Master Boot Record
The Master Boot Record ( or MBR ) is the first sector of a partition allocated in storage medium such as a hard disk. The MBR contains a partition table that describes the distribution of the data carrier and, optionally, for BIOS-based computer (x86, IBM - PC compatible ) a boot loader that program in the boot sector, which in Chainloading principle the boot loader of the operating system on one of the partitions starts.
- 2.1 Boot Loader
- 2.2 disk signature
- 2.3 Partition Table 2.3.1 Structure of the partition table
- 2.3.2 Important partition types, their identification numbers
- 2.3.3 Primary and Extended partition table
- 3.1 DOS and MS- DOS - based Windows versions
- Windows NT 3.2 to Windows XP
- 3.3 Microsoft Windows Vista and 7
- 3.4 Linux (and some UNIX variants ) 3.4.1 GRUB
- 3.4.2 LILO
- 3.4.3 Installation, Backup and Uninstall
Historical development
When the IBM PC was developed storage media were not initially divided into partitions. The original version of the IBM PC, the model 5150 from 1981, had two 5 ¼ " 160 KB floppy drives. The actual bundled operating system PC DOS 1.0 (MS- DOS 1.14) could only deal with this particular configuration then.
The BIOS, a new development for the IBM PC, expected at position CHS 0:0:1 ( track 0, head 0, sector 1 ) to 512 bytes large boot sector, invited these into memory and executed him. PC DOS 1.0 at this point contains a boot sector that emanates from this fixed configuration: 160 KB Memory Cards with 8 sectors per track.
With the release of the IBM PC XT 1983 newer floppy drives and a hard drive for the first time were introduced. The boot sector therefore had to be adjusted because it could no longer be assumed that a fixed configuration. With PC DOS 2.0 (MS- DOS 2.0 ) was introduced, therefore, for the floppy disk boot record ( VBR ), the parameter block ( BPB short ) contains a boat for the different disk formats and is evaluated by the code in the VBR. Thus, disks with 9 sectors per track could be used for the new 360 - kB drives and other future floppy geometries were made possible by. For the hard disk master boot record was introduced, which now allowed a partitioning. Another of the introduction of hard drives innovation were owed subdirectories that were separated with the backslash "\". (See FAT file system ).
For compatibility reasons, the Convention to load the boot sector into memory and run was maintained and should not be injured in disks with multiple partitions. The partition table is thus placed within the boot sector. The function of the bootloader is modified such that the program code in the MBR first evaluates only the partition table and contained in Chainloading principle invites the actual boot loader of the active partition and executes it. The firmware ( BIOS ) of the computer therefore needs to know nothing about partitions.
Synonyms
The Master Boot Record (MBR ) is sometimes referred to erroneously as a partition sector (English "partition sector" ). He is often perceived as partition table, although in addition to this also a program (English master boot code) is included, which evaluate the actual partitioning, and consequently to load the first sector of the active partition.
Even the term master boot sector ( boot sector → ) is not correct, although it materially speaking actually is a sector that contains the boot code and including the partition table.
The role of the MBR in the boot process
The statement, the BIOS would seek the active partition and start the boot sector (VBR ) of this partition is generally wrong, because most BIOSes run the program code of the MBR in order to remain compatible with the historic IBM PC. Only this machine code contained in the MBR reads the partition table, find the active partition, and then starts the first sector of that partition.
However, some manufacturers developed BIOS versions with additional features, such as a menu selection to allow booting from any partition; also functions reload more manufacturer-specific programs from one partition are common. This provides, for example, IBM / Lenovo on many laptops, the ThinkPad series, in the form of a " service partition ", whose programs can be launched directly from the BIOS out. In many Compaq models turn the BIOS setup can only be reached via external programs: the F10 key to be pressed by the user during the BIOS phase to configure the BIOS is only available if a only provided for the purpose DOS operating system, including setup and diagnostic programs in a special partition (type 0x12 ) is present on the first hard disk. Alternatively, this BIOS only configure a boot disk with the corresponding programs.
Although the IBM PC originally supported any kind of boot code, examine some BIOS versions prior to the start if a valid partition table exists. If a PC system uses only the MBR, the user notices them in almost all cases nothing, but this leads, for example, in the use of GPT - formatted disks to the fact that the startup process is interrupted by that BIOS or a start by even is basically impossible. Also can be started on such BIOSes no operating systems that do not use MBR or need (such as FreeBSD or self-built operating systems). Even if a valid MBR is present check some BIOS versions, in addition, whether an active primary partition exists and whether it contains a boot sector. This behavior causes an operating system with the boot loader is installed in the MBR itself and therefore does not mark partition as active, and can not start the BIOS instead outputs a most ambiguous error message.
Structure of the MBR
Bootloader
The boot loader (English master boot code numbered) of the master boot record is a small program that is invoked by the BIOS. This loads the boot loader always in the 8086 -compatible 16 -bit mode "Real Mode". Normally, this searches the partition table for " visible " and " active " partition, loads the boot sector of the first active partition and executes it. Thus the actual operating system is then loaded in Chainloading process.
This bootloader may be replaced or extended by specifically intended programs. Is quite popular, boot manager, the switch in front of the master boot code, by outsourcing these and replace the MBR to instead display a selection menu or the like, thus allowing, for example, starting from any partition. Also, there is disk manager which BIOS limitations to deal with geometry implementation (eg, to provide Logical Block Addressing ). Such programs often use a separate partition or reserved ( unpartitioned ) space on the hard disk of the other files or other program code is loaded.
Also boot viruses use the boot loader of the MBR to be already activated before the actual operating system startup.
A missing or defective bootloader means that the disk can not be started, even if an operating system with an intact boot sector is present in one of the partitions. Because some boot loader load additional files, there is a fault, even if indeed the MBR and the partition of the operating system are intact, but the files of the boot loader is corrupted or missing.
Disk signature
The disk signature is used by Windows 2000 and XP, to uniquely identify volumes that are provided with a classical partition table ( called Microsoft Basic Disk ). Thus, the disk signature, for example, in the assignment of drive letters to partitions crucial: While previous versions of Windows rely on the values determined by MS- DOS drive letter, these assignments are from Windows 2000 HKLM in registry keys, including \ SYSTEM \ MountedDevices stored. For certain system configurations, the disk signature is also used in the boot.ini file, which is part of the bootloader of Windows NT ( NTLDR ). Windows assigns the disk signature when initializing a new disk.
In particular, according to data backups may encounter some problems associated with the disk signature:
- A system configuration that exist in the two disks with the same disk signature, such as an original disk and a disk with a bit- identical copy is not assigned a drive letter in the system.
- A copied system partition is assigned, under certain circumstances, a new drive letter. In such cases, the boot process fails.
The fixmbr command in the Recovery Console in Windows XP can the signature unchanged. In contrast, the command fdisk / mbr, which rewrites the boot code refreshes, the disk signature on.
The Linux command dd if = / dev / zero of =
Partition table
The partition table provides information about the partitions on a disk. If it is incorrect or missing even completely, the access to the data from the disks is not readily possible. In many cases, however, the partition table with programs like TestDisk can recover. The entry for each partition contains two CHS addresses ( the start and the end address ) as well as a 32 -bit long LBA address and 32 -bit long LBA partition size. This can be personalized with conventional partition tables on CHS addressing a maximum of about 8 GB (approx. 7.8 GiB ) large disk and LBA addressing just over 2 TB ( just under 2 TiB ) large partitions or slightly more than 4 TB ( nearly 4 TiB ) large volume use (if supported by operating system). In order to address larger volumes or partitions, the successor technology to GUID Partition Table (GPT ) must be used or the sector size can be enlarged.
Construction of the partition table
As explained below, there are primary and extended partition table. Their structure is identical. The table is located at byte 446 ( 1BEhex ) of the sector and has a maximum of 4 entries of 16 bytes, so it is 64 bytes. This is followed by the magic number, which of the two byte 55hex and AAhex to the byte 510 ( 1FEhex ) and 511 ( 1FFhex ) of the sector is.
The adjacent table illustrates the location of the partition table (inside the boot sector ). The four partition entries are highlighted. Yellow, green, cyan and blue are the entries for the four primary partitions. The signature is red.
Such an entry is structured as follows:
Unused entries are filled with zeros.
The CHS entries are coded as follows:
The cylinder from 0 to 1023, the heads 0-254 and the sectors 1 to 63 are counted.
Addressing by CHS (1024 × 255 cylinder heads × 63 sectors × 512 bytes) allows unique addressing only with hard drives up to 8.4 GB or 7.8 GiB. In such a ( relatively small ) plates so a conversion from CHS to LBA be made. Today's hard drives have but usually much larger capacities. The CHS values obtained therefore their maxima simplified with " 1023, 63, 254 ", the actual disk size is, however, indicated by the Logical Block Addressing ( LBA). For the limitation of the sector specified in the " IBM PC compatible " partition entry to 32 bits and there usual sector size of 512 bytes, a maximum partition size of just under 2 TiB results ( ( 232-1 ) × 512 bytes). If one divides a disk into more than one partition and leaves the last partition with maximum partition size on the last LBA sector start, so can a 4.4TB (about 4 TiB ) use large hard disk almost completely. Condition is that the previous ( n ) partition (s ) has not yet come into the sum of the 2 TiB limit, the last addressable LBA sector is thus still available for the last partition, otherwise the creation of these last partition fails.
Older operating systems may have restrictions on the volume size. For example, Microsoft Windows XP 32 to just under 2.2 TB ( ( 232-1 ) × 512 bytes ) is limited. A larger disk can also be checked in the unpartitioned state with the wrong size. The triggered overflow leaves the eg about 3 TB of disks, only about 800 GB in size appear. Write accesses could have data loss.
For larger logical sector sizes increase these limits accordingly ( eg 4KB sectors on 32 TiB or TiB 16 ), but allows legacy operating systems such as Windows XP only boot from disk with 512 byte sectors.
Important partition types, their identification numbers
The entry at offset 0x04 stands for, inter alia:
- Complete list of the Technical University Eindhoven ( English)
Primary and Extended partition table
In a partitioned medium on the PC 's primary partition table is placed in front of the signature at the end of the first sector (Master Boot Record). The partitions in the partition table of the MBR are called primary partitions. However, a single partition in the MBR can also be labeled as extended (extended, Type 5 or Fhex ). This will link the entry boot sector on the first extended partition table.
This is located in the first sector of the extended partition. Each extended partition table defines exactly one logical partition and references if necessary to the next extended partition table. The extended partition tables operate on the principle of the linked list, so many logical partitions are allowed behind the primary partitions. The length of the entry of the type 5 in the MBR partition the sum of all concatenated logical partitions is registered. As always, a sector of the extended partition table is occupied, can extended and logical partition not be exactly the same size.
In an extended partition table thus up to the first two entries are used. The boot sectors are not given here relative to the beginning of the disk:
- The first entry describes the logical partition. Its boot sector is always given relative to the position of the current partition table.
- The second entry can contain a daisy chain to another extended partition table, and always has the type 5 in boot sector of this entry will always be referenced relative to the first extended partition sector.
Old operating systems always wait for the start of a partition to cylinder boundaries. Therefore, there is still widespread operating systems at a gap of 63 sectors between extended partition table and the boot sector of the corresponding logical partition. These sectors in the gap can, for example, for a boot manager or hiding of "secret" information, but are also used by boot sector viruses. There, too, a BIOS extension was previously housed to also support hard drives larger than 8 GiB, if the motherboard BIOS was unable to.
Due to the development through to 4- kiB sectors but an alignment of 63 sectors is extremely unfavorable. Therefore, recently a gap of 64 is used. Other powers of two are common.
MBR signature
(Also called Magic Number ) The MBR signature consists of the 2-byte 55hex and AAhex. This is interpreted as a 16 -bit number AA55hex on little-endian systems. If the signature is present, the BIOS assumes that a valid MBR is present. If the signature is not found, the BIOS suspects a new or deleted volume. The boot sequence will be aborted and an error message about "Non - System or Non- Bootable Disk " is displayed. Of course, a correct signature is no guarantee for valid boot code in the MBR. It merely serves to prevent empty MBR or MBR are performed with random data.
Even with discs that are not used for booting, a missing signature can have an impact. There are BIOS versions, run the disk without a valid signature in a slower mode. Prior to the velocity measurement ( benchmark), for example a new volume is therefore advisable to first initialize the MBR of that disk.
MBR different operating systems
Create Many popular operating systems or add default when installing the MBR so that the operating system can be started.
DOS and MS- DOS - based Windows versions
Under DOS, the MBR can be viewed and edited with non- partitioned media with the DOS belonging to debug. If the disk is partitioned, however, as can be seen with debug only the boot sector ( boot record ) of any partition. To access the MBR, a disk editor (such as Diskedit.exe, PTEdit.exe etc. ) is required. MS -DOS and the building on MS- DOS Windows versions ( Windows 95 and Windows Me) overwrite the boot loader on the MBR when installing without regard to its previous content.
In case of error in the MBR can be written under DOS with the undocumented command fdisk / mbr a new standard Master Boot Record. The entire MBR is overwritten with the exception of the partition table, boot sector viruses which can be removed if the virus does not recognize the write access to the Master Boot Record and intercepts. However, in this approach also any existing boot manager is removed because its instructions are overwritten by the default code of MS -DOS.
Windows NT to Windows XP
Some Microsoft Windows versions of the NT line, including XP, but not NT 4 and 2000, overwrite the boot loader ( the first 446 bytes of the MBR) with each new installation as well, but still consider available information about an older Microsoft operating system, so MS -DOS and other Windows versions based on it. In this case, the NTLDR is pre-configured with a choice between the various installed Microsoft operating systems.
For Windows 2000, XP and 2003, there is the Recovery Console, here is the command for fixmbr to repair the MBR (excluding the disk signature ) and fixboot to repair the boot sector of a partition (both fixed commands only on x86 systems).
Microsoft Windows Vista and 7
Unlike older NT-based Windows systems, Vista starts from the boot sector of the boot loader " BOOTMGR " ( under NT / XP was the " ntldr "). BOOTMGR extracts the information about the booting operating system is not the boot.ini file, but the file \ Boot \ BCD, which are either located on the EFI system partition, or directly on the system partition in BIOS systems. In the boot process BOOTMGR compares the disk signature (bytes 440-443 in the MBR ) with its saved boot entries from the BCD file. If the disk signature changed, Windows will refuse to start with a " winload error". The BCD file is in contrast to the boot.ini no simple text file, but a binary file (specifically in construction a Hive ) and can not be edited with a normal text editor. To edit the BCD file has its own tool called bcdedit.exe. It can be invoked in a running Windows (or an appropriate Windows PE CD ) on the command line. Alternatively, when booting from the Windows CD on the item " Repair your computer / System Recovery Options " the tool Bootrec.exe be invoked at the command prompt. bootrec / fixmbr to write a new MBR, bootrec / fixboot a new boot sector to the system partition.
Linux (and some UNIX variants )
Linux distributions and Solaris usually install the boot loader GRUB, rare the older LILO, SYSLINUX or another. GRUB is able to boot different operating systems (eg Linux, BSD, OSX or MS Windows).
GRUB
At system startup, the "Stage 1" of GRUB is first read from the MBR and executed. It 's only job is to find the so-called "Stage 2 ". Either the sector of the disk, where the "Stage 2 " begins, stored in the "Stage 1" or it specifies the partition number and the file path. In the first case is directly the "Stage 2 " is loaded. In the second case, first, the " Stage 1.5 ", which consists of a file system drivers are loaded from the boot sector of a partition. The 'Stage 2' is Unix-like operating systems, usually in the file / boot/grub/stage2. The "Stage 2 " reads the configuration from / boot / grub / menu.lst or / boot / grub / grub.cfg one, shows a boot menu and then loads the kernel and its image or starts the boot loader from another operating system, such as Windows.
LILO
LILO all necessary for booting the data is written directly to the MBR. LILO starts immediately the first sector of the kernel. The LILO configuration file (/ etc / lilo.conf ) serves only the program / sbin / lilo to generate an MBR. At the start of the system is just the MBR generated by / sbin / lilo involved. This simple concept is lost a lot of flexibility. So must be written for each change to the kernel or to the boot options a new MBR. Boot manager like GRUB or Syslinux values each time you reboot, your configuration file, and are sometimes even able to modify this during the boot menu.
Installation, backup, and uninstall
With the command "grub set / dev / sda " ( LILO: "lilo / dev / sda " ) is the "Stage 1" GRUB written to the MBR and, if provided, the " Stage 1.5 " in the boot sector of a partition. Linux gives you the piece of code (including partition table ) of the MBR (see above), usually with the command "dd if = / dev / hda of = file bs = 512 count = 1" ( / dev / hda for IDE, / dev / sda for SCSI, SATA, IEEE 1394 - Save or USB storage media) in a file as a backup. Sufficient to recover analog " dd of = / dev / hda if = file conv = notrunc ". Since this procedure but rewrites the entire first sector of the disk, one has meanwhile been amended partitioning lost again! Therefore, it is recommended to create a new backup copy of the MBR after each repartitioning.
Can you delete the GRUB or LILO MBR with the command "dd if = / dev / zero of = / dev / hdx bs = 512 count = 1 conv = notrunc ". Here, the boot code of the MBR and the partition table is overwritten (part of 512 bytes large sector! ) With zeros. If the partition table is to be retained and only the actual boot code rewritten, you have to run dd with a block size of 1 byte and may only write the first 440 bytes: dd if = / dev / zero of = / dev / hdx bs = 1 count = 440 conv = notrunc.
Also installing another boot loader (eg NTLDR ) deletes usually the boot code of the previously installed system completely, but leaves the partition table untouched.
MBR with EFI -based computers
EFI -based computers come instead of the MBR partition table the newer GUID Partition Table (GPT ) is used. For backward compatibility, each contains a so-called GPT Protective MBR. This ensures that operating systems or programs, not yet cope with the GPT, instead of seeing a blank disc a single partition that goes over the whole disk. This Protective MBR can also use it to install MBR -based operating systems on EFI-based computers by the partitions of the GPT are mapped to the MBR partition table. This trick uses Apple at its Boot Camp software that allows installation of non- GPT -compatible older versions of Windows on Intel-based Macs. The EFI application rEFIt can synchronize with the program gptsync GPT and MBR partition table.