Keyboard shortcuts

Press ← or → to navigate between chapters

Press S or / to search in the book

Press ? to show this help

Press Esc to hide this help

Master Boot Record (MBR) partition table format

The Master Boot Record (MBR) partition table is mainly used on the family of Intel x86 based computers.

Overview

A MBR partition table consists of:

  • Master Boot Record (MBR)
  • Extended Partition Records (EPRs)

Characteristics

CharacteristicsDescription
Byte orderlittle-endian
Date and time valuesN/A
Character stringsN/A

Terminology

TermDescription
Physical blockA fixed location on the storage media defined by the storage media
Logical blockAn abstract location on the storage media defined by software

Sector size(s)

Traditionally the size of sector is 512 bytes, but modern hard disk drives use 4096 bytes. The linux fdisk utility supports sector sizes of: 512, 1024, 2048 and 4096.

The location of of the “boot signature” of the MBR does not indicate the sector size. Methods to derive the sector size from the data:

  • check the “boot signature” of the first EPR, if present
  • check the content of well known partition types

Cylinder Head Sector (CHS) address

The Cylinder Head Sector (CHS) address is 24 bits in size and consists of:

OffsetSizeValueDescription
0.0 8 bitsHead
1.0 6 bitsSector
1.510 bitsCylinder

The logical block address (LBA) can be determined from the CHS with the following calculation:

lba = (((cylinder * heads_per_cylinder) + head) * sectors_per_track) + sector - 1

The Master Boot Record (MBR)

The Master Boot Record (MBR) is a data structure that describes the properties of the storage medium and its partitions.

The classical MBR can only contain 4 partition table entries. Additional partition entries must be stored using extended partition records (EPR). The classical MBR has evolved into different variants like:

  • The modern MBR
  • The Advanced Active Partitions (AAP) MBR
  • The NEWLDR MBR
  • The AST/NEC MS-DOS and SpeedStor MBR
  • The Disk Manager MBR

The classical MBR

The classical MBR is 512 bytes in size and consists of:

OffsetSizeValueDescription
0446The boot (loader) code
44616Partition table entry 1
46216Partition table entry 2
47816Partition table entry 3
49416Partition table entry 4
5102"\x55\xaa"The (boot) signature

The modern MBR

The modern MBR is 512 bytes in size and consists of:

OffsetSizeValueDescription
0218The first part of the boot (loader) code
Disk timestamp used by Microsoft Windows 95, 98 and ME
21820x0000Unknown (Reserved)
2201Unknown (Original physical drive), which contains a value that ranges from 0x80 to 0xff, where 0x80 is the first drive, 0x81 the second, etc.
2211Seconds, which contains a value that ranges from 0 to 59
2221Minutes, which contains a value that ranges from 0 to 59
2231Hours, which contains a value that ranges from 0 to 23
Without disk identity
224222The second part of the boot (loader) code
With disk identity, used by UEFI, Microsoft Windows NT or later
224216The second part of the boot (loader) code
4404Disk identity (signature)
44420x0000 or 0x5a5acopy-protection marker
Common
44616Partition table entry 1
46216Partition table entry 2
47816Partition table entry 3
49416Partition table entry 4
5102"\x55\xaa"The (boot) signature

The extended partition record

The extended partition record (EPR) (also referred to as extended boot record (EBR)) starts with a 64 byte (extended) partition record (EPR) like the MBR. This partition table contains information about the logical partition (volume) and additional extended partition tables.

OffsetSizeValueDescription
04460x00Unknown (Unused), which should contain zero bytes
44616Partition table entry 1
46216Partition table entry 2, which should contain an extended partition
478160x00Partition table entry 3, which should be unused and contain zero bytes
494160x00Partition table entry 4, which should be unused and contain zero bytes
5102"\x55\xaa"Signature

The second partition entry contains an extended partition which points to the next EPR. The LBA addresses in the EPR are relative to the start of the first EPR.

The first EPR typically has a partition type of 0x05 but certain version of Windows are known to use a partition type 0x0f, such as Windows 98.

The partition table entry

The partition table entry is 16 bytes in size and consists of:

OffsetSizeValueDescription
01Partition flags
13The partition start address, which contains a CHS relative from the start of the harddisk
41Partition type
53The partition end address, which contains a CHS relative from the start of the harddisk
84The partition start address, which contains a LBA (sectors) relative from the start of the harddisk
124Size of the partition in number of sectors

Partition flags

The partition flags consist of the following values:

ValueIdentifierDescription
0x80Partition is boot-able

Partition types

The partition types consist of the following values:

ValueIdentifierDescription
0x00Empty
0x01FAT12 (CHS)
0x02XENIX root
0x02XENIX user
0x04FAT16 (16 MiB -32 MiB CHS)
0x05Extended (CHS)
0x06FAT16 (32 MiB - 2 GiB CHS)
0x07HPFS/NTFS
0x08AIX
0x09AIX bootable
0x0aOS/2 Boot Manager
0x0bFAT32 (CHS)
0x0cFAT32 (LBA)
0x0eFAT16 (32 MiB - 2 GiB LBA)
0x0fExtended (LBA)
0x10OPUS
0x11Hidden FAT12 (CHS)
0x12Compaq diagnostics
0x14Hidden FAT16 (16 MiB - 32 MiB CHS)
0x16Hidden FAT16 (32 MiB - 2 GiB CHS)
0x17Hidden HPFS/NTFS
0x18AST SmartSleep
0x1bHidden FAT32 (CHS)
0x1cHidden FAT32 (LBA)
0x1eHidden FAT16 (32 MiB - 2 GiB LBA)
0x24NEC DOS
0x27Unknown (PackardBell recovery/installation partition)
0x39Plan 9
0x3cPartitionMagic recovery
0x40Venix 80286
0x41PPC PReP Boot
0x42SFS or LDM: Microsoft MBR (Dynamic Disk)
0x4dQNX4.x
0x4eQNX4.x 2nd part
0x4fQNX4.x 3rd part
0x50OnTrack DM
0x51OnTrack DM6 Aux1
0x52CP/M
0x53OnTrack DM6 Aux3
0x54OnTrackDM6
0x55EZ-Drive
0x56Golden Bow
0x5cPriam Edisk
0x61SpeedStor
0x63GNU HURD or SysV
0x64Novell Netware 286
0x65Novell Netware 386
0x70DiskSecure Multi-Boot
0x75PC/IX
0x78XOSL
0x80Old Minix
0x81Minix / old Linux
0x82Solaris x86 or Linux swap
0x83Linux
0x84Hibernation or OS/2 hidden C: drive
0x85Linux extended
0x86NTFS volume set
0x87NTFS volume set
0x8eLinux LVM
0x93Amoeba
0x94Amoeba BBT
0x9fBSD/OS
0xa0IBM Thinkpad hibernation
0xa1Hibernation
0xa5FreeBSD
0xa6OpenBSD
0xa7NeXTSTEP
0xa8Mac OS X
0xa9NetBSD
0xabMac OS X Boot
0xafMac OS X
0xb7BSDI
0xb8BSDI swap
0xbbBoot Wizard hidden
0xc1DRDOS/sec (FAT-12)
0xc4DRDOS/sec (FAT-16 < 32M)
0xc6DRDOS/sec (FAT-16)
0xc7Syrinx
0xdaNon-FS data
0xdbCP/M / CTOS / ...
0xdeDell Utility
0xdfBootIt
0xe1DOS access
0xe3DOS R/O
0xe4SpeedStor
0xebBeOS
0xeeEFI GPT protective partition
0xefEFI system partition (FAT)
0xf0Linux/PA-RISC boot
0xf1SpeedStor
0xf2DOS secondary
0xf4SpeedStor
0xfbVMWare file system
0xfcVMWare swap
0xfdLinux RAID auto-detect
0xfeLANstep
0xffBBT