Partition Styles

• Both MBR and GPT Partition Styles may support basic or dynamic disk storage types

http://msdn.microsoft.com/en-us/library/windows/desktop/aa363785(v=vs.85).aspx

•Please don’t confuse the terminology

•Basic disks allow the creation of partitions and the formatting of volumes

•Dynamic disks add functionality such as spanned, striped, mirrored and RAID-5 volumes

Master Boot Record

•The MBR occupies the first physical sector of a hard disk drive (PS0)

•The MBR has two main parts

–Master Boot Code

–Master Partition Table

–NTFS disks have a third part – a disk signature

Master Boot Record

Master Boot Code

̶Small program used to mount the first active partition

̶If the master boot code cannot find and mount an active partition it generates one of three error messages

•Invalid partition table

•Error loading operating system

•Missing operating system

̶These can be seen in plain text near the end of the master boot code

Master Boot Record

Master Partition Table

̶Small 64 byte database containing a list of partitions

̶The database contains four 16 byte records ̶Found at sector offset 446 within the MBR

̶Followed by the End of Sector Marker 0x55AA at sector offsets 510-511

̶Defines 4 Primary Partitions or 3 Primary and 1 extended partition

Master Boot Record Hands On

The essence of LBA is that each block addressed on the hard disk has its own number, an integer, starting from zero, etc. (that is, the first block LBA = 0, the second LBA = 1, ...)

LBA 0 = Cylinder 0 / Head 0 / Sector 1

16

Master Boot Record Hands On

extended boot records

•In the MBR partition table 3 primary partitions (P1 – P3) are defined

•The 4th entry does not point to a partition, but to an extended boot record which also contains a partition table

•The first entry in this table points to a partition (P4) and if necessary there can be a

pointer to a further extended boot record (e.g. EBR2 PT) and so on

In the first sector of the extended section is the EBR structure (Extended Boot Record). It is very similar to the MBR structure, but it has the following differences:

1.There is no boot code in EBR. Some downloaders can write it there, but usually this place is filled with zeros.

2.Disk signatures and two unused bytes must be filled with zeros.

3.Only the first two entries can be filled in the partition table. The remaining two entries must be filled with zeros.

At the end of the EBR structure, as well as in the MBR, there should be a “magic” value AA55h.

The first entry in the EBR partition table indicates relative offset between the sector of this EBR and the first sector of the logical partition, and the second entry indicates the relative address of the next EBR in the extended section. If this logical partition is the last in the list, then the second entry in the EBR partition table must be filled with zeros.

19

For the first entry of the EBR partition table, the distance in sectors between the current EBR sector and the beginning of the logical partition referenced by the entry is recorded in the field of the initial sector of the partition (offset 08h). In this case, the size of this logical partition in the sectors is written in the field of the number of sectors of the section (offset 0Ch).

For the second entry of the EBR partition table, the distance between the sector of the very first EBR and the sector of the next EBR in the list is recorded in the field of the initial sector of the section. In this case, the size of the disk area from the sector of this next EBR structure and to the end of the logical partition belonging to this structure is written in the field of the number of partition sectors.

Thus, the first entry in the partition table describes how to find, and what size the current logical partition occupies, and the second entry describes how to find it, and what size the next EBR occupies in the list, along with its partition.

20