Master Boot Record SCAN - partition table analyzer
Copyright (C) 1995, 1999 and 2003 by Nobumichi Kozawa
MBRSCAN comes with ABSOLUTELY NO WARRANTY; This is free software, and you are welcome to redistribute it under certain conditions: See GPL.TXT for details.
Japanese Document is also available. Please visit N.Kozawa Program Library to check latest information.
MBRSCAN is a PC-DOS program which dumps MBR (Master Boot Record) and boot record of each partition and analyzes partition table entries.
I wrote this program to dump the MBR when I encountered MBR corruption at OS installation.
At first, I used a debug command to look at the MBR.
Then I wrote the MBRSCAN for asking other person to display the MBR much easier.
After that, I added partition table analyzer to the MBRSCAN.
If you have some knowledge about hard disk, you can figure out partition and boot problems using this tool.
The MBRSCAN is also good for understand partition table structure.
MBRS112.ZIP includes following files.
| MBRSCAN.EXE | Executable |
|---|---|
| MBRSCAN.CPP | Source files |
| MBRSCAN.H | Source file, header |
| MBRSCAN.HTM | Japanese document |
| MBRSCANE.HTM | English document |
| GPL.TXT | GNU GENERAL PUBLIC LICENSE |
MBRSCAN.EXE is a DOS program.
It works under PC-DOS, DOS/V, DOS window of OS/2 and Windows 98.
If you want to run this program against boot drive, just type MBRSCAN.
Current version of the MBRSCAN supports up to 15 logical drives.
A:\>mbrscan /?
MBRSCAN V1.11 Copyright (C) 1995-2003 by Nobumichi Kozawa
MBRSCAN comes with ABSOLUTELY NO WARRANTY;
This is free software, and you are welcome to redistribute it
under certain conditions: See GPL.TXT for details.
Usage: MBRSCAN [-opt][drive]
opt: sd = Suppress Dump
st = Suppress Partition Table Report
sm = Suppress Partition Map
sf = Suppress Free Space Report
drive: 0 = FD-A
1 = FD-B
80 = 1st HDD
81 = 2nd HDD ...
default = 80 (1st HDD)
|
MBRSCAN -? will display help screen. Options will suppress a part of reports, detail of options as follow.
MBRSCAN V1.11 Copyright (C) 1995-2003 by Nobumichi Kozawa LBA mode |
Reports LBA mode is supported by INT13 BIOS call or not. If LBA mode is not supported, it will display Non-LBA mode. If LBA mode is supported by BIOS, following operation will perform using LBA mode.
DRV:80 CC=03E0h(992), HH=80h(128), SS=3Fh(63), BLKS=7A1000h(7999488) |
Geometry information gathered by INT13 BIOS call.
CC represents number of cylinders, HH represents number of heads and SS represents number of sectors.
BLKS means number of sectors available of this HDD.
BLKS is calculated using CCHHSS value in Non-LBA mode.
Geometry function sometimes fails under Windows 9x.
And we may see wrong number of heads value under OS/2 MDOS environment.
1 - Master Boot Record (00000000h) 0000: EB 69 4C 49 4C 4F 01 00-14 00 A3 00 00 00 00 00 [ iLILO ] 0010: 62 9E FA 36 25 DA 80 14-01 26 DA 80 14 01 24 DA [ b 6 ] 0020: 80 14 01 01 00 00 00 00-00 00 00 28 DA 80 14 01 [ ] 0030: 0B D7 80 52 01 0C D7 80-52 01 0D D7 80 52 01 0E [ R R R ] 0040: D7 80 52 01 0F D7 80 52-01 10 D7 80 52 01 11 D7 [ R R R ] 0050: 80 52 01 12 D7 80 52 01-00 00 00 00 00 00 00 00 [ R R ] 0060: 00 00 00 00 00 00 00 00-00 00 00 B8 C0 07 8E D8 [ ] 0070: 8C 06 66 00 89 36 64 00-89 1E 68 00 88 16 6A 00 [ f 6d h j ] 0080: B8 00 9A 8E C0 B9 00 01-29 F6 29 FF FC F3 A5 EA [ ] 0090: 94 00 00 9A FA 8E D8 8E-C0 BC 00 B0 B8 00 90 8E [ ] 00A0: D0 FB B0 0D E8 57 00 B0-0A E8 52 00 B0 4C E8 4D [ ] 00B0: 00 BE 30 00 BB 00 10 FC-AD 89 C1 AD 89 C2 09 C8 [ ] 00C0: 74 20 46 E8 43 00 72 06-81 C3 00 02 EB EA 50 B0 [ ] 00D0: 20 E8 2A 00 58 88 E0 E8-12 00 31 C0 88 C2 CD 13 [ ] 00E0: EB CF B0 49 E8 17 00 EA-00 00 00 9B 50 C0 E8 04 [ ] 00F0: E8 01 00 58 24 0F 04 30-3C 3A 72 02 04 07 30 FF [ ] 0100: B4 0E CD 10 C3 5A 59 5B-C3 F6 C2 40 74 52 80 E2 [ ] 0110: BF 53 51 52 B4 08 CD 13-72 EB 88 F3 5A 88 16 6D [ ] 0120: 01 88 F2 30 F6 88 F7 58-51 86 CD D0 C5 D0 C5 80 [ ] 0130: E5 03 89 0E 6B 01 59 83-E1 3F F7 F1 FE C2 88 16 [ ] 0140: 6E 01 31 D2 43 F7 F3 88-D6 8A 16 6D 01 3B 06 6B [ ] 0150: 01 77 13 86 C4 D0 C8 D0-C8 0A 06 6E 01 89 C1 5B [ ] 0160: B8 01 02 CD 13 C3 5B 31-C0 F9 C3 00 00 00 00 00 [ ] 0170: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0180: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 0190: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 01A0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 [ ] 01B0: 00 00 00 00 00 00 00 00-00 00 00 00 33 CC 00 00 [ ] 01C0: 01 C1 05 7F FF DF 80 BF-17 00 80 50 62 00 00 00 [ ] 01D0: 01 01 06 7F 3F C0 80 1F-00 00 00 A0 17 00 00 00 [ ] 01E0: 00 00 00 00 00 00 00 00-00 00 00 00 00 00 80 01 [ ] 01F0: 01 00 0A 7F 3F 00 3F 00-00 00 41 1F 00 00 55 AA [ ] |
MBR(Master Boot Record) dump. This is a first record to be read when boot the PC from the hard disk. Which consists of bootstrap and primary partition table. The MBR is located first sector of the hard disk. Address is 0 in LBA mode and CCC-HH-SS = 000-00-01 in Non-LBA mode.
1 - Partition table entry = 0 << Extended >>
01BE: 00 00 01 C1 05 7F FF DF-80 BF 17 00 80 50 62 00 [ ]
ST HH CS CC ID hh cs cc START-SEC NUMBER-SEC
+0 00 STATUS: Inactive
+1 00 01 C1 START CYL-HEAD-SECTOR: 0C1h-00h-01h (193-0-1)
+4 05 PARTITION ID: Extended
+5 7F FF DF END CYL-HEAD-SECTOR: 3DFh-7Fh-3Fh (991-127-63)
+8 0017BF80 START SECTOR: 1556352
+C 00625080 NUMBER OF SECTORS: 6443136
|
Partition table starts with offset address 0x1BE.
There are 4 entries and each entry has 16 bytes.
1 - Partition Table Entry = 0, first '1' represents primary partition.
In extended partition, this number would be 2 or larger value.
Last numeric means partition table entry number.
This must be between 0 and 3.
Partition table detail is also displayed.
Detail of partition table will mention later.
In this example, partition ID is Extended.
If this is a normal drive (FAT32 for example), dump of boot record will be followed.
[ PARTITION MAP - LBA ]
ABSOLUTE PART-TABLE
START END START BLOCKS
======== ======== ======== ========
1-0 : 0017BF80 007A0FFF 0017BF80 00625080 Extended
1-1 : 00001F80 0017BF7F 00001F80 0017A000 DOS 16-bit >=32M
1-3 : 0000003F 00001F7F 0000003F 00001F41 OS/2 Boot Manag
2-0 : 0017BFBF 002FFCFF 0000003F 00183D41 Linux native
2-1 : 002FFD00 0030F8FF 00183D80 0000FC00 Extended
3-0 : 002FFD3F 0030F8FF 0000003F 0000FBC1 Linux swap
3-1 : 0030F900 007A0FFF 00193980 00491700 Extended
4-0 : 0030F93F 007A0FFF 0000003F 004916C1 DOS 16-bit >=32M
|
Summary of partition map.
ABSOLUTE START and END values are real sector addresses (LBA mode address) calculated from START and BLOCKS in PARTITION-TABLE.
In Non-LBA mode, partition map with CCC-HH-SS address is also displayed.
[ FREE SPACE ] None. |
Free space display in LBA mode address. If geometry of the disk drive was not saved, free space for last part could not be calculated.
Before discussing Master Boot Record and partition table, I need to explain structure of the hard disk drive and INT13 BIOS call.
Basic INT13 BIOS interface specification was created based on hardware structure of the hard disk drive. To understand INT13 BIOS interface, you need to know basic hardware structure of the hard disk drive.
The hard disk drive records data on media shaped disk. It is called a disk or a platter. Device which moves on the disk and reads and writes data is called a head. The data is written on a concentric circle bit by bit. The concentric circle is called a track. Bundle of tracks at same potion on multiple disk surface is called a cylinder.
The hard disk drive used in PC writes multiple fixed length records (usually 512 bytes) on a track. The fixed length record is called a sector. The sector is addressed by nth sector counted from pre-recorded point of the disk surface.
A sector on the hard disk drive can be specified by address of cylinder, head and sector.
Program should know how many cylinders, heads and sectors are exists on the hard disk drive. The INT13 BIOS provides service to get this information. This information is called geometry.
Detail of INT13 BIOS is not mentioned here. We are focused on address parameter of INT13 BIOS interface.
inr.h.ah = 0x02; // Read sector inr.h.al = 0x01; // # of sectors inr.h.ch = plist->cyll; // CYL low inr.h.cl = plist->cylhsec; // CYL high + SEC inr.h.dh = plist->head; // HEAD seg.es = FP_SEG(buff); // buffer inr.x.bx = FP_OFF(buff); inr.h.dl = plist->drv; // Drive int86x(0x13, &inr, &outr, &seg);This is a part of mbrscan.cpp. This routine reads a sector on the hard disk drive. Register ch, cl and dh are using as address.
|<--- dh ---->| |<--- cl --->| |<--- ch --->|
|7.6.5.4.3.2.1.0| |7.6.5.4.3.2.1.0| |7.6.5.4.3.2.1.0|
| HEAD | |CYL| SECTOR | | CYLINDER LOW |
HIGH
Register dh is head address.
Cylinder is addressed by most significant 2 bits of register cl and register ch.
Remaining bits of register cl are addressing a sector.In fact, the hard disk drive structure is no longer matched with the address introduced here. Cylinder and sector address of INT13 BIOS interface are too small to address latest hard disk drives. Then INT13 BIOS uses surplus address bits of head for cylinder or sector addressing. (You can not imagine the hard disk drive has 256 disk surfaces, can't you ?) Therefore, cylinder, head and sector addresses of INT13 BIOS are logical addresses, they do not represents physical hard disk structure. Actually, you do not have to care about this to understand this document.
Let me do simple calculation.
How many sectors can be addressed by CCC-HH-SS (cylinder, head and sector) address introduced in previous section ?
Formula of disk capacity calculation is follow.
Disk capacity = Number of cylinders X Number of heads X Number of sectors X Sector size
Therefore, capacity is 0x400 X 0x100 X 0x3F X 512 = 8,455,716,864 bytes. (Note: Sector address begins 1)
So that, INT13 BIOS interface can address up to just 8.46GB (Sometimes, it uses 1K=1024 rule. In this case, it shows 7.8GB)
We can buy a over 10GB hard disk drive nowadays. LBA mode address becomes available to access large disks. The LBA mode address starts with 0 and can access all sectors on the hard disk drive using sequential number. This is called 'INT13 Extension'. LBA mode addressing uses DAP (Disk Address Packet) data structure. 64 bits address area is available in the DAP. If sector size is 512 bytes, it can handle 9.4 X 10^21 bytes disk ! In fact, the MBRSCAN handles only 32 bits. Even though, the MBRSCAN can access up to 2TB. It might be okay for a while.
If the target disk is IDE drive, we should consider about limitation of IDE interface.
The IDE interface has 16 bits for cylinder, 4 bits for head and 8 bits for sector address.
So total number of address bits are 28 bits.
If we can utilize all of 28 bits, we can address 268,435,456 sectors.
According to ANSI documents, 'Total number of user addressable sectors' which returned by IDENTIFY DEVICE command will be 1 thru 268,435,455.
Let me use this value.
If sector capacity is 512 bytes, we can address up to 136,438,952,960 bytes or 137GB (in 1K=1024, 128GB).
Detail of INT13 Extension is available at web site of Phoenix Technologies Ltd.
Please refer documents named Enhanced Disk Drive Specification.
I explained disk capacity in focused on the INT13 interface specification.
Now, going to look at limitation of the IDE interface specification.
IDE interface has 16 bits for cylinder address, 4 bits for head address and 8 bits for sector address.
Therefore, maximum capacity of the IDE is 0x10000 X 0x10 X 0xFF X 512 = 136,902,082,560 bytes.
In early phase of INT13 BIOS, BIOS just passed CCC-HH-SS address of INT13 BIOS call to IDE interface.
So that, usable address bits were limited by smaller value of each interface as following chart.
| INT13 BIOS | IDE Interface | Accessible | |
|---|---|---|---|
| CYLINDER | 10 bits | 16 bits | 10 bits |
| HEAD | 8 bits | 4 bits | 4 bits |
| SECTOR | 6 bits | 8 bits | 6 bits |
| CAPACITY | 8.46GB (7.875GB) | 137GB (127.5GB) | 528MB (504MB) |
| EIDE (Non LBA) | - | Non EIDE |
When beginning to write this text I thought that LBA mode 137GB disk is large enough. However, I finally got a 160GB HDD for my home PC. It is over 137GB of limit which I wrote in IDE limitation clause. It is called as Big Drive. It accesses using a 48 bit LBA address. IDE physical interface is not changed to achieve this. 48 bit LBA address is divided 2 parts and then send out to IDE interface. Accessible sectors are 281,474,976,710,655 sectors (according to addressable sectors obtained from IDENTIFY DEVICE). If it calculates by 512 bytes/sector, capacity is 144,115,188,075,855,360 bytes, about 144PB (in 1k = 1024, 128 PB). It is the standard which is likely to last long this time ?
INT13 Extension already has 64bit address field. So that, no change required to BIOS interface to support Big Drive. If your BIOS supprts 48 bit LBA, MBRSCAN will also work on Big Drive.
I have never seen any documents which described details of partition table. Let me explain partition table based on my understanding. If somebody knows good documentation for partition table, please let me know.
Master Boot Record is usually called MBR.
Which is a sector has smallest address of the hard disk drive.
And it is read when PC boots from the disk and includes a bootstrap program.
You may found first byte of the MBR is 0xEB.
It is a relative jump instruction.
And bootstrap program followed by program name, directory and file system information.
Partition table is also included in this sector.
Partition table starts at offset 0x01BE and 16 bytes each total 4 entries are included in the sector.
Last 2 bytes of the sector are 0x55AA as signature.
There are 4 entries in a partition table.
Offset address for each entries are 0x1BE, 0x1CE, 0x1DE and 0x1FE.
A partition table entry consists of following elements.
| OFFSET | LENGTH | ||
|---|---|---|---|
| 0x00 | 1 | STATUS | Bootable or not |
| 0x01 | 3 | START CCHHSS | Start address of a partition (INT13 format) |
| 0x04 | 1 | PARTITION ID | |
| 0x05 | 3 | END CCHHSS | End address of a partition (INT13 format) |
| 0x08 | 4 | START SECTOR | Start sector address of a partition |
| 0x0C | 4 | NUMBER OF SECTOR | Partition size |
Partition defines in the MBR called 'primary partition'.
+- MBR -+ +--------------------+
| | +--->| Drive C: | STATUS = Active
|-------| | | |
01BE |ENTRY 0|---+ +--------------------+
|-------| | Another Drive C: | STATUS = Inactive
01CE |ENTRY 1|------->| |
|-------| | |
01DE |ENTRY 2|->Empty | |
|-------| | |
01EE |ENTRY 3|->Empty | |
|-------| | |
| 55AA| | |
+-------+ | |
+--------------------+
Extended partition is defined in the primary partition to make more partitions. One or more partition tables are defined in the extended partition,
+- MBR -+ +--------------------+
| | +--->| Drive C: | STATUS = Active
|-------| | | |
01BE |ENTRY 0|---+ +--------------------+
|-------| +->| Another Drive C: | STATUS = Inactive
01CE |ENTRY 1|-----+ | |
|-------| +--------------------+
01DE |ENTRY 2|------->| Extended Partition |
|-------| | |
01EE |ENTRY 3|->Empty | |
|-------| | |
| 55AA| | |
+-------+ | |
+--------------------+
Extended partition defined in the MBR includes all logical disks.
Logical disks are included in a extended partition defined in the MBR. Each logical drive has a partition table. First sector of the extended partition includes first partition table. First entry of the partition table in extended partition defines a logical disk and following entry defines next partition table and logical disk pair (Partition ID is same as extended partition). Remaining entries are empty tables.
+--- EXTENDED PARTITION --------------------------------+ | _____+--------------+ --- +--------------+_____ | | | |--------------|___ A |--------------| | | | | |--------------| | | |--------------| | | | | |--------------| +->| |--------------| | | | | --- +--------------+ | +--------------+ --- | | | | A | Drive D: | | | Drive E: | A | | | +->| | | | | | |<-+ | | | | | | | | | | | V | | V | | V | | --- +--------------+ --- +--------------+ --- | +-------------------------------------------------------+
Start sector address of partition table in extended partition is relative address.
| BASE ADDRESS | |
|---|---|
| Extended | Start address of extended partition defined in the MBR |
| Logical Disk | Absolute Start Address of upper level extended partition |