Disk Offset vs Volume Offset: Why the Starting Point Matters

A disk offset counts from the beginning of a disk; a volume offset counts from the beginning of a volume. For a simple volume occupying one partition on a basic disk, subtract the partition’s starting byte offset to translate a disk address into a volume address.

The subtraction is useful only after you confirm the disk, the units, and the partition boundary. A correctly calculated number can still describe the wrong device.

This walkthrough covers that straightforward, single-partition layout. It does not translate addresses from individual RAID members, Storage Spaces pool disks, or other underlying media into a virtual volume.

Disk offset vs volume offset: two starting points

Illustrative layout — not a command. Every value below is expressed in bytes:

Disk byte 0
    |
    | 1,048,576 bytes
    v
Partition begins: disk byte 1,048,576 = volume byte 0
    |
    | 2,097,152 bytes into this volume
    v
Target byte: disk byte 3,145,728 = volume byte 2,097,152

The target did not move. Only the origin used to describe it changed.

Conversion formulas — not commands. Let D be the disk byte offset, P the partition’s starting byte offset, and V the volume byte offset:

V = D - P
D = P + V

If an existing value is already volume-relative, do not subtract P again. If the source gives an LBA, convert that block number to a byte offset using the logical block size for that address space before applying the formula.

Neither a drive letter nor the word “offset” on its own establishes the origin.

For converting a block number before this step, see LBA to Byte Offset: Decimal, Hex, and Sector Size.

Use the calculator below with verified values from the same disk and partition. If you do not have those values yet, follow the checks in the next sections first.

Confirm which disk the address belongs to

Preserve the original event or tool output, including its source, time, device path, numeric base, and units. Ask whether the reported address refers to the whole Windows disk, a particular volume, an NVMe namespace, or a layer below a virtual disk.

For the Windows inventory, open Windows PowerShell as administrator:

Get-Disk |
    Select-Object Number, FriendlyName, SerialNumber, UniqueId,
        BusType, PartitionStyle, LogicalSectorSize, Size |
    Format-List

This is an information query; it does not scan, repair, initialize, or format disks. Serial numbers can be sensitive when shared publicly.

Cross-check the reported device with this inventory and Disk Management. Disk numbers can change across restarts, so today’s Disk 1 is not automatically the device named Disk 1 in an old event. A controller port name is also not a disk number.

If the connection between the original address and a current disk cannot be established, stop before assigning that address to a partition.

For cross-checking Windows disk numbers against your drives, see Which Drive Is Disk 0 in Windows?.

Read the partition’s raw start and length

After confirming the disk, query its partitions in the same Windows PowerShell session running as administrator. Here 1 is a placeholder disk number; replace it with the number you verified:

Get-Partition -DiskNumber 1 |
    Select-Object DiskNumber, PartitionNumber, DriveLetter,
        Offset, Size, AccessPaths |
    Format-List

The query changes nothing. In this output, Offset is the partition’s starting offset in bytes, and Size is its length in bytes. Use these raw values, not a rounded capacity label from a screenshot.

Do not substitute StartingOffset in this command: that name belongs to other interfaces, including Win32_DiskPartition. Selecting a nonexistent property can produce a blank field that looks deceptively usable.

An empty drive letter does not mean a partition is empty or irrelevant. It may have a mounted-folder path, or it may be a system partition. Do not assign letters or alter partitions just to complete this calculation.

Check the range before subtracting

Range condition — not a command. For a partition of length S, a single disk byte belongs to it only when:

P <= D < P + S

The start is included. The end is excluded because P + S is the first byte after the partition.

Using the illustrative start of 1,048,576 and length of 10,485,760:

A negative result from D – P is not a strange NTFS address. It means the selected partition starts after the target byte.

If the source describes a range of N bytes rather than one byte, also require D + N <= P + S, with N positive. Checking the starting byte alone does not prove the entire request fits inside the partition.

Calculate without losing integer precision

The following example uses Windows PowerShell and needs no administrator rights because it performs arithmetic only. Replace all three quoted decimal values with verified byte values. Do not include thousands separators or GB suffixes.

$diskByte = [bigint]'3145728'
$partitionStart = [bigint]'1048576'
$partitionSize = [bigint]'10485760'
if ($diskByte -lt 0 -or $partitionStart -lt 0 -or $partitionSize -le 0) {
    throw 'Use nonnegative offsets and a positive partition size.'
}
$partitionEnd = $partitionStart + $partitionSize
if ($diskByte -lt $partitionStart -or $diskByte -ge $partitionEnd) {
    throw 'The disk byte is outside this partition.'
}
$volumeByte = $diskByte - $partitionStart
[pscustomobject]@{
    DiskByte = $diskByte.ToString()
    PartitionStart = $partitionStart.ToString()
    PartitionEndExclusive = $partitionEnd.ToString()
    VolumeByte = $volumeByte.ToString()
}

For these inputs, VolumeByte is 2097152 and PartitionEndExclusive is 11534336. The example uses arbitrary-precision integers so multiplication or subtraction elsewhere in the calculation need not be forced through a 32-bit or floating-point value.

A successful calculation verifies the arithmetic and range check. It does not verify that the inputs came from the right disk.

What this result can tell you

For the supported layout, you now have a position measured from the volume’s beginning. On NTFS, that is the starting point for converting a byte position to a logical cluster number using the volume’s bytes per cluster.

It is not yet a filename, a diagnosis of physical damage, or proof of which file existed at that location when an older event occurred.

If no partition contains the address, recheck the device identity, hexadecimal versus decimal interpretation, logical block size, and address origin. The address may also refer to space outside a partition. Do not move or resize a partition to make a diagnostic number fit.