Master Boot Record
MBR can designate:
- the whole contents of a disk's first sector (CHS 0,0,1);
- the boot loader occupying the first 446 bytes of that sector;
- the classical partitioning format with 4 partitions max (e.g., 3 primary partitions + 1 extended partition);
MBR (cylinder 0, head 0, sector 1)
The first part of this sector (first 446 bytes) is occupied by the Boot Loader code (some people call it MBR or MBR code). If this part is damaged, OS cannot be loaded from this HDD in usual manner. However, it does not mean that it cannot be loaded at all. There are ways to start a boot loader from other media (like USB-flash) or to write the appropriate code to this part of HDD. Anyway, these first 446 bytes are less important than remaining 66 bytes containing partition table. That is, there are std tools that can help you to restore the boot loader, but the partition table is unique: to be able to restore it, you should first make an appropriate backup of it (see one of methods).
Partition table
The second part of the sector is occupied by the Partition Table. The Partition Table conforms to a standard layout that is independent of the OS. Each entry is 16 bytes long, making a maximum of 4 entries available. Each entry starts at a predetermined offset from the beginning of the sector, as follows:
Partition 1 0x01BE (446)
Partition 2 0x01CE (462)
Partition 3 0x01DE (478)
Partition 4 0x01EE (494)
The last 2 bytes in the sector are a signature word for the sector and are always 0x55AA. When there are fewer than 4 partitions, the remaining fields are all zeros.
| Offset | Len | Sample value | Description |
|---|---|---|---|
| 00 | 8 | 0x80 | Boot Indicator. Shows whether the partition
is the system partition. Legal values:
00 = Do not use for booting; 80 = System partition; |
| 01 | 8 | 0x01 | Starting Head; |
| 02 | 6 | 0x01 | Starting Sector. Only bits 0-5 are used. Bits 6-7 are the upper two bits for the starting cyl field; |
| 03 | 10 | 0x00 | Starting Cylinder. This field contains the lower 8 bits of the cyl value. Starting cyl is thus a 10-bit number, with a max value of 1023; |
| 04 | 8 | 0x06 | System ID. This byte defines the volume type; |
| 05 | 8 | 0x0F | Ending Head; |
| 06 | 6 | 0x3F | Ending Sector. Only bits 0-5 are used. Bits 6-7 are the upper two bits for the ending cyl field; |
| 07 | 10 | 0x196 | Ending Cylinder. This field contains the lower 8 bits of the cylinder value. Ending cyl is thus a 10-bit num, with a max value of 1023; |
| 08 | 32 | 3F 00 00 00 | Relative Sector; |
| 12 | 32 | 51 42 06 00 | Total Sectors; |
| Value | Meaning |
|---|---|
| 0x01 | 12-bit FAT partition or logical drive. The number of sectors in the volume is fewer than 32680; |
| 0x04 | 16-bit FAT partition or logical drive. The number of sectors is between 32680 and 65535; |
| 0x05 | Extended partition; |
| 0x06 | BIGDOS FAT partition or logical drive; |
| 0x07 | NTFS partition or logical drive; |
How to restore MBR
An old solution was to boot DOS from floppy disk and execute:
FDISK /MBR
Since floppy drives and diskettes are rare now, you have to find some other way. Luckily, moderm Linux distros usually come with MBR image hidden in /usr/lib/syslinux or /usr/lib/syslinux/mbr. Thus, you can start your system using Live CD/USB (e.g., Ubuntu Live CD or Ubuntu Live USB, which are actually regular Ubuntu distros for OS installation), then you just put MBR to the right place of the target disk (/dev/sda is specified in the following cmd as an example):
dd if=/usr/lib/syslinux/mbr/mbr.bin of=/dev/sda
Some LiveCDs (like RIPLinux, Knoppix)
include a utility named TestDisk that also can restore DOS MBR.
Note!
Programs that erase or rewrite MBR do not (or, at least, should not) change HDD's partition table!
How to create GRUB boot floppy
This is really obsolete. Get a floppy diskette and a Linux-computer with a diskette drive:
cd /usr/share/grub/i386-redhat
(in other systems /usr/share/grub/i386-pc)
dd if=stage1 of=/dev/fd0 bs=512 count=1
dd if=stage2 of=/dev/fd0 bs=512 seek=1
GPT, UEFI, EFI
GPT (GUID Partition Table) is a standard for the layout of the partition table on a physical hard disk. Since 2010 it is a subset of UEFI.
The original EFI (Extensible Firmware Interface) specification was developed by Intel Corp. between 1998..2005. In the middle of 2005 Intel stopped spec development (last version 1.10), and contributed it to Unified EFI Forum. UEFI version 2.1 was released in 2007.
UEFI (Unified Extensible Firmware Interface) is a specification that defines a software interface between OS and platform firmware. UEFI is a more advanced and secure replacement for IBM PC BIOS firmware interface. UEFI is not restricted to any specific processor architecture and can run on top of (or instead of) older BIOS implementations.
ESP (EFI System Partition) is a data storage device partition that is used in computers adhering to the UEFI spec. Accessed by the UEFI firmware when a computer is powered up, it stores UEFI apps and the files these apps need to run, e.g., OS kernel. Supported partition table schemes include MBR, GPT, and El Torito volumes on optical disks. UEFI defines a specific version (!) of the FAT file system independently from the original FAT spec. This specific version encompasses a variant of the FAT32 on ESPs, and FAT16/FAT12 on removable media. ESP also provides space for a boot sector for backward BIOS compatibility.
Some features
MBR-based partition table schemes insert the partitioning info in the MBR. In a GPT, partition table info is stored in the GPT header, but to maintain compatibility, GPT retains the MBR entry as the first sector on the disk followed by a primary partition table header, the actual beginning of a GPT.
Like modern MBRs, GPTs use logical block addressing (LBA) in place of the historical cylinder-head-sector (CHS) addressing. Legacy MBR info is contained in LBA 0, the GPT header is in LBA 1, and the partition table itself follows. 64-bit Windows systems reserve 16,384 bytes (32 sectors) for the GPT, leaving LBA 34 as the first usable sector on the disk.
| Location in the HDD | Purpose |
|---|---|
| First logical sector of the disk (or first 512 bytes) | Protective MBR - Same as a normal MBR but the 64-byte area contains a single 0xEE type Primary partition entry defined over the entire size of the disk or in case of >2 TiB, upto a partition size of 2 TiB; |
| Second logical sector of the disk (or next 512 bytes) | Primary GPT Header - Contains the Unique Disk GUID, Location of the Primary Partition Table, Number of possible entries in partition table, CRC32 checksums of itself and the Primary Partition Table, Location of the Secondary (or Backup) GPT Header; |
| 16 KiB (by default) following the second logical sector of the disk | Primary GPT Table - 128 Partition entries (by default, can be higher), each with an entry of size 128 bytes (hence total of 16 KiB for 128 partition entries). Sector numbers are stored as 64-bit LBA and each partition has a Partition Type GUID and a Unique Partition GUID; |
| 16 KiB (by default) before the last logical sector of the disk | Secondary GPT table - It is byte-for-byte identical to the Primary table. Used mainly for recovery in case the primary partition table is damaged. |
| Last logical sector of the disk (or last 512 bytes) | Secondary GPT Header - Contains the Unique Disk GUID, Location of the Secondary Partition Table, Number of possible entries in the partition table, CRC32 checksums of itself and the Secondary Partition Table, Location of the Primary GPT Header. This header can be used to recover GPT info in case the primary header is corrupted. |
Note!
The copies of a partition table (secondary GPT table) and header (secondary GPT header) are kept at the end of the disk. Thus, GPT provides redundancy, writing the GPT header and partition table both at the beginning and at the end of the disk.
Protective MBR (Legacy MBR), LBA 0
A conventional GPT disk contains a protective MBR with a single partition, of type 0xEE (EFI GPT), defined. This partition spans the entire size of the disk or 2 TiB, whichever is smaller. The intent is to keep GPT-unaware OSes and utilities from trying to modify the disk.
A hybrid MBR is a variant on the normal protective MBR. A hybrid MBR contains a type-0xEE partition, but it also contains up to three additional primary partitions, which point to the same space that's marked out by up to three GPT partitions. Hybrid MBRs are normally needed only on BIOS-based computers, and should be avoided, when this is possible.
If the disk exceeds 2 TiB (the maximum partition size supported by the 32-bit LBAs of the legacy MBR, assuming a 512 byte block size), the size of this partition is marked as 2 TiB, ignoring the rest of disk.
Apple's Boot Camp Intel based Apple macs software creates a hybrid partition table to allow the booting of Windows (which at the time of Boot Camp's creation did not support GPT or EFI). In this system the protective partition is reduced in size to cover from sector 1 to the sector before the first regular partition included in the hybrid MBR. Additional MBR partitions are then defined to correspond to the next three GPT partitions.
Partition table header (LBA 1)
The partition table header defines the usable blocks on the disk. It also defines the number and size of the partition entries that make up the partition table. On 64-bit Windows Server 2003 machines, 128 partitions can be created. There are 128 partition entries reserved, each 128 bytes long. The EFI spec requires that a minimum of 16,384 bytes be reserved for the partition table, so this gives space for 128 partition entries.
The header contains the disk GUID (Globally Unique Identifier). It records its own size and location (always LBA 1) and the size and location of the secondary GPT header and table (always the last sectors on the disk). Importantly, it also contains a CRC32 checksum for itself and for the partition table, which may be verified by the firmware, bootloader and/or operating system on boot. Because of this, hex editors should not be used to modify the contents of the GPT. Such modification would render the checksum invalid. In this case, the primary GPT may be overwritten with the secondary one by disk recovery software. If both GPTs contain invalid checksums, the disk would be unusable.
| Offset, byte |
Len, byte |
Contents |
|---|---|---|
| 0 | 8 | Signature ("EFI PART", 45 46 49 20 50 41 52 54) |
| 8 | 4 | Revision; for GPT version 1.0 (through at least UEFI version 2.3.1), the value is 00 00 01 00 |
| 12 | 4 | Header size in little endian (in bytes, usually 5C 00 00 00 meaning 92 bytes) |
| 16 | 4 | CRC32 of header (0 to header size), with this field zeroed during calculation |
| 20 | 4 | Reserved; must be zero |
| 24 | 8 | Current LBA (location of this header copy) |
| 32 | 8 | Backup LBA (location of the other header copy) |
| 40 | 8 | First usable LBA for partitions (primary partition table last LBA + 1) |
| 48 | 8 | Last usable LBA (secondary partition table first LBA - 1) |
| 56 | 16 | Disk GUID (also referred as UUID on UNIXes) |
| 72 | 8 | Partition entries starting LBA (always 2 in primary copy) |
| 80 | 4 | Number of partition entries |
| 84 | 4 | Size of a partition entry (usually 128) |
| 88 | 4 | CRC32 of partition array |
| 92 | * | Reserved; must be zeroes for the rest of the block (420 bytes for a 512-byte LBA) |
Note!
Primary and secondary headers are not identical! For example, current and backup LBAs are different, CRCs may be different, etc. The values for current and backup LBAs of the primary header should be the second sector of the disk (1) and the last sector of the disk respectively. The secondary header at the end of the disk identifies its own table of partition entries (located just before that header).
Partition table entries (LBA 2–33)
The first 16 bytes designate the partition type GUID (see below). The second 16 bytes contain a GUID unique to the partition. Starting and ending 64-bit LBAs are also recorded here, and space is allocated for partition names and attributes. As is the nature and purpose of GUIDs, no central registry is needed to ensure the uniqueness of the GUID partition type designators.
| Offset | Len | Contents |
|---|---|---|
| 0 | 16 | Partition type GUID |
| 16 | 16 | Unique partition GUID |
| 32 | 8 | First LBA (little-endian) |
| 40 | 8 | Last LBA (inclusive, usually odd) |
| 48 | 8 | Attribute flags (e.g. bit 60 denotes read-only) |
| 56 | 72 | Partition name (36 UTF-16LE code units) |
| 128 | Total | |
According to Microsoft TechNet, attributes are divided into two halves: the lower 4 bytes representing partition independent attributes, and the upper 4 bytes are partition type dependent. Microsoft uses the following bits in general:
| Bit | Content |
|---|---|
| 0 | System partition (disk partitioning utilities must reserve the partition as is) |
| 2 | Legacy BIOS Bootable (equivalent to MBR 80h Active flag) |
| 60 | Read-only |
| 62 | Hidden |
| 63 | Do not automount (i.e., do not assign drive letter) |
Microsoft does not support EFI on 32-bit platforms, and by extension, does not allow booting from GPT partitions. Some versions, however, support GPT data disks with hybrid MBR.
Microsoft supports booting from GPT on EFI for following 64-bit IA-32 (aka x86-64, EM64T, x64) Windows versions:
- Windows Server 2008 (64-bit)
- Windows Vista SP1 (64-bit)
- Windows 7 (64-bit)
- Windows Server 2008 R2 (64-bit)
Other 64-bit versions support GPT data disks with hybrid MBR.
Linux (x86 / x86-64; since Fedora 8, Ubuntu 8.04), Mac OS X (x86 / x86-64; since 10.4.0), FreeBSD (x86 / x86-64; since 7.0) support booting from GPT on PC/BIOS and booting from GPT on EFI. Data disks are supported in most cases.
| OS | Par. type | Globally unique identifier |
|---|---|---|
| None | Unused entry | 00000000-0000- 0000-0000-000000000000 |
| None | MBR partition scheme | 024DEE41-33E7- 11D3-9D69-0008C781F39F |
| None | EFI System partition | C12A7328-F81F- 11D2-BA4B-00A0C93EC93B |
| None | BIOS Boot partition | 21686148-6449- 6E6F-744E-656564454649 |
| Windows | Microsoft Reserved Partition | E3C9E316-0B5C- 4DB8-817D-F92DF00215AE |
| Windows | Basic data partition | EBD0A0A2-B9E5- 4433-87C0-68B6B72699C7 |
| Windows | Logical Disk Manager metadata partition | 5808C8AA-7E8F- 42E0-85D2-E1E90434CFB3 |
| Windows | Logical Disk Manager data partition | AF9B60A0-1431- 4F62-BC68-3311714A69AD |
| Windows | Windows Recovery Environment | DE94BBA4-06D1- 4D40-A16A-BFD50179D6AC |
| Windows | IBM General Parallel File System (GPFS) par | 37AFFC90-EF7D- 4E96-91C3-2D7AE055B174 |
| Linux | Linux filesystem data | 0FC63DAF-8483- 4772-8E79-3D69D8477DE4 |
| Linux | RAID partition | A19D880F-05FC- 4D3B-A006-743F0F84911E |
| Linux | Swap partition | 0657FD6D-A4AB- 43C4-84E5-0933C84B4F4F |
| Linux | Logical Volume Manager (LVM) par | E6D6D379-F507- 44C2-A23C-238F2A3DF928 |
| Linux | Reserved | 8DA63339-0007- 60C0-C436-083AC8230908 |
The GUIDs in this table use a little-endian byte order.
Initially Linux did not have a separate partition type for its data
partitions, and used the same GUID for the data partitions as Windows.
This created problems when dual-booting Linux / Windows in UEFI-GPT setup.
The new GUID (Linux filesystem data) was defined jointly by GPT fdisk
and GNU Parted developers. GPT fdisk (gdisk) identifies
it as type 8300.