A sector is a unit of storage on a hard disk and is typically 512 bytes. Computers access certain sectors on a hard disk during startup to determine which operating system to start and where the partitions are located. The data stored on these sectors varies depending on the computer platform.
Computers that are x86-based begin the startup process from disks that contain a master boot record and are referred to as MBR disks. Itanium-based computers start up from disks that contain a GUID partition table and are referred to as GPT disks. MBR and GPT disks each have disk sectors critical to startup, but the differences in the sectors are not visible in the graphical user interface. Instead, you must use a disk-editing tool, such as DiskProbe, to see how the data on these sectors is structured. For more information about using DiskProbe, see DiskProbe earlier in this chapter.
Caution
The ability to edit and repair these sectors on a byte-by-byte basis after corruption has occurred is invaluable, but using a disk-editing tool requires a thorough understanding of how data is organized on the sectors. If you make a mistake, you can damage or permanently overwrite critical on-disk data structures that might make all data on a disk or volume permanently inaccessible. Therefore, it is a good idea to use the information in this chapter to learn about the sectors used for startup, and then to examine the sectors on your own disks to further your learning.
Disk Sectors on MBR Disks
The two sectors critical to starting x86-based computers are the following:
The master boot record (MBR), which is always located at sector 1 of cylinder 0, head 0, the first sector of a hard disk.
The boot sector, which resides at sector 1 of each volume.
These sectors contain both executable code and the data required to run the code.
Master Boot Record on Basic Disks
The MBR, the most important data structure on the disk, is created when the disk is partitioned. The MBR contains a small amount of executable code called the master boot code, the disk signature, and the partition table for the disk. At the end of the MBR is a 2-byte structure called a signature word or end of sector marker, which is always set to 0x55AA. A signature word also marks the end of an extended boot record (EBR) and the boot sector.
The disk signature, a unique number at offset 0x01B8, identifies the disk to the operating system. Windows XP Professional uses the disk signature as an index to store and retrieve disk information, such as drive letters, in the registry.
Master Boot Code
The master boot code performs the following activities:
Scans the partition table for the active partition.
Finds the starting sector of the active partition.
Loads a copy of the boot sector from the active partition into memory.
Transfers control to the executable code in the boot sector.
If the master boot code cannot complete these functions, the system displays a message similar to one of the following:
Floppy disks and removable disks, such as Iomega Zip disks, do not contain an MBR. The first sector on these disks is the boot sector. Although every hard disk contains an MBR, the master boot code is used only if the disk contains the active primary partition.
For more information about troubleshooting MBR problems, see Repairing Damaged MBRs and Boot Sectors in x86-based Computers earlier in this chapter.
Partition Table on Basic Disks
The partition table, which is a 64-byte data structure that is used to identify the type and location of partitions on a hard disk, conforms to a standard layout independent of the operating system. Each partition table entry is 16 bytes long, with a maximum of four entries. Each entry starts at a predetermined offset from the beginning of the sector, as follows:
Partition 1 0x01BE (446)
Partition 2 0x01CE (462)
Partition 3 0x01DE (478)
Partition 4 0x01EE (494)
The following example shows a partial printout of an MBR revealing the partition table from a computer with three partitions. When there are fewer than four partitions on a disk, the remaining partition table fields are set to the value 0.
Figure 26-5 provides an example of how to interpret the sector printout of the partition table by using Table 26-7. The Boot indicator, System ID, Relative sectors, and Total sectors values correspond to Table 26-7.
Figure 26-5: Interpreting data in the partition table
Table 26-7 describes the fields in each entry in the partition table. The sample values correspond to the first partition table entry shown in this example. The Byte Offset values correspond to the addresses of the first partition table entry. There are three additional entries whose values can be calculated by adding 10h to the byte offset value specific for each additional partition table entry (for example, add 20h for partition table entry 3 and 30h for partition table entry 4).
The subsections that follow Table 26-7 provide additional detail about these fields.
Table 26-7: Partition Table Fields
Byte Offset
Field Length
Sample Value*
Field Name and Definition
0x01BE
1 byte
0x80
Boot Indicator. Indicates whether the volume is the active partition. Legal values include:
00. Do not use for booting.
80. Active partition.
0x01BF
1 byte
0x01
Starting Head.
0x01C0
6 bits
0x01
Starting Sector. Only bits 0 5 are used. The upper two bits, 6 and 7, are used by the Starting Cylinder field.
0x01C1
10 bits
0x00
Starting Cylinder. Uses 1 byte in addition to the upper 2 bits from the Starting Sector field to make up the cylinder value. The Starting Cylinder is a 10-bit number that has a maximum value of 1023.
0x01C2
1 byte
0x07
System ID. Defines the volume type. See Table 26-8 for sample values.
0x01C3
1 byte
0xFE
Ending Head.
0x01C4
6 bits
0xBF
Ending Sector. Only bits 0 5 are used. The upper two bits, 6 and 7, are used by the Ending Cylinder field.
0x01C5
10 bits
0x09
Ending Cylinder. Uses 1 byte in addition to the upper 2 bits from the Ending Sector field to make up the cylinder value. The Ending Cylinder is a 10-bit number, with a maximum value of 1023.
0x01C6
4 bytes
0x3F000000
Relative Sectors. The offset from the beginning of the disk to the beginning of the volume, counting by sectors.
0x01CA
4 bytes
0x4BF57F00
Total Sectors. The total number of sectors in the volume.
*Numbers larger than one byte are stored in little endian format, or reverse-byte ordering. Little endian format is a method of storing a number so that the least significant byte appears first in the hexadecimal number notation. For example, the sample value for the Relative Sectors field in the previous table, 0x3F000000, is a little endian representation of 0x0000003F. The decimal equivalent of this little endian number is 63.
+This value does not accurately represent the value of the fields, because the fields are either 6 bits or 10 bits and the data is recorded in bytes.
Boot Indicator Field
The first element of the partition table, the Boot Indicator field, indicates whether the volume is the active partition. Only one primary partition on the disk can have this field set. See Table 26-7 for the legal values.
It is possible to have different operating systems and different file systems on different volumes. By using disk configuration tools, such as the Windows XP Professional based Disk Management and DiskPart, or the MS DOS-based Fdisk to designate a primary partition as active, the Boot Indicator field for that partition is set in the partition table.
System ID Field
Another element of the partition table is the System ID field. It defines which file system, such as FAT16, FAT32, or NTFS, was used to format the volume. The System ID field also identifies an extended partition, if one is defined. Windows XP Professional uses the System ID field to determine which file system device drivers to load during startup. Table 26-8 identifies the values for the System ID field.
Table 26-8: System ID Values
Partition Type
ID Value
0x01
FAT12 primary partition or logical drive (fewer than 32,680 sectors in the volume)
0x04
FAT16 partition or logical drive (32,680 65,535 sectors or 16 MB 33 MB)
0x05
Extended partition
0x06
BIGDOS FAT16 partition or logical drive (33 MB 4 GB)
0x07
Installable File System (NTFS partition or logical drive)
0x0B
FAT32 partition or logical drive
0x0C
FAT32 partition or logical drive using BIOS INT 13h extensions
0x0E
BIGDOS FAT16 partition or logical drive using BIOS INT 13h extensions
0x0F
Extended partition using BIOS INT 13h extensions
0x12
EISA partition or OEM partition
0x42
Dynamic volume
0x84
Power management hibernation partition
0x86
Multidisk FAT16 volume created by using Windows NT 4.0
0x87
Multidisk NTFS volume created by using Windows NT 4.0
0xA0
Laptop hibernation partition
0xDE
Dell OEM partition
0xFE
IBM OEM partition
0xEE
GPT partition
0xEF
EFI System partition on an MBR disk
Windows XP Professional does not support multidisk volumes that are created by using Windows NT 4.0 and earlier, and that use System ID values 0x86, 0x87, 0x8B, or 0x8C.
If you are upgrading from Windows NT Workstation 4.0 to Windows XP Professional, you must first back up and then delete all multidisk volumes before you upgrade. After you complete the upgrade, create dynamic volumes and restore the data . If you do not delete the multidisk volumes before beginning Setup, you must use the Ftonline tool, which is part of Windows Support Tools, to access the volume after Setup completes. For more information about using Ftonline.exe, click Tools in Help and Support Center, and then click Windows Support Tools.
If you are upgrading from Windows 2000 to Windows XP Professional, you must convert the multidisk volumes to dynamic before you begin Setup, or Setup does not continue. For more information about multidisk volumes and Setup, see Disk Management in this book.
MS DOS can only access volumes that have a System ID value of 0x01, 0x04, 0x05, or 0x06. However, you can delete volumes that have the other values listed in Table 26-8 by using Disk Management, DiskPart, or the MS DOS tool Fdisk.
Starting and Ending Cylinder, Head, and Sector Fields
The Starting and Ending Cylinder, Head, and Sector fields (collectively known as the CHS fields) are additional elements of the partition table. These fields are essential for starting the computer. The master boot code uses these fields to find and load the boot sector of the active partition. The Starting CHS fields for non-active partitions point to the boot sectors of the remaining primary partitions and the extended boot record (EBR) of the first logical drive in the extended partition, as shown in Figure 26-6.
Knowing the starting sector of an extended partition is very important for low-level disk troubleshooting. If your disk fails, you need to work with the partition starting point (among other factors) to retrieve stored data.
The Ending Cylinder field in the partition table is 10 bits long, which limits the number of cylinders that can be described in the partition table to a range of 0 through 1,023. The Starting Head and Ending Head fields are each one byte long, which limits the field range from 0 through 255. The Starting Sector and Ending Sector fields are each six bits long, which limits the range of these fields from 0 through 63. However, the enumeration of sectors starts at 1 (not 0, as for other fields), so the maximum number of sectors per track is 63.
Because all hard disks are low-level formatted with a standard 512-byte sector, the maximum disk capacity described by the partition table is calculated as follows:
Maximum capacity = sector size x cylinders (10 bits) x heads (8 bits) x sectors per track (6 bits)
Using the maximum possible values yields:
512 x 1024 x 256 x 63 (or 512 x 224) = 8,455,716,864 bytes or 7.8 GB
Windows XP Professional and other Windows-based operating systems that support BIOS INT 13h extensions can access partitions that exceed the first 7.8 GB of the disk by ignoring the Starting and Ending CHS fields in favor of the Relative Sectors and Total Sectors fields.
Windows 2000 and Windows XP Professional ignore the Starting and Ending CHS fields regardless of whether the partition exceeds the first 7.8 GB of the disk. However, Windows XP Professional must place the appropriate values in the Starting and Ending CHS fields because Windows 95, Windows 98, and Windows Me (which all support BIOS INT 13h extensions) use the Starting and Ending CHS fields if the partition does not exceed the first 7.8 GB of the disk. These fields are also required to maintain compatibility with the BIOS INT 13h for startup.
MS DOS and other Windows operating systems that do not support BIOS INT 13h extensions ignore partitions that exceed the 7.8 GB boundary because these partitions use a System ID that is recognized only by operating systems that support BIOS INT 13h extensions.
Both the operating system and the computer must support BIOS INT 13h extensions if you want to create partitions that exceed the first 7.8 GB of the disk.
Relative Sectors and Total Sectors Fields
The Relative Sectors field represents the offset from the beginning of the disk to the beginning of the volume, counting by sectors, for the volume described by the partition table entry. The Total Sectors field represents the total number of sectors in the volume.
Using the Relative Sectors and Total Sectors fields (resulting in a 32-bit number) provides eight more bits than the CHS scheme to represent the total number of sectors. This allows you to create partitions that contain up to 232 sectors. With a standard sector size of 512 bytes, the 32 bits used to represent the Relative Sectors and Total Sectors fields translates into a maximum partition size of 2 terabytes (or 2,199,023,255,552 bytes).
Figure 26-6 shows the MBR, partition table, and boot sectors on a basic disk with four partitions. The definitions of the fields in the partition table and the extended partition tables are the same.
Figure 26-6: Detail of a basic disk with four partitions
Note
For more information about the maximum partition size that each file system supports, see File Systems in this book.
Extended Boot Record on Basic Disks
An EBR, which consists of an extended partition table and the signature word for the sector, exists for each logical drive in the extended partition. It contains the only information on the first side of the first cylinder of each logical drive in the extended partition. The boot sector in a logical drive is usually located at either Relative Sector 32 or 63. However, if there is no extended partition on a disk, there are no EBRs and no logical drives.
The first entry in an extended partition table for the first logical drive points to its own boot sector. The second entry points to the EBR of the next logical drive. If no further logical drives exist, the second entry is not used and is recorded as a series of zeros. If there are additional logical drives, the first entry of the extended partition table for the second logical drive points to its own boot sector. The second entry of the extended partition table for the second logical drive points to the EBR of the next logical drive. The third and fourth entries of an extended partition table are never used.
As shown in Figure 27-7, the EBRs of the logical drives in the extended partition are a linked list. The figure shows three logical drives on an extended partition, illustrating the difference in extended partition tables between preceding logical drives and the last logical drive.
Figure 26-7: Detail of an extended partition on a basic disk
With the exception of the last logical drive on the extended partition, the format of the extended partition table, which is described in Table 26-9, is repeated for each logical drive: the first entry identifies the logical drive s own boot sector and the second entry identifies the next logical drive s EBR. The extended partition table for the last logical drive has only its own partition entry listed. The second through fourth entries of the last extended partition table are not used.
Table 26-9: Contents of Extended Partition Table Entries
Entry
Entry Contents
First
Information about the current logical drive in the extended partition, including the starting address for data.
Second
Information about the next logical drive in the extended partition, including the address of the sector that contains the EBR for the next logical drive. If no additional logical drives exist, this field is not used.
Third
Not used.
Fourth
Not used.
The fields in each entry of the extended partition table are identical to the MBR partition table entries. See Table 26-7 for more information about partition table fields.
The Relative Sectors field in an extended partition table entry shows the number of bytes that are offset from the beginning of the extended partition to the first sector in the logical drive. The number in the Total Sectors field refers to the number of sectors that make up the logical drive. The value of the Total Sectors field equals the number of sectors from the boot sector defined by the extended partition table entry to the end of the logical drive.
Because of the importance of the MBR and EBR sectors, it is recommended that you run disk-scanning tools regularly and that you regularly back up all your data files to protect against losing access to a volume or an entire disk.
Master Boot Record on Dynamic Disks
Like basic disks, dynamic disks contain an MBR that includes the master boot code, the disk signature, and the partition table for the disk. However, the partition table on a dynamic disk does not contain an entry for each volume on the disk because volume information is stored in the dynamic disk database. Instead, the partition table contains entries for the system volume, boot volume (if it is not the same as the system volume), and one or more additional partitions that cover all the remaining unallocated space on the disk. All these partitions use System ID 0x42, which indicates that these partitions are on a dynamic disk. Placing these partitions in the partition table prevents MBR-based disk utilities from interpreting the space as available for new partitions.
Note
In Windows 2000, the partition entries for existing basic volumes were preserved in the partition table when the disk was converted to dynamic. These entries prevented the converted dynamic volumes from being extended. This limitation has been removed from Windows XP Professional for all converted volumes except the boot and system volumes. Partition entries for all other converted volumes are removed from the partition table, and therefore these volumes can be extended.
The following example shows a partial printout of an MBR on a dynamic disk that contains four simple volumes: the system volume, the boot volume, and two data volumes. The first entry is the system volume, which is marked as active. The second entry is the boot volume, and the third entry is the container volume for all other simple volumes on the disk. All entries are type 0x42, which specifies dynamic volumes.
000001B0: 80 01 .....,Dc!.!..... 000001C0: 01 00 42 FE 7F 04 3F 00 - 00 00 86 FA 3F 00 00 00 ..B...?.....?... 000001D0: 41 05 42 FE FF 02 C5 FA - 3F 00 7E 04 7D 00 00 00 A.B.....?.~.}... 000001E0: C1 03 42 FE FF FF 43 FF - BC 00 58 53 54 00 00 00 ..B...C...XST... 000001F0: 00 00 00 00 00 00 00 00 - 00 00 00 00 00 00 55 AA ..............U.
Boot Sectors on MBR Disks
The boot sector, which is located at sector 1 of each volume, is a critical disk structure for starting your computer. It contains executable code and the data required by the code, including information that the file system uses to access the volume. The boot sector is created when you format a volume. At the end of the boot sector is a 2-byte structure called a signature word or end of sector marker, which is always set to 0x55AA. On computers running Windows XP Professional, the boot sector on the active partition loads into memory and starts Ntldr, which loads the boot menu if multiple versions of Windows are installed or loads the operating system if only one operating system is installed.
A boot sector consists of the following elements:
An x86-based CPU jump instruction.
The original equipment manufacturer identification (OEM ID).
The BIOS parameter block (BPB), a data structure.
The extended BPB.
The executable boot code (or bootstrap code) that starts the operating system.
All Windows XP Professional boot sectors contain the preceding elements regardless of the type of disk (basic disk or dynamic disk).
Note
Disk editing tools such as DiskProbe and third-party tools that work with Windows NT 4.0 and NTFS might not support FAT32 boot sectors and volumes.
The BPB describes the physical parameters of the volume: the extended BPB begins immediately after the BPB. Due to differing types of fields and the amount of data they contain, the length of the BPB is different for FAT16, FAT32, and NTFS boot sectors.
Disk device drivers use the information in the BPB and the extended BPB to read and configure volumes. The area following the extended BPB typically contains executable boot code, which performs the actions necessary to continue the startup process.
Boot Sector Startup Processes
Computers use the boot sector to run instructions during startup. The initial startup process is summarized in the following steps:
The system BIOS and the CPU initiate the power-on self test (POST).
The BIOS finds the boot device, which is typically the first disk the BIOS finds, unless the controller is configured to boot from a different disk.
The BIOS loads the first physical sector of the boot device into memory and transfers CPU execution to that memory address.
If the boot device is on a hard disk, the BIOS loads the MBR. The master boot code in the MBR loads the boot sector of the active partition, and transfers CPU execution to that memory address. On computers that are running Windows XP Professional, the executable boot code in the boot sector finds Ntldr, loads it into memory, and transfers execution to that file.
Note
Windows XP Professional cannot start up from a spanned or striped volume on dynamic disks. These disk structures cannot be registered into the MBR partition table; therefore, a system volume that uses these structures cannot start.
If drive A contains a floppy disk, the system BIOS loads the first sector (the boot sector) of the disk into memory. If the disk is a startup disk (formatted by MS DOS with core operating system files applied), the boot sector loads into memory and uses the executable boot code to transfer CPU execution to Io.sys, a core MS DOS operating system file. If the floppy disk is not a startup disk, the executable boot code displays a message such as the following:
Non-system disk or disk error. Replace and press any key when ready.
Note
These messages do not appear on normally functioning systems that are configured to look for the startup files on drive C first. On many computers, an option in the CMOS setup program allows the user to set the sequence of installed disks that the system searches to find the startup files.
If you get similar errors when trying to start the computer from the hard disk, the boot sector might be corrupted. For more information about troubleshooting boot sector problems, see Repairing Damaged MBRs and Boot Sectors in x86-based Computers earlier in this chapter.
Initially, the startup process is independent of disk format and operating system. The unique characteristics of operating and file systems become important when the boot sector s executable boot code starts.
Components of a Boot Sector
The MBR transfers CPU execution to the boot sector, so the first three bytes of the boot sector must be valid, executable x86-based CPU instructions. This includes a jump instruction that skips the next several nonexecutable bytes.
Following the jump instruction is the 8-byte OEM ID, a string of characters that identifies the name and version number of the operating system that formatted the volume. To preserve compatibility with MS DOS, Windows XP Professional records MSDOS5.0 in this field on FAT16 and FAT32 disks. On NTFS disks, Windows XP Professional records NTFS.
Note
You might also see the OEM ID MSWIN4.0 on disks formatted by Windows 95 and MSWIN4.1 on disks formatted by Windows 95 OEM Service Release 2 (OSR2), Windows 98, and Windows Me. Windows XP Professional does not use the OEM ID field in the boot sector except for verifying NTFS volumes.
Following the OEM ID is the BPB, which provides information that enables the executable boot code to locate Ntldr. The BPB always starts at the same offset, so standard parameters are in a known location. Disk size and geometry variables are encapsulated in the BPB. Because the first part of the boot sector is an x86 jump instruction, the BPB can be extended in the future by appending new information at the end. The jump instruction needs only a minor adjustment to accommodate this change. The BPB is stored in a packed (unaligned) format.
FAT16 Boot Sector
Table 26-10 describes the boot sector of a volume formatted with the FAT16 file system.
Table 26-10: Boot Sector Sections on a FAT16 Volume
Byte Offset
Field Length
Field Name
0x00
3 bytes
Jump instruction
0x03
8 bytes
OEM ID
0x0B
25 bytes
BPB
0x24
26 bytes
Extended BPB
0x3E
448 bytes
Bootstrap code
0x01FE
2 bytes
End of sector marker
The following example illustrates a hexadecimal printout of the boot sector on a FAT16 volume. The printout is formatted in three sections:
Bytes 0x00 0x0A are the jump instruction and the OEM ID (shown in bold print).
Bytes 0x0B 0x3D are the BPB and the extended BPB.
The remaining section is the bootstrap code and the end of sector marker (shown in bold print).
Tables 26-11 and 26-12 illustrate the layout of the BPB and the extended BPB for FAT16 volumes. The sample values correspond to the data in this example.
Table 26-11: BPB Fields for FAT16 Volumes
Byte Offset
Field Length
Sample Value
Field Name and Definition
0x0B
2 bytes
0x0002
Bytes Per Sector. The size of a hardware sector. Valid decimal values for this field are 512, 1024, 2048, and 4096. For most disks used in the United States, the value of this field is 512.
0x0D
1 byte
0x40
Sectors Per Cluster. The number of sectors in a cluster. Because FAT16 can track only a limited number of clusters (up to 65,524), FAT16 supports large volumes by increasing the number of sectors per cluster. The default cluster size for a volume depends on the volume size. Valid decimal values for this field are 1, 2, 4, 8, 16, 32, 64, and 128.
0x0E
2 bytes
0x0100
Reserved Sectors. The number of sectors that precede the start of the first FAT, including the boot sector. The value of this field is typically 1.
0x10
1 byte
0x02
Number of FATs. The number of copies of the FAT on the volume. The value of this field is typically 2.
0x11
2 bytes
0x0002
Root Entries. The total number of 32-byte file and folder name entries that can be stored in the root folder of the volume. On a typical hard disk, the value of this field is 512. One entry can be used as a volume label, and files and folders with long names use multiple entries per file. The largest number of file and folder entries is typically 511; however, if long file names are used, entries usually run out before you reach that number.
0x13
2 bytes
0x0000
Small Sectors. The number of sectors on the volume represented in 16 bits (< 65,536). For volumes larger than 65,536 sectors, this field has a value of zero and the Large Sectors field is used instead.
0x15
1 byte
0xF8
Media Descriptor. Provides information about the media being used. A value of 0xF8 indicates a hard disk and 0xF0 indicates a high-density 3.5-inch floppy disk. Media descriptor entries are a legacy of MS DOS FAT16 and FAT12 disks and are not used in Windows XP Professional.
0x16
2 bytes
0xFC00
Sectors Per FAT. The number of sectors occupied by each FAT on the volume. The computer uses this number and the number of FATs and reserved sectors to determine where the root directory begins. The computer can also determine where the user data area of the volume begins based on the number of entries in the root directory (512).
0x18
2 bytes
0x3F00
Sectors Per Track. Part of the apparent disk geometry used on a low-level formatted disk.
0x1A
2 bytes
0x4000
Number of Heads. Part of the apparent disk geometry used on a low-level formatted disk.
0x1C
4 bytes
0x3F000000
Hidden Sectors. The number of sectors on the volume before the boot sector. This value is used during the boot sequence to calculate the absolute offset to the root directory and data areas.
0x20
4 bytes
0x01F03E0 0
Large Sectors. If the value of the Small Sectors field is zero, this field contains the total number of sectors in the FAT16 volume. If the value of the Small Sectors field is not zero, the value of this field is zero.
Table 26-12: Extended BPB Fields for FAT16 Volumes
Byte Offset
Field Length
Sample Value
Field Name and Definition
0x24
1 byte
0x80
Physical Drive Number. Related to the BIOS physical drive number. Floppy drives are identified as 0x00 and physical hard disks are identified as 0x80, regardless of the number of physical disk drives. Typically, this value is set prior to issuing an INT 13h BIOS call to specify the device to access. This value is only relevant if the device is a boot device.
0x25
1 byte
0x00
Reserved. FAT16 volumes are always set to zero.
0x26
1 byte
0x29
Extended Boot Signature. A field that must have the value 0x28 or 0x29 to be recognized by Windows XP Professional.
0x27
4 bytes
0xA88B3652
Volume Serial Number. A random serial number that is created when a volume is formatted and that helps to distinguish between disks.
0x2B
11 bytes
NO NAME
Volume Label. A field that was once used to store the volume label. The volume label is now stored as a special file in the root directory.
0x36
8 bytes
FAT16
Not used by Windows XP Professional.
FAT32 Boot Sector
The FAT32 boot sector is structurally very similar to the FAT16 boot sector, but the FAT32 BPB contains additional fields. The FAT32 extended BPB uses the same fields as FAT16, but the offset addresses of these fields within the boot sector are different than those found in FAT16 boot sectors. Volumes formatted in FAT32 are not readable by operating systems that are incompatible with FAT32.
Table 26-13 describes the boot sector of a volume formatted with the FAT32 file system.
Table 26-13: Boot Sector Sections on a FAT32 Volume
Byte Offset
Field Length
Field Name
0x00
3 bytes
Jump instruction
0x03
8 bytes
OEM ID
0x0B
53 bytes
BPB
0x40
26 bytes
Extended BPB
0x5A
420 bytes
Bootstrap code
0x01FE
2 bytes
End of sector marker
The following example illustrates a hexadecimal printout of the boot sector on a FAT32 volume. The printout is formatted in three sections:
Bytes 0x00 0x0A are the jump instruction and the OEM ID (shown in bold print).
Bytes 0x0B 0x59 are the BPB and the extended BPB.
The remaining section is the bootstrap code and the end of sector marker (shown in bold print).
Tables 26-14 and 26-15 illustrate the layout of the BPB and the extended BPB for FAT32 volumes. The sample values correspond to the data in this example.
Table 26-14: BPB Fields for FAT32 Volumes
Byte Offset
Field Length
Sample Value
Field Name and Definition
0x0B
2 bytes
0x0002
Bytes Per Sector. The size of a hardware sector. Valid decimal values for this field are 512, 1024, 2048, and 4096. For most disks used in the United States, the value of this field is 512.
0x0D
1 byte
0x10
Sectors Per Cluster. The number of sectors in a cluster. The default cluster size for a volume depends on the volume size. Valid decimal values for this field are 1, 2, 4, 8, 16, 32, 64, and 128. The Windows XP Professional implementation of FAT32 allows for creation of volumes up to a maximum of 32 GB. However, larger volumes created by other operating systems (Windows 95 OSR2 and later) are accessible in Windows XP Professional.
0x0E
2 bytes
0x2400
Reserved Sectors. The number of sectors that precede the start of the first FAT, including the boot sector.
0x10
1 byte
0x02
Number of FATs. The number of copies of the FAT on the volume. The value of this field is always 2.
0x11
2 bytes
0x0000
Root Entries (FAT12/FAT16 only). For FAT32 volumes, this field must be set to zero.
0x13
2 bytes
0x0000
Small Sectors (FAT12/FAT16 only). For FAT32 volumes, this field must be set to zero.
0x15
1 byte
0xF8
Media Descriptor. Provides information about the media being used. A value of 0xF8 indicates a hard disk and 0xF0 indicates a high-density 3.5-inch floppy disk. Media descriptor entries are a legacy of MS DOS FAT16 disks and are not used in Windows XP Professional.
0x16
2 bytes
0x0000
Sectors Per FAT (FAT12/FAT16 only). For FAT32 volumes, this field must be set to zero.
0x18
2 bytes
0x3F00
Sectors Per Track. Contains the sectors per track geometry value for disks that use INT 13h. The volume is broken down into tracks by multiple heads and cylinders.
0x1A
2 bytes
0xFF00
Number of Heads. Contains the count of heads geometry value for disks that use INT 13h. For example, on a 1.44-MB, 3.5-inch floppy disk this value is 2.
0x1C
4 bytes
0x3F000000
Hidden Sectors. The number of sectors on the volume before the boot sector. This value is used during the boot sequence to calculate the absolute offset to the root directory and data areas. This field is generally only relevant for media that are visible on interrupt 13h. It must always be zero on media that are not partitioned.
0x20
4 bytes
0x1D911101
Large Sectors. Contains the total number of sectors in the FAT32 volume.
0x24
4 bytes
0x2A220000
Sectors Per FAT (FAT32 only). The number of sectors occupied by each FAT on the volume. The computer uses this number and the number of FATs and reserved sectors (described in this table) to determine where the root directory begins. The computer can also determine where the user data area of the volume begins based on the number of entries in the root directory.
0x28
2 bytes
0x0000
Not used by Windows XP Professional.
0x2A
2 bytes
0x0000
File System Version (FAT32 only). The high byte is the major revision number; the low byte is the minor revision number. This field supports the ability to extend the FAT32 media type in the future with concern for old FAT32 drivers mounting the volume. Both bytes are zero in Windows XP Professional, Windows 2000, and Windows Me and earlier.
0x2C
4 bytes
0x02000000
Root Cluster Number (FAT32 only). The cluster number of the first cluster of the root directory. This value is typically, but not always, 2.
0x30
2 bytes
0x0100
File System Information Sector Number (FAT32 only). The sector number of the File System Information (FSINFO) structure in the reserved area of the FAT32 volume. The value is typically 1. A copy of the FSINFO structure is kept in the Backup Boot Sector, but it is not kept up-to-date.
0x32
2 bytes
0x0600
Backup Boot Sector (FAT32 only). A value other than zero specifies the sector number in the reserved area of the volume where a copy of the boot sector is stored. The value of this field is typically 6. No other value is recommended.
0x34
12 bytes
0x000000000000000000000000
Reserved (FAT32 only). Reserved space for future expansion. The value of this field must always be zero.
Table 26-15: Extended BPB Fields for FAT32 Volumes
Byte Offset
Field Length
Sample Value
Field Name and Definition
0x40
1 byte
0x80
Physical Drive Number. Related to the BIOS physical drive number. Floppy drives are identified as 0x00 and physical hard disks are identified as 0x80, regardless of the number of physical disk drives. Typically, this value is set prior to issuing an INT 13h BIOS call to specify the device to access. This value is only relevant if the device is a boot device.
0x41
1 byte
0x00
Reserved. FAT32 volumes are always set to zero.
0x42
1 byte
0x29
Extended Boot Signature. A field that must have the value 0x28 or 0x29 to be recognized by Windows XP Professional.
0x43
4 bytes
0xF19E5E5E
Volume Serial Number. A random serial number that is created when a volume is formatted and that helps to distinguish between disks.
0x47
11 bytes
NO NAME
Volume Label. A field that was once used to store the volume label. The volume label is now stored as a special file in the root directory.
0x52
8 bytes
FAT32
System ID. A text field with a value of FAT32.
NTFS Boot Sector
Table 26-16 describes the boot sector of a volume that is formatted with NTFS. When you format an NTFS volume, the format program allocates the first 16 sectors for the boot sector and the bootstrap code.
Table 26-16: Boot Sector Sections on an NTFS Volume
Byte Offset
Field Length
Field Name
0x00
3 bytes
Jump instruction
0x03
8 bytes
OEM ID
0x0B
25 bytes
BPB
0x24
48 bytes
Extended BPB
0x54
426 bytes
Bootstrap code
0x01FE
2 bytes
End of sector marker
On NTFS volumes, the data fields that follow the BPB form an extended BPB. The data in these fields enables Ntldr to find the master file table (MFT) during startup. On NTFS volumes, the MFT is not located in a predefined sector, as on FAT16 and FAT32 volumes. For this reason, NTFS can move the MFT if there is a bad sector in the current location of the MFT. However, if the data is corrupted, the MFT cannot be located, and Windows XP Professional assumes that the volume has not been formatted.
The following example illustrates the boot sector of an NTFS volume that is formatted by using Windows XP Professional. The printout is formatted in three sections:
Bytes 0x00 0x0A are the jump instruction and the OEM ID (shown in bold print).
Bytes 0x0B 0x53 are the BPB and the extended BPB.
The remaining code is the bootstrap code and the end of sector marker (shown in bold print).
Table 26-17 describes the fields in the BPB and the extended BPB on NTFS volumes. The fields starting at 0x0B, 0x0D, 0x15, 0x18, 0x1A, and 0x1C match those on FAT16 and FAT32 volumes. The sample values correspond to the data in this example.
Table 26-17: BPB and Extended BPB Fields on NTFS Volumes
Byte Offset
Field Length
Sample Value
Field Name and Definition
0x0B
2 bytes
0x0002
Bytes Per Sector. The size of a hardware sector. For most disks used in the United States, the value of this field is 512.
0x0D
1 byte
0x08
Sectors Per Cluster. The number of sectors in a cluster.
0x0E
2 bytes
0x0000
Reserved Sectors. Always 0 because NTFS places the boot sector at the beginning of the partition. If the value is not 0, NTFS fails to mount the volume.
0x10
3 bytes
0x000000
Value must be 0 or NTFS fails to mount the volume.
0x13
2 bytes
0x0000
Value must be 0 or NTFS fails to mount the volume.
0x15
1 byte
0xF8
Media Descriptor. Provides information about the media being used. A value of 0xF8 indicates a hard disk and 0xF0 indicates a high-density 3.5-inch floppy disk. Media descriptor entries are a legacy of MS DOS FAT16 disks and are not used in Windows XP Professional.
0x16
2 bytes
0x0000
Value must be 0 or NTFS fails to mount the volume.
0x18
2 bytes
0x3F00
Not used or checked by NTFS.
0x1A
2 bytes
0xFF00
Not used or checked by NTFS.
0x1C
4 bytes
0x3F000000
Not used or checked by NTFS.
0x20
4 bytes
0x00000000
The value must be 0 or NTFS fails to mount the volume.
0x24
4 bytes
0x80008000
Not used or checked by NTFS.
0x28
8 bytes
0x1C91110100000000
Total Sectors. The total number of sectors on the hard disk.
0x30
8 bytes
0x0000040000000000
Logical Cluster Number for the File $MFT. Identifies the location of the MFT by using its logical cluster number.
0x38
8 bytes
0x1119110000000000
Logical Cluster Number for the File $MFTMirr. Identifies the location of the mirrored copy of the MFT by using its logical cluster number.
0x40
1 byte
0xF6
Clusters Per MFT Record. The size of each record. NTFS creates a file record for each file and a folder record for each folder that is created on an NTFS volume. Files and folders smaller than this size are contained within the MFT. If this number is positive (up to 0x7F), then it represents clusters per MFT record. If the number is negative (0x80 to 0xFF), then the size of the file record is 2 raised to the absolute value of this number.
0x41
3 bytes
0x000000
Not used by NTFS.
0x44
1 byte
0x01
Clusters Per Index Buffer. The size of each index buffer, which is used to allocate space for directories. If this number is positive (up to 0x7F), then it represents clusters per MFT record. If the number is negative (0x80 to 0xFF), then the size of the file record is 2 raised to the absolute value of this number.
0x45
3 bytes
0x000000
Not used by NTFS.
0x48
8 bytes
0x3AB27B82CD7B8214
Volume Serial Number. The volume s serial number.
0x50
4 bytes
0x00000000
Not used by NTFS.
Protecting the Boot Sector
Because a functioning system relies on the boot sector to access a volume, it is highly recommended that you run Chkdsk when needed and back up all your data files regularly to protect against data loss if you lose access to a volume. For more information about Chkdsk, see Chkdsk earlier in this chapter. For more information about repairing boot sectors, see Replacing the Boot Sector earlier in this chapter.
Disk Sectors on GPT Disks
GPT uses primary and backup partition structures to provide redundancy. These structures are located at the beginning and the end of the disk. GPT identifies these structures by their logical block address (LBA) rather than by their relative sectors. Using this scheme, sectors on a disk are numbered from 0 to n-1, where n is the number of sectors on the disk.
As shown in Figure 26-8, the first structure on a GPT disk is the Protective MBR in LBA 0, followed by the primary GUID partition table (GPT) header in LBA 1. The GPT header is followed by the primary GUID partition entry array, which includes a partition entry for each partition on the disk.
Partitions on the disk are located between the primary and backup GUID partition entry arrays. The partitions must be placed within the first usable and last usable LBAs, as specified in the GPT partition header.
Figure 26-8: Partition structures on a GPT disk
Protective MBR
The Extensible Firmware Interface (EFI) specification requires that LBA 0 be reserved for compatibility code and a Protective MBR. The Protective MBR has the same format as an existing MBR, and it contains one partition entry with a System ID value of 0xEE. This entry reserves the entire space of the disk, including the space used by the GPT header, as a single partition. The Protective MBR is included to prevent disk utilities that were designed for MBR disks from interpreting the disk as having available space and overwriting GPT partitions. The Protective MBR is ignored by EFI; no MBR code is executed.
The following example shows a partial printout of a Protective MBR.
Table 26-18 describes the fields in each entry in the Protective MBR.
Table 26-18: Protective MBR in GPT Disks
Byte Offset
Field Length
Sample Value*
Field Name and Definition
0x01BE
1 byte
0x00
Boot Indicator. Must be set to 0x00 to indicate that this partition cannot be booted.
0x01BF
1 byte
0x00
Starting Head. Matches the Starting LBA of the single partition.
0x01C0
1 byte
0x02
Starting Sector. Matches the Starting LBA of the single partition.
0x01C1
1 byte
0x00
Starting Cylinder. Matches the Starting LBA of the GPT partition.
0x01C2
1 byte
0xEE
System ID. Must be 0xEE to specify that the single partition is a GPT partition. If you move a GPT disk to a computer running Windows 2000 with Service Pack 1 or greater or Windows XP Professional, the partition is displayed as a GPT Protective Partition and cannot be deleted.
0x01C3
1 byte
0xFF
Ending Head. Matches the Ending LBA of the single partition. If the Ending LBA is too large to be represented here, this field is set to 0xFF.
0x01C4
1 byte
0xFF
Ending Sector. Matches the Ending LBA of the single partition. If the Ending LBA is too large to be represented here, this field is set to 0xFF.
0x01C5
1 byte
0xFF
Ending Cylinder. Matches the Ending LBA of the single partition. If the Ending LBA is too large to be represented here, this field is set to 0xFF.
0x01C6
4 bytes
0x01000000
Starting LBA. Always set to 1. The Starting LBA begins at the GPT partition table header, which is located at LBA 1.
0x01CA
4 bytes
0xFFFFFFF F
Size in LBA. The size of the single partition. Must be set to 0xFFFFFFFF if this value is too large to be represented here.
*Numbers larger than one byte are stored in little endian format, or reverse-byte ordering. Little endian format is a method of storing a number so that the least significant byte appears first in the hexadecimal number notation.
GPT Partition Table Header
The GPT header defines the range of logical block addresses that are usable by partition entries. The GPT header also defines its location on the disk, its GUID, and a 32-bit cyclic redundancy check (CRC32) checksum that is used to verify the integrity of the GPT header.
GPT disks use a primary and a backup GUID partition table (GPT) header:
The primary GPT header is located at LBA 1, directly after the Protective MBR.
The backup GPT header is located in the last sector of the disk. No data follows the backup GPT header.
EFI verifies the integrity of the GPT headers by using a CRC32 checksum, which is a calculated value that is used to test data for the presence of errors. If the primary GPT header is corrupted, the system checks the backup GPT header checksum. If the backup checksum is valid, then the backup GPT header is used to restore the primary GPT header. This restoration process works in reverse if the primary GPT header is valid but the backup GPT header is corrupted. If both the primary and backup GPT headers are corrupted, then Windows XP 64-Bit Edition cannot access the disk.
Caution
Do not use disk editing tools such as DiskProbe to make changes to GPT disks because any change that you make renders the checksums invalid, which might cause the disk to become inaccessible. To make changes to GPT disks, do either of the following:
Use Diskpart.efi in the firmware environment.
Use Diskpart.exe or Disk Management in Windows XP 64-Bit Edition.
The following example shows a partial printout of a GPT header.
Table 26-19 describes the fields in the GPT header.
Table 26-19: GUID Partition Table Header
Byte Offset
Field Length
Sample Value
Field Name and Definition
0x00
8 bytes
0x4546492050415254
Signature. Used to identify all EFI-compatible GPT headers. The value must always be 0x4546492050415254.
0x08
4 bytes
0x00000100
Revision. The revision number of the EFI specification to which the GPT header complies. For version 1.0, the value is 0x00000100.
0x0C
4 bytes
0x5C000000
Header Size. The size, in bytes, of the GPT header. The size is always 0x5C000000 or 92 bytes. The remaining bytes in LBA 1 are reserved.
0x10
4 bytes
0x276D9FC9
CRC32 Checksum. Used to verify the integrity of the GPT header. The 32-bit cyclic redundancy check (CRC) algorithm is used to perform this calculation.
0x14
4 bytes
0x00000000
Reserved. Must be 0.
0x18
8 bytes
0x0100000000000000
Primary LBA. The LBA that contains the primary GPT header. The value is always equal to LBA 1.
0x20
8 bytes
0x37C8110100000000
Backup LBA. The LBA address of the backup GPT header. This value is always equal to the last LBA on the disk.
0x28
8 bytes
0x2200000000000000
First Usable LBA. The first usable LBA that can be contained in a GUID partition entry. In other words, the first partition begins at this LBA. In Windows XP 64-Bit Edition, this number is always LBA 34.
0x30
8 bytes
0x17C8110100000000
Last Usable LBA. The last usable LBA that can be contained in a GUID partition entry.
0x38
16 bytes
0x00A2DA989F79C001A1F404622FD5EC6D
Disk GUID. A unique number that identifies the partition table header and the disk itself.
0x48
8 bytes
0x0200000000000000
Partition Entry LBA. The starting LBA of the GUID partition entry array. This number is always LBA 2.
0x50
4 bytes
0x80000000
Number of Partition Entries. The maximum number of partition entries that can be contained in the GUID partition entry array. In Windows XP 64-Bit Edition, this number is equal to 128.
0x54
4 bytes
0x80000000
Size of Partition Entry. The size, in bytes, of each partition entry in the GUID partition entry array. Each partition entry is 128 bytes.
0x58
4 bytes
0x27C3F385
Partition Entry Array CRC32. Used to verify the integrity of the GUID partition entry array. The 32-bit CRC algorithm is used to perform this calculation.
0x5C
420 bytes
Reserved. Must be 0.
GUID Partition Entry Array
Similar to the partition table on MBR disks, the GUID partition entry array contains partition entries that represent each partition on the disk. Windows XP 64-Bit Edition creates an array that is 16,384 bytes, so the first usable block must start at an LBA greater than or equal to 34. (LBA 0 contains the protective MBR; LBA 1 contains the GPT header; and LBAs 2 through 33 are used by the GUID partition entry array.)
Each GPT disk contains two GUID partition entry arrays:
The primary GUID partition entry array is located after the GUID partition table header and ends before the first usable LBA.
The backup GUID partition entry array is located after the last usable LBA and ends before the backup GUID partition table header.
A CRC32 checksum of the GUID partition entry array is stored in the GPT header. When a new partition is added, this checksum is updated in the primary and backup GUID partition entries, and then the GPT header size checksum is updated.
GUID Partition Entry
A GUID partition entry defines a single partition and is 128 bytes long. Because Windows XP 64-Bit Edition creates a GUID partition entry array that has 16,384 bytes, you can have a maximum of 128 partitions on a basic GPT disk.
Each GUID partition entry begins with a partition type GUID. The 16-byte partition type GUID, which is similar to a System ID in the partition table of an MBR disk, identifies the type of data that the partition contains and identifies how the partition is used. Windows XP 64-Bit Edition recognizes only the partition type GUIDs described in Table 26-20 and does not mount any other type of partition. However, original equipment manufacturers (OEMs) and independent software vendors (ISVs), as well as other operating systems might define additional partition type GUIDs.
For more information about the required partitions on GPT disks, see Disk Management in this book.
Table 26-20: Partition Type GUIDs
Partition Type
GUID Value
Unused entry
0x00000000000000000000000000000000
EFI System partition
0x28732AC11FF8D211BA4B00A0C93EC93B
Microsoft Reserved partition
0x16E3C9E35C0BB84D817DF92DF00215AE
Primary partition on a basic disk
0xA2A0D0EBE5B9334487C068B6B72699C7
LDM Metadata partition on a dynamic disk
0xAAC808588F7EE04285D2E1E90434CFB3
LDM Data partition on a dynamic disk
0xA0609BAF3114624FBC683311714A69AD
The following example illustrates a partial hexadecimal printout of the GUID partition entry array on a basic GPT disk. This printout shows three partition entries: an EFI System partition, a Microsoft Reserved partition, and a primary partition. The partition type GUIDs are bold and match the entries in Table 26-20.
Table 26-21 illustrates the layout of a GUID partition entry. The sample values correspond to the EFI System partition entry in the preceding example.
Table 26-21: GUID Partition Entry
Byte Offset
Field Length
Sample Value
Field Name and Definition
0x00
16 bytes
0x28732AC11FF8D211BA4B00A0C93EC93B
Partition Type GUID. Identifies the type of partition. The partition type GUID in this example identifies Microsoft Reserved partitions. See Table 26-20 for a description of the partition type GUIDs.
0x 10
16 bytes
0xC09477FC4386C00192E03C772E43AC40
Unique Partition GUID. A unique ID created for each partition entry.
0x 20
8 bytes
0x3F00000000000000
Starting LBA. The starting LBA of the partition that is defined by this partition entry.
0x 28
8 bytes
0xCC2F030000000000
Ending LBA. The ending LBA of the partition that is defined by this partition entry.
0x 30
8 bytes
0x0000000000000000
Attribute Bits. Describe how the partition is used. See Table 26-22 for a description of the attribute used by Windows XP 64-Bit Edition.
0x 38
72 bytes
EFI system partition
Partition Name. A 36-character Unicode string that can be used to name the partition.
The following example illustrates a partial hexadecimal printout of a GUID partition entry array on a dynamic GPT disk. Notice the differences between this example and the previous example of the basic GPT disk. The GUID partition entry array shows the Microsoft Reserved partition plus additional entries that appear only on dynamic GPT disks:
The LDM Metadata partition is a 1-MB hidden partition that stores the dynamic disk database, which contains information about all dynamic disks and volumes installed on the computer.
The LDM Data partition acts as a container for dynamic volumes. Individual dynamic volumes do not contain entries in the GUID partition entry array.
The partition type GUIDs are bold and match the entries in Table 26-20. For more information about partitions on GPT disks, see Disk Management in this book.
GUID partition entry attributes are descriptors for how a partition is used. The attributes are specified within a 64-bit value, so EFI supports up to 64 different attributes. Windows XP 64-Bit Edition uses two attributes as described in Table 26-22.
Table 26-22: GUID Partition Entry Attributes Used by Windows XP 64-Bit Edition
Bits
Description
Bit 0
Specifies that this partition is required for the platform to function.
Bits 48 to 63
Reserved by Microsoft for the following partition types: EFI System partitions, Microsoft Reserved partitions, primary partitions, LDM Metadata partitions, and LDM Data partitions. These partitions use the partition type GUIDs described in Table 26-20.
Boot Sectors on GPT Disks
Boot sectors on GPT disks are similar to boot sectors on MBR disks, except that EFI ignores all x86 code in the boot sector. Instead, EFI uses its own file system driver to read the BPB and then mount the volume.
