How to determine if there are extended partitions on a drive?

To determine whether your disk includes extended partitions, you can use the 'Raw Disk Viewer' module in OSForensics to identify and locate your extended partitions. Extended partitions provide support for more than the 4 partition entries limit with MBR partition tables.

Select the physical disk (without a partition) in the drop-down list. This is important as the MBR and partition table are outside of the partitioned space.

Ensure the cursor is within the first sector (Sector 0) of the disk. In the Data Interpreter window, the partition table is displayed in a readable format.

Extended partitions on the disk are marked as "Extended". There is also an additional field, 'EBR Location (LBA)', that identifies the location of the Extended Boot Record (EBR). Double-clicking on any 'LBA' field will seek to the appropriate offset in the disk viewer.