Partition Tables and the Master Boot Record
Partition tables are an important part of the logical structure of a hard disk. If the space of a hard disk is large, we usually divide it into several sections. Each section has a fixed size and is called a logical drive. Why should we do this? We do this for two reasons:
1. If the space of a hard disk were not divided, a logical drive could be too large and file fragments (see DEFRAG.EXE --- disk defragmentation) would grow faster. To avoid this, we divide the hard disk space. (This is no longer the case in Windows NT/2000 and above).
2. Although storing information in different directories is a good method to store different kinds of files at different places (especially when they are reassigned as network drives, see SUBST.EXE), sometimes we still want to format a disk to make it clean. At this moment, one logical drive taking up all space of the disk would bring trouble. (There is almost no such need since Windows Vista because its bootable installation CD has a Pre-installation Environment, and also it can move all old Windows files into a directory called Windows.old before starting a new installation).
In partition tables, data including the starting sector of the partition, the size of the partition and the type of the partition are stored.
Before using a new hard disk, it should be partitioned. A new hard disk is usually low-level formatted (which means the magnetic marks for tracks and sectors are already on the disk; floppy disks are sometimes sold without low-level formatting), and is with a usable "bootstrap" in its first sector, which is called the Master Boot Record (MBR). Another sector is also important, which is the first sector of the active (bootable) partition. It is called the boot sector.
The bootstrap in MBR is a program used to boot the operating system installed in a bootable partition on the disk. It looks up the main partition table (which a part of the MBR) first, and then loads the boot sector of the specific "active" partition, and then run the bootstrap in the boot sector of the partition to load the operating system.
As of 2001, when the article was first-written, popular hard disks have capacity of around 40GB. As of 2011, when I reviewed this article, the MBR will be replaced by Guid Partition Table and related architecture defined in Intel Unified Extensible Firmware Interface (UEFI), because it cannot handle hard disks larger than 2TB.
Let's see what the master boot record contains. Below is what I did with my 8GB hard disk from inside Windows 98.
C:\WINDOWS\Desktop>debug
-a 100
17C2:0100 mov ax, 0201
17C2:0103 mov bx, 0200
17C2:0106 mov cx, 0001
17C2:0109 mov dx, 0080
17C2:010C int 13
17C2:010E int 3
17C2:010F
-g=100
AX=0050 BX=0200 CX=0001 DX=0080 SP=FFEE BP=0000 SI=0000 DI=0000
DS=17C2 ES=17C2 SS=17C2 CS=17C2 IP=010E NV UP EI PL NZ NA PO NC
17C2:010E CC INT 3
-d 200 3ff
17C2:0200 FA 33 C0 8E D0 BC 00 7C-8B F4 50 07 50 1F FB FC .3.....|..P.P...
17C2:0210 BF 00 06 B9 00 01 F2 A5-EA 1D 06 00 00 BE BE 07 ................
17C2:0220 B3 04 80 3C 80 74 0E 80-3C 00 75 1C 83 C6 10 FE ...<.t..<.u.....
17C2:0230 CB 75 EF CD 18 8B 14 8B-4C 02 8B EE 83 C6 10 FE .u......L.......
17C2:0240 CB 74 1A 80 3C 00 74 F4-BE 8B 06 AC 3C 00 74 0B .t..<.t.....<.t.
17C2:0250 56 BB 07 00 B4 0E CD 10-5E EB F0 EB FE BF 05 00 V.......^.......
17C2:0260 BB 00 7C B8 01 02 57 CD-13 5F 73 0C 33 C0 CD 13 ..|...W.._s.3...
17C2:0270 4F 75 ED BE A3 06 EB D3-BE C2 06 BF FE 7D 81 3D Ou...........}.=
17C2:0280 55 AA 75 C7 8B F5 EA 00-7C 00 00 49 6E 76 61 6C U.u.....|..Inval
17C2:0290 69 64 20 70 61 72 74 69-74 69 6F 6E 20 74 61 62 id partition tab
17C2:02A0 6C 65 00 45 72 72 6F 72-20 6C 6F 61 64 69 6E 67 le.Error loading
17C2:02B0 20 6F 70 65 72 61 74 69-6E 67 20 73 79 73 74 65 operating syste
17C2:02C0 6D 00 4D 69 73 73 69 6E-67 20 6F 70 65 72 61 74 m.Missing operat
17C2:02D0 69 6E 67 20 73 79 73 74-65 6D 00 00 80 20 06 17 ing system... ..
17C2:02E0 56 33 F6 56 56 52 50 06-53 51 BE 10 00 56 8B F4 V3.VVRP.SQ...V..
17C2:02F0 50 52 B8 00 42 8A 56 24-CD 13 5A 58 8D 64 10 72 PR..B.V$..ZX.d.r
17C2:0300 0A 40 75 01 42 80 C7 02-E2 F7 F8 5E C3 EB 74 B7 .@u.B......^..t.
17C2:0310 D6 C7 F8 B1 ED CE DE D0-A7 A1 A3 B0 B2 D7 B0 B3 ................
17C2:0320 CC D0 F2 CE DE B7 A8 BC-CC D0 F8 A1 A3 00 BC D3 ................
17C2:0330 D4 D8 B2 D9 D7 F7 CF B5-CD B3 CA B1 B3 F6 CF D6 ................
17C2:0340 B4 ED CE F3 A1 A3 B0 B2-D7 B0 B3 CC D0 F2 CE DE ................
17C2:0350 B7 A8 BC CC D0 F8 A1 A3-00 C8 B1 C9 D9 B2 D9 D7 ................
17C2:0360 F7 CF B5 CD B3 00 00 00-00 00 00 00 00 00 00 00 ................
17C2:0370 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
17C2:0380 00 00 00 8B FC 1E 57 8B-F5 CB 00 00 00 00 00 00 ......W.........
17C2:0390 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
17C2:03A0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
17C2:03B0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 01 ................
17C2:03C0 01 00 17 FE BF 8C 3F 00-00 00 0E 12 A0 00 80 00 ......?.........
17C2:03D0 81 8D 0C FE FF FF 4D 12-A0 00 4D 12 A0 00 00 FE ......M...M.....
17C2:03E0 FF FF 0F FE FF FF 9A 24-40 01 FE E6 19 01 00 00 .......$@.......
17C2:03F0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 AA ..............U.
-
In the table:
1. From the very beginning is the "bootstrap" program. It boots the operating system on the partition specified to be "active". For a good example of the bootstrap program, see my Minix MBR code reading. For the exact Windows 98 MBR, please refer to Windows 98 MBR Revealed - Starman.
2. From the byte at offset 0x1BE (which is the byte 17C2:03BE) is the main partition table. Four entries are there in all. Each entry takes 16 bytes. The bytes of them mean:
Offset content
0x00 Whether the partition is active. If the value is 0x80 ~ 0x8F,
the partition is active. If the value is 0x00, the
partition is not active.
0x01-0x03 The starting head number, sector number and cylinder number of the
partition. For those partitions that are within the first 504 MiB of
the hard disk in P-CHS mode (Physical Cylinder Head Sector) or
those partitions that are within the first 8 GB of the hard disk in
L-CHS (Logical Cylinder Head Sector) mode.
0x04 The type of the partition. See the table (from BootStar Help):
MS-DOS:
FAT 12, partition smaller than 32 MiB: Type "01" (Robbie: for FAT/NTFS, value 0x10 can be added to the partition type, and that means a hidden partition of that type)
FAT 16, partition smaller than 504 MiB version higher than 3.3: Type "04"
FAT 16, partition smaller than 2 GB and end not higher than 8 GB: Type "06"
Windows 95:
FAT 16, partition smaller than 2 GB and end not higher than 8 GB: Type "06"
FAT 16, partition smaller than 2 GB and end higher than 8 GB: Type "0E"
Windows 95b OSR 2, Windows 98:
FAT 16, partition smaller than 2 GB and end not higher than 8 GB: Type "06"
FAT 16, partition smaller than 2 GB and end higher than 8 GB: Type "0E"
FAT 32, end not higher than 8 GB: Type "0B"
FAT 32, end higher than 8 GB: Type "0C"
Windows NT:
FAT 16, partition smaller than 4 GB and end not higher than 8 GB: Type "06"
NTFS; start not higher than Cylinder 1024: Type "07" (Robbie: also applied for partition starting at a cylinder higher than 1024)
Windows 2000:
FAT 16, partition smaller than 4 GB and end not higher than 8 GB: Type "06"
FAT 16, partition smaller than 4 GB and end higher than 8 GB: Type "0E"
FAT 32, partition smaller than 127 GB and end not higher than 8 GB: Type "0B"
FAT 32, partition smaller than 127 GB and end higher than 8 GB: Type "0C"
NTFS; start not higher than Cylinder 1024: Type "07" (Robbie: also applied for partition starting at a cylinder higher than 1024; this type can represent HPFS/NTFS/exFAT/Advance Unix/QNX/etc.)
OS/2:
HPFS; partition smaller than 2 GB and end not higher than 8 GB: Type "07"
FAT 16, partition smaller than 2 GB and end not higher than 8 GB: Type "06"
Linux:
ext2fs, start not higher than Cylinder 1024: Type "83"
Swap partition (should be set up additionally): Type "82"
Extended Partitions:
Normal: Type "05"
Partition bigger than 8 GB or higher than 8 GB : Type "0F"
Novell NetWare:
Netware 286: Type "64"
Netware 3.11: Type "65"
Extended reading: Partition types - Andries Brouwer
0x05-0x07 The ending head number, sector number and cylinder number of the
partition. For partitions that are within the first 504 MiB of the
hard disk in P-CHS mode or partitions that are within the first 8 GB
of the hard disk in L-CHS mode.
0x08-0x0B Relative sector number of the first sector of the partition, that is,
the absolute sector number of the starting sector minuses the sector
number of the sector containing the partition table. This number is
still valid for hard disks up to size 2048 GB. This number can be
used with extended INT 13H call, which supports LBA (logical block
addressing) mode up to 48-bit sector number (in ATA-6 spec year
2003).
0x0C-0x0F The number of sectors in the partition. This number is still
valid for hard disks up to size 2048 GB.
3. The bytes offset 0x1FE and 0x1FF compose the hard disk MBR validity mark "55 AA".
If you are using MS-DOS or Windows 9x or Windows NT/2000, you will see that there is a
primary DOS partition and an
extended partition. They together take up the whole space of the hard disk (not shown in this example, because my hard disk has not been fully divided). Usually, drive C: is a bootable partition and it should be a primary DOS partition. In order to boot it at the starting-up of the computer, it should be marked "active". Other drive letters of your hard disk are usually logical drives in the extended partition. Often, there are more than one logical drives in the extended partition. To mark these logical drives on the hard disk, there are extended partition tables. These partition tables are linked like this: The information of the extended partition in the
MBR partition table points to the first
extended partition table, and the first extended partition table contains information (stored in a sector, which is also called an extended boot record, though it doesn't contain any code) pointing to the first logical drive and information pointing to the second extended partition table, and so on. In this way the extended partition can contain many logical drives.
To get exact information of hard disks larger than 504 MiB, MS-DOS or Windows 9x or NT/2000 refers to the system BIOS configuration to find out the factors of the hard disk so that they can calculate the real cylinder number, head number and sector number from the relative sector number and the number of sectors in a partition, or they just ignore this configuration and use the logical CHS numbers and call INT 13H (BIOS disk operation routine) directly. For modern hard disks, LBA access mode is widely supported, so usually it's not necessary to consider cylinder, head and sector.
When you create partitions using FDISK, it not only writes partition information on the disk, but also clears the boot sector of the partition. So before you use FORMAT command to format the partition, MS-DOS will not allow you use it. Because of this operation, if you delete a partition and then create a new one with FDISK, one partition that is at the same place of the hard disk and is of the same size as that of the former partition, you will still be unable to see the original information of the disk. Because of this, please be careful when you delete and create a partition! Another thing about FDISK: the switch "/MBR". This switch makes FDISK just overwrite the "bootstrap" program with its standard version. It doesn't affect the partition table. If you are using multi-booting tools that modify the partition tables, such as BootStar, SystemCommander, etc., do not use that switch.
There are other partitioning tools such as commercial Partition Magic (produced by PowerQuest), Disk Manager (produced by IBM) and open source software GParted (Gnome Partition Editor). They support resizing, copying and moving partitions, which is not supported by FDISK. Also, Norton Ghost is a partition copying and back-up tool (also PowerQuest DriveImage). Of course you can use any of them, but for your sake, do not use more than one tools of the same kind at the same time, unless there are official documents pointing out that the products you are going to use are compatible with each other. Sometimes one tool has one type of bugs or incompatibilities while another tool has another type. Also, you'd better not stop any of the operations of the partitioning tools in progress (even if they have a "Cancel" button), because this may cause severe data loss.