The MBR (Master Boot Record) is the first sector of a hard drive. It contains the boot loader code and the MPT (Master Partition Table). USB flash drives may also feature an MBR. If formatted as a hard drive they contain both an MBR and a boot record, if as a floppy, just a boot record.
The startup sequence
The motherboard completes a POST (power on self test) then the BIOS copies the MBR of the drive to memory location 7C00h (31744 decimal). It is then executed by a jump to it with the CPU instruction: JMP 0000:7C00
The MBR code then first copies itself to location 0600h (1536 decimal) and continues execution with a jump to location 061Dh.
The relocation is necessary as the code next checks the partition table (64 bytes near the end of the MBR) for the first partition that is marked active, the first sector of which is then copied to location 7C00h and executed.
If no bootable partition is found or the partition marked active does not contain an operating system, an error message is displayed using INT 10.
Types of MBR
The MBR may be of one of the several standard versions or a customization. The above description is for the MBR of a hard drive initialized with the DOS and Windows 95(A) FDISK. It requires that the first sector of the active partition must be at or under cylinder 1024 as the standard INT 13h Read function is used to copy that sector to location 7C00h (the INT 13h BIOS interrupt limits cylinders to 0 to 1023, sectors to 1 to 63 and heads 1 to 15, 8455716864 bytes, 8.4 GB).
The most common is the MBR used by Windows 98 and ME. It closely resembles the above except that an extended instruction is used to copy the first sector of the active partion to avoid the cylinder 1024 limitation.
The first two bytes usually indicate the MBR version:
FA 33 .. DOS 3.3 to Windows 95A 33 C0 .. Windows 95B, 98, 98SE, ME, 2000, XP, Vista FA EB .. Linux LILO EB 3C .. Windows Floppy Disk boot record The FA instruction is disable interrupts, 33 C0 is XOR AX,AX
The first sector of the active partion is actually sector 63 of the partition as the first sector contains a redundant copy of the MBR and sectors 2 through 62 are normally empty (the remainder of the first cylinder). From Windows Vista, Microsoft installations place the first partition at absolute sector 2048 (2048 * 512 = 1,048,576 bytes).
Note that some anti virus or disk utility software make use of empty sectors.
Master Partition Table
The second part of the Master Boot Record, the MPT consists of 48 bytes, sixteen for each possible partition. The first byte indicates whether it is a bootable partition. A value of 80h represents true, a zero false. The next three bytes hold the cylinder, head and sector (CHS) of the boot sector. The fifth byte is the system:
0 .. Unused
1 .. DOS primary with 12 bit FAT
4 .. DOS primary with 16 bit FAT
5 .. DOS extended
6 .. DOS huge (more than 32MB)
The next three bytes hold the cylinder, head and sector (CHS) of the end of the partition.
The final two blocks of 4 bytes hold the number of sectors on the disk before the start of the partition (usually 63) and the number of sectors in the partition.
Note that the final two bytes of the MBR are always 55 and AA. The BIOS checks for them and if not present displays the error message DRIVE NOT READY.
The partition table is required to be operating system independent as it is loaded by the BIOS. The first sector of the active partion (the ‘boot sector’) which is subsequently copied to location 7C00h and executed, is part of the installed operating system.
0x01b0 80 01 .....,Dc..�..�. 0x01c0 01 00 06 80 e0 bc 20 00-00 00 e0 bf 3b 00 00 00 ...�� ...�;... 0x01d0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0x01e0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0x01f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 aa ..............U�
Partition limits
DOS 3.31 .. 32MB Windows 95A .. 2GB Windows NT .. 4GB (installs to a FAT16 partition then converts it to NTFS) Windows XP .. 137GB (SP2 extends) The FAT 32 file system (introduced Windows 95 OSR2, Windows 2000 onwards) had a limit of 137.5 GB. Windows ME extended it to 2 terabytes (Windows 2000 and Windows XP will only format it to 32GB). The NTFS file system is 2TB (32 bit) or 16 exabytes (64 bit).
Low level format
A hard drive has a low level format at time of manufacture. There are utilities available from the manufacturers web sites for such, however it is unlikely that they would be necessary as they just request the controller to place a physical format pattern on the disk.
Drives may contain a diagnostic cylinder (part of the IBM specification, customer engineering cylinder) in order to conduct tests without affecting stored data. It is the cylinder closest to the spindle.
Finally there may also be a secret cylinder used by the controller to record information.
IBM(Hitachi) .. http://www.hgst.com/hdd/support/download.htm Maxtor .. http://www.maxtor.com/en/support/downloads/index.htm Fujitsu .. http://www.fel.fujitsu.com/home/drivers.asp?L=en&CID=1 Samsung .. http://www.samsung.com/Products/HardDiskDrive/utilities/index.htm
High level format
A boot record is placed on the drive when it is formatted. It holds the names of the system files that are required if the drive is to be bootable. The files may be added later with the SYS command if the drive was not originally formatted as bootable. The three required files are the two hidden files IO.SYS and MSDOS.SYS and the command interpreter COMMAND.COM
The Windows Format initializes four areas, the boot sector, the file allocation tables (FATs), the root directory and the data area. The boot sector consists of a JMP instruction then a data area followed by the actual boot code. The sector once again ends with 55 and AA.
How to make a USB drive bootable
Use Microsoft’s DiskPart command line utility (Windows XP, Vista, 7)
Open an elevated Command Prompt and run DISKPART then type LIST DISK.
Note the USB drive number (substitute for X below) then (backup any data first):
SELECT DISK X CLEAN CREATE PARTITION PRIMARY SELECT PARTITION 1 ACTIVE FORMAT FS=NTFS ASSIGN
To exit from DiskPart type EXIT
Finally place the Windows DVD in a drive and navigate to the boot folder:
CD BOOT BOOTSECT.EXE /nt60 X:
The master boot record on USB drives may easily be damaged. Microsoft provide a free command line tool, Sector Inspector (SecInspect.ext) for backup and restore. It is available here
Microsoft Sector Inspect tool use
To backup the MBR of the USB drive D: to a file backup.dsk:
secinspect.exe -backup d: c:\backup.dsk 0 1
To restore:
secinspect.exe -restore d: c:\backup.dsk 0 confirm
Details
The tool may also be used without any parameters to display a summary of all drives on the system. The following is for a Lexar 2GB drive:
LBN 0 [C 0, H 0, S 1]
0x0000 33 c0 8e d0 bc 00 7c fb-50 07 50 1f fc be 1b 7c 3��м.|�P.P��| 0x0010 bf 1b 06 50 57 b9 e5 01-f3 a4 cb bd be 07 b1 04 �.PW��.�˽�.�. 0x0020 38 6e 00 7c 09 75 13 83-c5 10 e2 f4 cd 18 8b f5 8n.|.u������� 0x0030 83 c6 10 49 74 19 38 2c-74 f6 a0 b5 07 b4 07 8b ��It8,t���.�.� 0x0040 f0 ac 3c 00 74 fc bb 07-00 b4 0e cd 10 eb f2 88 �<.t��..�.��� 0x0050 4e 10 e8 46 00 73 2a fe-46 10 80 7e 04 0b 74 0b N�F.s*�F�~..t. 0x0060 80 7e 04 0c 74 05 a0 b6-07 75 d2 80 46 02 06 83 �~..t.��.uҀF..� 0x0070 46 08 06 83 56 0a 00 e8-21 00 73 05 a0 b6 07 eb F..�V..�!.s.��.� 0x0080 bc 81 3e fe 7d 55 aa 74-0b 80 7e 10 00 74 c8 a0 ��>�}U�t.�~.tȠ 0x0090 b7 07 eb a9 8b fc 1e 57-8b f5 cb bf 05 00 8a 56 �.멋�W��˿..�V 0x00a0 00 b4 08 cd 13 72 23 8a-c1 24 3f 98 8a de 8a fc .�.�r#��$?��ފ� 0x00b0 43 f7 e3 8b d1 86 d6 b1-06 d2 ee 42 f7 e2 39 56 C��цֱ.��B��9V 0x00c0 0a 77 23 72 05 39 46 08-73 1c b8 01 02 bb 00 7c .w#r.9F.s�..�.| 0x00d0 8b 4e 02 8b 56 00 cd 13-73 51 4f 74 4e 32 e4 8a �N.�V.�sQOtN2� 0x00e0 56 00 cd 13 eb e4 8a 56-00 60 bb aa 55 b4 41 cd V.���V.`��U�A� 0x00f0 13 72 36 81 fb 55 aa 75-30 f6 c1 01 74 2b 61 60 r6��U�u0��.t+a` 0x0100 6a 00 6a 00 ff 76 0a ff-76 08 6a 00 68 00 7c 6a j.j.�v.�v.j.h.|j 0x0110 01 6a 10 b4 42 8b f4 cd-13 61 61 73 0e 4f 74 0b .j�B���aas.Ot. 0x0120 32 e4 8a 56 00 cd 13 eb-d6 61 f9 c3 49 6e 76 61 2�V.���a��Inva 0x0130 6c 69 64 20 70 61 72 74-69 74 69 6f 6e 20 74 61 lid partition ta 0x0140 62 6c 65 00 45 72 72 6f-72 20 6c 6f 61 64 69 6e ble.Error loadin 0x0150 67 20 6f 70 65 72 61 74-69 6e 67 20 73 79 73 74 g operating syst 0x0160 65 6d 00 4d 69 73 73 69-6e 67 20 6f 70 65 72 61 em.Missing opera 0x0170 74 69 6e 67 20 73 79 73-74 65 6d 00 00 00 00 00 ting system..... 0x0180 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0x0190 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0x01a0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0x01b0 00 00 00 00 00 2c 44 63-18 2e 07 c3 00 00 80 01 .....,Dc..�..�. 0x01c0 01 00 06 80 e0 bc 20 00-00 00 e0 bf 3b 00 00 00 ...�� ...�;... 0x01d0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0x01e0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0x01f0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 55 aa ..............U� ---------------------------------------------------------------------------
Primary Partition 1
FAT BIOS Parameter Block Information
BytesPerSector : 512
Sectors Per Cluster : 64
ReservedSectors : 2
Fats : 2
RootEntries : 512
Small Sectors : 0 ( 0 MB )
Media Type : 248 ( 0xf8 )
SectorsPerFat : 239
SectorsPerTrack : 32
Heads : 128
Hidden Sectors : 32
Large Sectors : 3915744 ( 1911 MB )
—————————————————————————
LBN 32 [C 0, H 0, S 33]
0x0000 eb 3c 90 4d 53 57 49 4e-34 2e 31 00 02 40 02 00 �<�MSWIN4.1..@.. 0x0010 02 00 02 00 00 f8 ef 00-20 00 80 00 20 00 00 00 .....��. .�. ... 0x0020 e0 bf 3b 00 00 00 29 60-7f ea a7 4e 4f 20 4e 41 �;...)`�NO NA 0x0030 4d 45 20 20 20 20 46 41-54 31 36 20 20 20 fa 33 ME FAT16 �3 0x0040 c9 8e d1 bc fc 7b 16 07-bd 78 00 c5 76 00 1e 56 ɎѼ�{.�x.�v.V 0x0050 16 55 bf 22 05 89 7e 00-89 4e 02 b1 0b fc f3 a4 U�".�~.�N.�.�� 0x0060 06 1f bd 00 7c c6 45 fe-0f 8b 46 18 88 45 f9 38 .�.|�E�.�F�E�8 0x0070 4e 24 7d 22 8b c1 99 e8-77 01 72 1a 83 eb 3a 66 N$}"����w.r��:f 0x0080 a1 1c 7c 66 3b 07 8a 57-fc 75 06 80 ca 02 88 56 �|f;.�W�u.��.�V 0x0090 02 80 c3 10 73 ed 33 c9-8a 46 10 98 f7 66 16 03 .��s�3ɊF��f. 0x00a0 46 1c 13 56 1e 03 46 0e-13 d1 8b 76 11 60 89 46 FV.F.ыv`�F 0x00b0 fc 89 56 fe b8 20 00 f7-e6 8b 5e 0b 03 c3 48 f7 ��V�� .��^..�H� 0x00c0 f3 01 46 fc 11 4e fe 61-bf 00 07 e8 23 01 72 39 �.F�N�a�..�#.r9 0x00d0 38 2d 74 17 60 b1 0b be-d8 7d f3 a6 61 74 39 4e 8-t`�.��}�at9N 0x00e0 74 09 83 c7 20 3b fb 72-e7 eb dd be 7f 7d ac 98 t.�� ;�r��ݾ}�� 0x00f0 03 f0 ac 84 c0 74 17 3c-ff 74 09 b4 0e bb 07 00 .��t<�t.�.�.. 0x0100 cd 10 eb ee be 82 7d eb-e5 be 80 7d eb e0 98 cd ��}�往}���� 0x0110 16 5e 1f 66 8f 04 cd 19-be 81 7d 8b 7d 1a 8d 45 ^f�.���}�}�E 0x0120 fe 8a 4e 0d f7 e1 03 46-fc 13 56 fe b1 04 e8 c1 ��N.��.F�V��.�� 0x0130 00 72 d6 ea 00 02 70 00-b4 42 eb 2d 60 66 6a 00 .r��..p.�B�-`fj. 0x0140 52 50 06 53 6a 01 6a 10-8b f4 74 ec 91 92 33 d2 RP.Sj.j��t쑒3� 0x0150 f7 76 18 91 f7 76 18 42-87 ca f7 76 1a 8a f2 8a �v��vB���v�� 0x0160 e8 c0 cc 02 0a cc b8 01-02 8a 56 24 cd 13 8d 64 ���..̸..�V$��d 0x0170 10 61 72 0a 40 75 01 42-03 5e 0b 49 75 77 c3 03 ar.@u.B.^.Iuw�. 0x0180 18 01 27 0d 0a 49 6e 76-61 6c 69 64 20 73 79 73 .'..Invalid sys 0x0190 74 65 6d 20 64 69 73 6b-ff 0d 0a 44 69 73 6b 20 tem disk�..Disk 0x01a0 49 2f 4f 20 65 72 72 6f-72 ff 0d 0a 52 65 70 6c I/O error�..Repl 0x01b0 61 63 65 20 74 68 65 20-64 69 73 6b 2c 20 61 6e ace the disk, an 0x01c0 64 20 74 68 65 6e 20 70-72 65 73 73 20 61 6e 79 d then press any 0x01d0 20 6b 65 79 0d 0a 00 00-49 4f 20 20 20 20 20 20 key....IO 0x01e0 53 59 53 4d 53 44 4f 53-20 20 20 53 59 53 7f 01 SYSMSDOS SYS. 0x01f0 00 41 bb 00 07 80 7e 02-0e e9 40 ff 00 00 55 aa .A�..�~..�@�..U�
Further details
SecInspect.exe is a command-line diagnostics tool that allows administrators to view the contents of master boot records, boot sectors, and IA64 GUID partition tables. Additional features include creating hex dumps of binary files and backup/restore of sector ranges.
Other tools
A selection of tools may be found here
Source: www.bibase.com
Recent Comments