Extended boot record

Last updated

An extended boot record (EBR), [1] or extended partition boot record (EPBR), [note 1] is a descriptor for a logical partition under the common DOS disk drive partitioning system. In that system, when one (and only one) partition record entry in the master boot record (MBR) is designated an extended partition , then that partition can be subdivided into a number of logical partitions. The actual structure of that extended partition is described by one or more EBRs, which are located inside the extended partition. The first (and sometimes only) EBR will always be located on the very first sector of the extended partition.

Contents

Unlike primary partitions, which are all described by a single partition table within the MBR, and thus limited in number, each EBR precedes the logical partition it describes. [note 2] If another logical partition follows, then the first EBR will contain an entry pointing to the next EBR; thus, multiple EBRs form a linked list. [note 3] This means the number of logical drives that can be formed within an extended partition is limited only by the amount of available disk space in the given extended partition. [note 4]

While in Windows versions up to XP logical partitions within the extended partition were aligned following conventions called "drive geometry" or "CHS", since Windows Vista they are aligned to a 1-MiB boundary. Due to this difference in alignment, the Logical Disk Manager of XP (Disk Management) may delete these extended partitions without warning. [2]

EBR structure and values

EBRs have essentially the same structure as the MBR; except only the first two entries of the partition table are supposed to be used, besides having the mandatory boot record signature (or magic number) of 0xAA55 at the end of the sector. [1] This 2-byte signature appears in a disk editor as 0x55 first and 0xAA last, because IBM-compatible PCs store hexadecimal words in little-endian order (see table below).

Structures

Common Structure of Extended Boot Records:
Offsets within EBR sectorsContentsSize
Hex Dec bytes
000 – 1BD000 – 445Generally unused; normally filled with zeroes;
may contain another boot loader i.e. a partition boot record, for example in conjunction with Advanced Active Partitions 		446
1BE – 1CD446 – 461Partition table's first entry16
1CE – 1DD462 – 477Partition table's second entry16
1DE – 1ED478 – 493Unused [3] third entry filled with zeroes16
1EE – 1FD494 – 509Unused [3] fourth entry filled with zeroes16
1FE - 1FF510 - 511Signature 55AAh in big-endian network order,
same as little-endian 0xAA55. On disk: 0x55 at offset 510 and 0xAA at offset 511.		2
EBR, total size: 446 +(4×16) +2 =512

The IBM Boot Manager (included with OS/2 operating systems and some early versions of Partition Magic), adds at least one 9-byte entry (starting at offset 0x18A) to each EBR sector. The entry consists of a flag value byte (indicating if the partition is on the IBM Boot Manager menu) followed by an 8-byte ASCII string which is the name to be used on the menu. If the partition is not included on the boot menu (such as data only partitions), the flag byte is zero; in which case, the following 8-byte field may contain an ASCII representation of that partition's starting sector number (in hexadecimal).

Structure of an MBR or EBR 16-byte Partition Table Entry:
Offsetswithin entryBytesDescription
Hex Dec
1?E 1 01Boot indicator (80h for active; otherwise, 00h)
1?F - 1?1 1 –  33CHS cylinder-head-sector address: partition start
1?241 Partition type code
1?3 - 1?5 5 –  73CHS cylinder-head-sector address: partition end
1?6 - 1?9 8 – 114LBA logical block address: partition start
1?A - 1?D12 – 154Partition size (in sectors)
1 : For 1?E read 1BE or 1CE to get the hex. offset of the first or second entry, respectively

The partition type of an extended partition is 0x05 (CHS addressing) or 0x0F (LBA addressing). [4] DR DOS 6.0 and higher support secured extended partitions using 0xC5 , which are invisible to other operating systems. Since non-LBA-enabled versions of DR-DOS up to including 7.03 do not recognize the 0x0F partition type and other operating systems do not recognize the 0xC5 type, this can also be utilized to occupy space up to the first 8 GB of the disk for use under DR-DOS (for logical drives in secured or non-secured partitions), and still use 0x0F to allocate the remainder of the disk for LBA-enabled operating systems in a non-conflictive fashion. Similarly, Linux supports the concept of a second extended partition chain with type 0x85 — this type is hidden (unknown) for other operating systems supporting only one chain. [5] Other extended partition types which may hold EBRs include the deliberately hidden types 0x15 , 0x1F , 0x91 and 0x9B , the access-restricted types 0x5E and 0x5F , and the secured types 0xCF and 0xD5 . However, these should be treated private to the operating systems and tools supporting them and should not be mounted otherwise.

The CHS addresses of a partition are hard to interpret without knowledge of the (virtual) disk geometry, because CHS to LBA translations are based on the number of heads and the number of sectors per track. However, the given LBA start address and the given partition size in sectors permit to calculate a disk geometry matching the given CHS addresses where that is at all possible. CHS addressing with 24 bits always uses 6 bits for up to 63 sectors per track (1...63), and INT 13h disk access generally uses 8 bits for up to 256 heads (0...255), leaving 10 bits for up to 1024 cylinders (0...1023). ATA CHS addresses always use 4 bits for up to 16 heads (0...15), this leaves 14 bits for up to 16,383 cylinders ({{{1}}}) in ATA-5 24 bits CHS address translations. [6]

Values

The following are general rules that apply only to values found in the 4-byte fields of an EBR's partition table entries (cf. tables above). These values depend upon the partitioning tool(s) used to create or alter them, and in fact, most operating systems that use the extended partitioning scheme (including Microsoft MS-DOS and Windows, and Linux) ignore the "partition size" value in entries which point to another EBR sector. One exception is that value must be one or greater for Linux operating systems.

The first entry of an EBR partition table points to the logical partition belonging to that EBR:

  • Starting sector = relative offset between this EBR sector and the first sector of the logical partition
Note: This is often the same value for each EBR on the same hard disk; usually 63 for Windows XP or older.
  • Number of sectors = total count of sectors for this logical partition
Note: Any unused sectors between EBR and logical drive are not considered part of the logical drive. [1]

The second entry of an EBR partition table will contain zero-bytes if it's the last EBR in the extended partition; otherwise, it points to the next EBR in the EBR chain.

in other words, the EBR must have a valid partition type, just as a partition must have a valid partition type.
  • Starting sector = relative address of next EBR within extended partition
in other words: Starting sector = LBA address of next EBR minus LBA address of extended partition's first EBR
  • Number of sectors = total count of sectors for next logical partition, but count starts from the next EBR sector
Note: Unlike the first entry in an EBR's partition table, this number of sectors count includes the next logical partition's EBR sector along with the other sectors in its otherwise unused track. (Compare Diagram 1 and 2 below.)
06-02-05-embr-entry-1.png
Diagram 1. What the Starting and
Total Number of sectors values of
1st entrypoint to and enumerate.
09-02-28-ebr-entry-2.png
Diagram 2. What the Starting and Total
Number of sectors values of an EBR's
2nd entrypoint to and enumerate.

Remarks:
The diagrams above are not to scale: The thin white lines between each "EBR" and its logical "partition" represent the remainder of an unused area usually 63 sectors [note 2] in length; including the single EBR sector (shown at a greatly exaggerated size).

On some systems, a large gap of unused space may exist between the end of a logical partition and the next EBR, or between the last logical partition and the end of the whole extended partition itself, if any previously created logical partition has been deleted or resized (shrunk).

The interleaving of EBRs and partitions shown above is typical but not required. It is legitimate to have two or more consecutive EBRs followed by two or more regions of partition data.

Naming

Linux and similar operating systems designate IDE hard disks as /dev/hda for the first hard disk, /dev/hdb for the second hard disk, and so on. Likewise SCSI and in later kernels also IDE and SATA hard disks are identified as /dev/sda for the first disk, etc.

The up to four partitions defined in the master boot record are designated as /dev/hda1 ... /dev/hda4 for /dev/hda. The fifth partition in this scheme, e.g., /dev/hda5, corresponds to the first logical drive. The sixth partition /dev/hda6 would then correspond to the second logical drive, or in other words, the extended partition containers are not counted. Only the outermost extended partition defined in the MBR (one of /dev/hda1 ... /dev/hda4) has a name in this scheme. [7]

Examples

This shows an extended partition with 6,000 sectors and 3 logical partitions.
Remark: Neither a tiny extended partition with only 3 MB nor a hard drive with 20 sectors per track are realistic but these values have been chosen to make this example more readable.

06-02-05-EMBR-A.png

Snapshot

The following output of a command line tool[ which? ] shows the layout of a disk with two logical drives. Details for the FAT and NTFS partitions stripped, the line annotated with Linux is /dev/hda6 with an extended file system. The begin of /dev/hda5 shows that the involved operating systems PC DOS 7, Windows NT, and Debian do not insist on any extended partition alignment with a gap:

 \\.\PHYSICALDRIVE0 (assuming geometry CHS 99999 255 63)  id. [3189-3188]    MBR CHS     0   0  1 at          0, end     0   0  1, size          1 unused CHS     0   0  2 at          1, end     0   0 63, size         62 1:*06: CHS     0   1  1 at         63, end   260 254 63, size    4192902 bigFAT 2: 05: CHS   261   0  1 at    4192965, end   757 254 63, size    7984305 => EXT 3: 17: CHS   758   0  1 at   12177270, end  1522 254 63, size   12289725 NTFS 4: 1C: CHS  1523   0  1 at   24466995, end  1825 254 63, size    4867695 FAT32           (extended offset    4192965)                  total   29334690 => EXT CHS   261   0  1 at          0, end   261   0  1, size          1 5: 06: CHS   261   0  2 at          1, end   384 254 63, size    1992059 bigFAT 6: 05: CHS   385   0  1 at    1992060, end   757 254 63, size    5992245 => EXT           (extended offset    6185025)                  total    7984305 => EXT CHS   385   0  1 at          0, end   385   0  1, size          1 unused CHS   385   0  2 at          1, end   385   0 63, size         62 6: 83: CHS   385   1  1 at         63, end   757 254 63, size    5992182 Linux 7: 00: CHS     0   0  0 at          0, end     0   0  0, size          0 unused                                                         total    5992245  bigFAT CHS     0   1  1 at         63, end   260 254 63, size    4192902 PC DOS 7    (cluster size  64, number      65506)       total    4192902    NTFS CHS   758   0  1 at   12177270, end  1522 254 63, size   12289725 [1C81-013D] (cluster size   8, number    1536215)       total   12289725   FAT32 CHS  1523   0  1 at   24466995, end  1825 254 63, size    4867695 [C417-9E22] (cluster size   8, number     607271)       total    4867695  bigFAT CHS   261   0  2 at    4192966, end   384 254 63, size    1992059 FAT SWAP    (cluster size  32, number      62236)       total    1992059

For another example see the "Linux Partition HOWTO". [8]

Footnotes

  1. ↑ This term is used by PowerQuest's (now Symantec) diagnostic software programs, such as their PartitionInfo utility (included with Partition Magic), when extended partition information is displayed.
  2. 1 2 The EBR is located on the very first sector of an otherwise unused area which is equal to the number of sectors per track; normally, 63 sectors. In this regard, each logical partition mimicks the layout of a hard disk's structure for its first primary partition, since the MBR is located on the very first sector of the disk, the first sector of Track 0 (normally followed by 62 unused sectors) and then the boot sector of its first primary partition.
  3. ↑ Therefore, any operating system or utility program that must access or enumerate all logical drive partitions, must follow this chain of entries until the last EBR, containing only one entry, has been read.
  4. ↑ Under most DOS and earlier Windows operating systems, the number of logical drives in an extended partition was limited to 23, because the FDISK program couldn't create any more drives than it could assign a drive letter to; thus, assuming C: is a primary drive, the DOS drive letters D: through Z: allow for only 23 more drives. This limitation does not exist in DR-DOS FDISK, since it does not associate partitions with drive letters (except for primary partitions). Advanced features like secured or compressed volumes and multi-platform support result in more complex drive letter assignment rules, making it impractical or even misleading to associate drive letters with partitions inside FDISK. Also, the fact that DR-DOS FDISK does not only partition but also format freshly created partitions, makes it less important to know the corresponding drive letter. Further, Novell DOS 7 and higher officially support up to 32 volumes using the LASTDRIVE=32 CONFIG.SYS directive. Under Windows NT and later, an unlimited number of logical partitions can be created using the Computer Management's, Disk Management Extension; though in practice, users rarely created more than 23, since the Windows NT shell (user interface) was still limited to accessing only those drives with an A: through Z: drive letter. Newer releases of Windows support Unix-like mounting of partitions to paths in another filesystem, instead of a letter, and also allow UNC-style paths such as \\?\Volume{uuid}\.

See also

Related Research Articles

Booting Process of starting a computer

In computing, booting is the process of starting a computer as initiated via hardware such as a button or by a software command. After it is switched on, a computer's central processing unit (CPU) has no software in its main memory, so some process must load software into memory before it can be executed. This may be done by hardware or firmware in the CPU, or by a separate processor in the computer system.

File Allocation Table (FAT) is a file system developed for personal computers. Originally developed in 1977 for use on floppy disks, it was adapted for use on hard disks and other devices. It is often supported for compatibility reasons by current operating systems for personal computers and many mobile devices and embedded systems, allowing interchange of data between disparate systems. The increase in disk drives capacity required three major variants: FAT12, FAT16 and FAT32. The FAT standard has also been expanded in other ways while generally preserving backward compatibility with existing software.

Disk partitioning Creation of separate accessible storage areas on a secondary computer storage device

Disk partitioning or disk slicing is the creation of one or more regions on secondary storage, so that each region can be managed separately. These regions are called partitions. It is typically the first step of preparing a newly installed disk, before any file system is created. The disk stores the information about the partitions' locations and sizes in an area known as the partition table that the operating system reads before any other part of the disk. Each partition then appears to the operating system as a distinct "logical" disk that uses part of the actual disk. System administrators use a program called a partition editor to create, resize, delete, and manipulate the partitions. Partitioning allows the use of different filesystems to be installed for different kinds of files. Separating user data from system data can prevent the system partition from becoming full and rendering the system unusable. Partitioning can also make backing up easier. A disadvantage is that it can be difficult to properly size partitions, resulting in having one partition with too much free space and another nearly totally allocated.

GNU GRUB Boot loader package

GNU GRUB is a boot loader package from the GNU Project. GRUB is the reference implementation of the Free Software Foundation's Multiboot Specification, which provides a user the choice to boot one of multiple operating systems installed on a computer or select a specific kernel configuration available on a particular operating system's partitions.

Logical block addressing (LBA) is a common scheme used for specifying the location of blocks of data stored on computer storage devices, generally secondary storage systems such as hard disk drives. LBA is a particularly simple linear addressing scheme; blocks are located by an integer index, with the first block being LBA 0, the second LBA 1, and so on.

Multi-booting Act of installing multiple operating systems on a single computer

Multi-booting is the act of installing multiple operating systems on a single computer, and being able to choose which one to boot. The term dual-booting refers to the common configuration of specifically two operating systems. Multi-booting may require a custom boot loader.

Cylinder-head-sector Historical method for giving addresses to physical data blocks on hard disk drives

Cylinder-head-sector (CHS) is an early method for giving addresses to each physical block of data on a hard disk drive.

GUID Partition Table Computer disk partitioning standard

The GUID Partition Table (GPT) is a standard for the layout of partition tables of a physical computer storage device, such as a hard disk drive or solid-state drive, using universally unique identifiers, which are also known as globally unique identifiers (GUIDs). Forming a part of the Unified Extensible Firmware Interface (UEFI) standard, it is nevertheless also used for some BIOS systems, because of the limitations of master boot record (MBR) partition tables, which use 32 bits for logical block addressing (LBA) of traditional 512-byte disk sectors.

INT 13h is shorthand for BIOS interrupt call 13hex, the 20th interrupt vector in an x86-based computer system. The BIOS typically sets up a real mode interrupt handler at this vector that provides sector-based hard disk and floppy disk read and write services using cylinder-head-sector (CHS) addressing. Modern PC BIOSes also include INT 13h extension functions, originated by IBM and Microsoft in 1992, that provide those same disk access services using 64-bit LBA addressing; with minor additions, these were quasi-standardized by Phoenix Technologies and others as the EDD BIOS extensions.

Apple Partition Map (APM) is a partition scheme used to define the low-level organization of data on disks formatted for use with 68k and PowerPC Macintosh computers. It was introduced with the Macintosh II.

The Logical Disk Manager (LDM) is an implementation of a logical volume manager for Microsoft Windows NT, developed by Microsoft and Veritas Software. It was introduced with the Windows 2000 operating system, and is supported in Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows 8, Windows 10 and Windows 11. The MMC-based Disk Management snap-in hosts the Logical Disk Manager. On Windows 8 and Windows Server 2012, Microsoft deprecated LDM in favor of Storage Spaces.

TestDisk

TestDisk is a free and open-source data recovery utility that helps users recover lost partitions or repair corrupted filesystems. TestDisk can collect detailed information about a corrupted drive, which can then be sent to a technician for further analysis. TestDisk supports DOS, Microsoft Windows, Linux, FreeBSD, NetBSD, OpenBSD, SunOS and MacOS. TestDisk handles non-partitioned and partitioned media. In particular, it recognizes the GUID Partition Table (GPT), Apple partition map, PC/Intel BIOS partition tables, Sun Solaris slice and Xbox fixed partitioning scheme. TestDisk uses a command line user interface. TestDisk can recover deleted files with 97% accuracy.

A volume boot record (VBR) is a type of boot sector introduced by the IBM Personal Computer. It may be found on a partitioned data storage device, such as a hard disk, or an unpartitioned device, such as a floppy disk, and contains machine code for bootstrapping programs stored in other parts of the device. On non-partitioned storage devices, it is the first sector of the device. On partitioned devices, it is the first sector of an individual partition on the device, with the first sector of the entire device being a Master Boot Record (MBR) containing the partition table.

In BSD-derived computer operating systems and in related operating systems such as SunOS, a disklabel is a record stored on a data storage device such as a hard disk that contains information about the location of the partitions on the disk. Disklabels were introduced in the 4.3BSD-Tahoe release. Disklabels are usually edited using the disklabel utility. In later versions of FreeBSD, this was renamed as bsdlabel.

The partition type in a partition's entry in the partition table inside a master boot record (MBR) is a byte value intended to specify the file system the partition contains or to flag special access methods used to access these partitions.

gpart is a software utility which scans a storage device, examining the data in order to detect partitions which may exist but are absent from the disk's partition tables. Gpart was written by Michail Brzitwa of Germany. The release on the author's website is now older than the releases some distributions are using. It appears that Michail Brzitwa does not actively maintain the code, instead the various distributions appear to maintain their own versions.

The BIOS boot partition is a partition on a data storage device that GNU GRUB uses on legacy BIOS-based personal computers in order to boot an operating system, when the actual boot device contains a GUID Partition Table (GPT). Such a layout is sometimes referred to as BIOS/GPT boot.

A master boot record (MBR) is a special type of boot sector at the very beginning of partitioned computer mass storage devices like fixed disks or removable drives intended for use with IBM PC-compatible systems and beyond. The concept of MBRs was publicly introduced in 1983 with PC DOS 2.0.

Ranish Partition Manager is a freeware hard disk partition editor, disk cloning utility, and boot manager, that gives a high level of control for creating multi-boot systems. It is available on the freeware live CD SystemRescueCD and the Ultimate Boot CD. It runs under MS-DOS, PC DOS, DR-DOS, or FreeDOS.

A FAT file system is a specific type of computer file system architecture and a family of industry-standard file systems utilizing it.

References

  1. 1 2 3 "Disk Concepts and Troubleshooting". Windows 2000 Web and Application Services Technical Overview. Microsoft Technet. 2000. Retrieved 2011-07-19.
  2. ↑ "The partition that hosts Windows Vista may disappear if you use Windows XP to create a partition on a computer that has both Windows XP and Windows Vista installed". Microsoft Support. 2007-12-02. Retrieved 2015-08-29.
  3. 1 2 "Troubleshooting Disks and File Systems". Windows XP Resource Kit. Microsoft TechNet. 2005-11-03. Retrieved 2011-09-15.
  4. 1 2 Andries E. Brouwer (2011). "List of partition identifiers for PCs" . Retrieved 2011-07-19. [0x05 s]upports at most 8.4 GB disks: with type 05 DOS/Windows will not use the extended BIOS call, even if it is available. See type 0f below. Using type 05 for extended partitions beyond 8 GB may lead to data corruption with MSDOS.
  5. ↑ Andries Brouwer (2004). "Extended and logical partitions". Large Disk HOWTO. Retrieved 2011-07-19.
  6. ↑ "ATA-5" (PDF). T13/1321D. INCITS Technical Committee T10 SCSI Storage Interfaces. 2000. Archived from the original (PDF) on 2011-07-28. Retrieved 2011-07-30.
  7. ↑ Juergen Haas. "Extended partitions". linux.about.com . Retrieved 2011-07-19.
  8. ↑ Anthony Lissot (2005). "Partitioning with fdisk". Linux Partition HOWTO Revision 3.5. Retrieved 2011-07-19.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.