and the Disk Signature (2 bytes). The Disk Signature is located immediately after the partition table and before the final boot signature. It serves as a unique identifier for the disk, allowing the operating system to distinguish between multiple disks.Why the Other Options Are Wrong
Option A, 'Signature word', typically refers to the 2-byte value (0x55AA) found at the very end of the MBR (bytes 511-512). While this is a critical part of the MBR structure, the specific blank in the question follows the Partition Table. In the standard breakdown taught in certification exams, the component occupying the space between the partition table and the boot signature is identified as the Disk Signature. Option B, Volume Boot Record, is a separate entity located within each partition, not part of the MBR itself. Option C, Boot loader, is software loaded by the Master Boot Code, not a structural component of the MBR sector.Community Comment Notes
Community comments show a split between 'Disk Signature' and 'Signature word'. Users citing the official ECC book often point out that the MBR has three parts: Boot Code, Partition Table, and Disk Signature. One commenter noted that the Disk Signature is required by BIOS during booting, reinforcing its role as a distinct component. Another user clarified that the 'Signature word' (0x55AA) is technically the boot signature, distinguishing it from the Disk Signature which holds the unique ID.Exam Strategy
When asked about MBR components, remember the order: Boot Code -> Partition Table -> Disk Signature -> Boot Signature. If the question asks for the component after the partition table but before the validity check, it is likely the Disk Signature.
Frequently Asked Questions
What is the difference between Disk Signature and Boot Signature?
The Disk Signature (2 bytes) is a unique ID for the disk located after the partition table. The Boot Signature (0x55AA, 2 bytes) is at the very end of the MBR to validate the sector.
Why is Option A incorrect if 0x55AA is a signature?
While 0x55AA is a signature, the term 'Disk Signature' specifically refers to the 2-byte unique identifier field defined in the MBR structure before the final boot signature.