Home Company Ordering 4Webcheck Utilities Support Buy
|
The MBR (Master Boot Record) is the first sector of a hard drive. It contains the boot loader code and the MPT (Master Partition Table). USB flash drives may also feature an MBR. If formatted as a hard drive they contain both an MBR and a boot record, if as a floppy, just a boot record.
The startup sequence The motherboard completes a POST (power on self test) then the BIOS copies the MBR of the drive to memory location 7C00h (31744 decimal). It is then executed by a jump to it with the CPU instruction: JMP 0000:7C00 The MBR code then first copies itself to location 0600h (1536 decimal) and continues execution with a jump to location 061Dh. The relocation is necessary as the code next checks the partition table (64 bytes near the end of the MBR) for the first partition that is marked active, the first sector of which is then copied to location 7C00h and executed. If no bootable partition is found or the partition marked active does not contain an operating system, an error message is displayed using INT 10. Types of MBR The MBR may be of one of the several standard versions or a customization. The above description is for the MBR of a hard drive initialized with the DOS and Windows 95(A) FDISK. It requires that the first sector of the active partition must be at or under cylinder 1024 as the standard INT 13h Read function is used to copy that sector to location 7C00h (the INT 13h BIOS interrupt limits cylinders to 0 to 1023, sectors to 1 to 63 and heads 1 to 15, 8455716864 bytes, 8.4 GB). The most common is the MBR used by Windows 98 and ME. It closely resembles the above except that an extended instruction is used to copy the first sector of the active partion to avoid the cylinder 1024 limitation. The first two bytes usually indicate the MBR version:
FA 33 .. DOS 3.3 to Windows 95A
The first sector of the active partion is actually sector 63 of the partition as the first sector contains a redundant copy of the MBR and sectors 2 through 62 are normally empty (the remainder of the first cylinder). From Windows Vista, Microsoft installations place the first partition at absolute sector 2048 (2048 * 512 = 1,048,576 bytes). Note that some anti virus or disk utility software make use of empty sectors. Master Partition Table The second part of the Master Boot Record, the MPT consists of 48 bytes, sixteen for each possible partition. The first byte indicates whether it is a bootable partition. A value of 80h represents true, a zero false. The next three bytes hold the cylinder, head and sector (CHS) of the boot sector. The fifth byte is the system: 0 .. Unused 1 .. DOS primary with 12 bit FAT 4 .. DOS primary with 16 bit FAT 5 .. DOS extended 6 .. DOS huge (more than 32MB) The next three bytes hold the cylinder, head and sector (CHS) of the end of the partition. The final two blocks of 4 bytes hold the number of sectors on the disk before the start of the partition (usually 63) and the number of sectors in the partition. Note that the final two bytes of the MBR are always 55 and AA. The BIOS checks for them and if not present displays the error message DRIVE NOT READY. The partition table is required to be operating system independent as it is loaded by the BIOS. The first sector of the active partion (the 'boot sector') which is subsequently copied to location 7C00h and executed, is part of the installed operating system.
0x01b0 80 01 .....,Dc..Ã...
Partition limits DOS 3.31 .. 32MB
Low level format A hard drive has a low level format at time of manufacture. There are utilities available from the manufacturers web sites for such, however it is unlikely that they would be necessary as they just request the controller to place a physical format pattern on the disk. Drives may contain a diagnostic cylinder (part of the IBM specification, customer engineering cylinder) in order to conduct tests without affecting stored data. It is the cylinder closest to the spindle. Finally there may also be a secret cylinder used by the controller to record information.
IBM(Hitachi) .. http://www.hgst.com/hdd/support/download.htm
High level format A boot record is placed on the drive when it is formatted. It holds the names of the system files that are required if the drive is to be bootable. The files may be added later with the SYS command if the drive was not originally formatted as bootable. The three required files are the two hidden files IO.SYS and MSDOS.SYS and the command interpreter COMMAND.COM The Windows Format initializes four areas, the boot sector, the file allocation tables (FATs), the root directory and the data area. The boot sector consists of a JMP instruction then a data area followed by the actual boot code. The sector once again ends with 55 and AA. How to make a USB drive bootable Use Microsoft's DiskPart command line utility (Windows XP, Vista, 7) Open an elevated Command Prompt and run DISKPART then type LIST DISK. Note the USB drive number (substitute for X below) then (backup any data first): SELECT DISK X CLEAN CREATE PARTITION PRIMARY SELECT PARTITION 1 ACTIVE FORMAT FS=NTFS ASSIGN To exit from DiskPart type EXIT Finally place the Windows DVD in a drive and navigate to the boot folder: CD BOOT BOOTSECT.EXE /nt60 X: The master boot record on USB drives may easily be damaged. Microsoft provide a free command line tool, Sector Inspector (SecInspect.ext) for backup and restore. It is available here Microsoft Sector Inspect tool use To backup the MBR of the USB drive D: to a file backup.dsk: secinspect.exe -backup d: c:\backup.dsk 0 1 To restore: secinspect.exe -restore d: c:\backup.dsk 0 confirm Details The tool may also be used without any parameters to display a summary of all drives on the system. The following is for a Lexar 2GB drive: LBN 0 [C 0, H 0, S 1]
0x0000 33 c0 8e d0 bc 00 7c fb-50 07 50 1f fc be 1b 7c 3ÀŴỳ.|ûP.P üẅ|
Further details SecInspect.exe is a command-line diagnostics tool that allows administrators to view the contents of master boot records, boot sectors, and IA64 GUID partition tables. Additional features include creating hex dumps of binary files and backup/restore of sector ranges. Other tools A selection of tools may be found here
About the author Chris I Burkinshaw is a software engineer. He also writes wacky science fiction short stories: Anulian |
