Partition Tables Explained

By hankcurt

Many people have difficulty understanding how the partition table on their hard drive works. The master boot record (MBR) contains the partition table, which contains the location of up to four primary partitions on the disk. One primary partition may be designated as a logical partition, allowing an operating system to treat that primary partition as any number of logical partitions. We will not discuss logical partitioning in this article. The information for each partition is 16 bytes long (each byte is usually shown as a pair of hex digits, e.g. 0f).

Here's a typical partition table entry.

0001b0 00 00 00 00 00 00 00 00 48 04 07 c9 00 00 80 01
0001c0 01 00 06 0f ff e0 3f 00 00 00 b1 45 0f 00 00 00
0001d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0001e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa

There is only one partition on this drive, and the information that describes it is at address 0x01be to 0x01cd (the red numbers in the table above). If there were more, the second partition's data would be those shown in green, the third partition in purple, and the fourth partition in brown. I'll copy those numbers for the single partition below, and color code them for easier reference.

80 01 01 00 06 0f ff e0 3f 00 00 00 b1 45 0f 00

The first hex number (red) gives two pieces of information. If it is 00, then the partition is not the active partition (does not contain the boot loader). If it is 80 or greater, as in the example, this means it is the active (bootable) partition. Only one partition can be marked as active. The second piece of information applies to fixed disks. If the first fixed disk contains the active partition, this number will be 80. If it were the second fixed disk, this number would be 81, and so on.

There are two ways that the location of the partition is specified in the partition table entry. The first is the Cylinder Heads Sectors method (CHS). The three light blue numbers (01 01 00) specify the CHS location where the partition begins, and the three dark blue numbers (0f ff e0) specify where it ends. Sectors are the smallest unit of space and cylinders are the largest unit of space. Or to put it another way, there are so many sectors per head, and so many heads per cylinder (this is important when you try to do math with these values).

Now to extract the actual values from the hex numbers above. Sorry, but this gets tricky, and I don't know if I can explain it well. The Heads value is easy, it is the value of the first byte and can be from 0 to 255 (decimal). To get the other two values, we have to convert the hex numbers to binary. The Sectors number is the lower six bits of the second byte and can have a value from 1 to 63. To get the Cylinders value, we take the remaining two bits from the second byte and add them to the high end of the bits from the third byte. These 10 bits allow for a cylinder value from 0 to 1023. I will demonstrate with the CHS values from the example.

Partition Starting Location

1st Byte  2nd Byte  3rd Byte
   01       01       00
   01                       Head 1
         00000001 00000000  Bytes converted to bits
         XX000001           Sector 1
         00-----> 00000000
                 0000000000 Cylinder 0

Partition Ending Location

1st Byte  2nd Byte  3rd Byte
   0f       ff       e0
   0f                       Head 15
         11111111 11100000  Bytes converted to bits
         XX111111           Sector 63
         11-----> 11100000
                 1111100000 Cylinder 992

Since a partition always ends on a cylinder boundary, we can tell that the drive geometry is 63 sectors per head and 16 heads per Cylinder (counting head 0). So the partition begins on the first sector of the second head (remember head 0) on the first cylinder. Since there are 63 sectors per head, the partition begins on the 64th sector. To see which sector the partition ends on, we would multiply 993 cylinders (remember there is a cylinder 0) times 16 heads times 63 sectors. This gives us 100944.

The Cylinder Head Sector method only works on drives up to 8 gigabytes because that is the maximum size that can be specified with the three bytes. To get around this, a second method of specifying the location of the partition is used. It is called Logical Block Addressing, and it uses the last eight bytes in the partition table entry. These bytes give the location of the partition by counting the number of sectors from the start of the disk, which is much simpler. The four bytes in green (3f 00 00 00) give the number of sectors before the partition, and the following four bytes (b1 45 0f 00) give the length of the partition.

8001 01 00 060f ff e0 3f 00 00 00 b1 45 0f 00

We have to know just one thing to interpret these bytes. They are in "little endian" order. This means that the lowest "place value" is held by the first byte. So to use them like we use ordinary numbers, we just have to reverse the order of the bytes. So 3f 00 00 00 becomes 0000003f and b1 45 0f 00 becomes 000f45b1. Now we can convert these numbers to decimal. This tells us that there are 63 sectors before the partition begins at the 64th sector, and it is 1000881 sectors long. Thus the partition ends at sector 1000944. Notice that this is the same result we got with the CHS math.

Last Piece of the Puzzle

In the partition table entry, the hex number 06 (in purple) tells which type of file system the partition contains, and whether the Cylinder, Head, Sector (CHS) or the Large Block Addressing (LBA) system is to be used to locate the partition. Here is a brief listing of file systems.

01

DOS file system with 12 bit file allocation table

06

DOS file system with 16 bit file allocation table and CHS system is used to indicate the partition location

0e

DOS file system with 16 bit file allocation table and LBA system is used to indicate the partition location

0b

DOS file system with 32 bit file allocation table and LBA is almost always used, however if the partition is in the first 8GB of the disk, the CHS numbers should be set correctly, otherwise, if the partition is past the 8gb boundary, the CHS numbers should be set to their maximum value.

07

NTFS

81

Linux

83

Linux ext2fs

82

Linux swap

There are other file system types, but these are the ones you will most likely run into.

I got my information from these web pages and some wikipedia articles. Read these for more information:

http://home.att.net/%7Erayknights/pc_boot/w95b_mbr.htm
http://www.bitzenbytes.com/Content-Arcanum-18-1-14.html.

Top