CHAPTER 5 PC-BASED PARTITIONS 3. When an entry for a non-extended partition is processed, its starting sector and size are displayed. The ending sector address can be determined by adding the starting sector address and the size together and subtracting one. DATA STRUCTURES The previous section reviewed the DOS partition system. This section provides a detailed discussion of the structures that make the system work. If you are not interested in data structures, you can skip this; however, there is an interesting example of extended partitions. This section is organized into three subsections describing the MBR, extended partitions, and show tool output from an example image. MBR Data Structure DOS Partition tables exist in the MBR and in the first sector of each extended partition. Conveniently, they all use the same 512-byte structure. The first 446 bytes are reserved for assembly boot code. Code needs to exist in the MBR because it is used when the computer is started, but the extended partitions do not need it and could contain hidden data. The MBR layout in tabular form can be found in Table 5.1. Table 5.1 Data structures for the DOS partition table. Description Boot Code Byte Range Essential 0-445 No 446-461 Partition Table Entry #1 (see Table 5.2) Yes 462-477 Partition Table Entry #2 (see Table 5.2) Yes 478-493 Partition Table Entry #3 (see Table 5.2) Yes 494-509 510-511 Partition Table Entry #4 (see Table 5.2) Signature value (OxAA55) Yes No The partition table has four 16-byte entries. The entries' structures are given in Table 5.2. Note that the CHS addresses are essential for older systems that rely on them, but are not essential on newer systems. Table 5.2 Data structure for DOS partition entries. Byte Range Description Essential 0-0 Bootable Flag No 1-3 Starting CHS Address Yes 44 Partition Type (see Table 5.3) No 5-7 Ending CHS Address Yes 8-11 Starting LBA Address Yes 12-15 Size in Sectors Yes The bootable flag is not always necessary. The standard boot code for a system with only one OS looks for an entry whose flag is set to 0x80. For example, if a system has Microsoft Windows on it and the disk is partitioned into two partitions, the partition with the operating system on it (C:\windows, for example) will have the bootable flag set. On the other hand, if the boot code prompts the user to choose which partition to boot from, the bootable flag is not necessary. Although, some boot programs will set the bootable flag after the user chooses to boot that partition. The starting and ending CHS addresses have an 8-bit head value, a 6-bit sector value, and a 10-bit cylinder value. In theory, either the CHS addresses or the LBA addresses need to be set for each partition, but not both. It is up to the OS and the code that is used to boot the system to determine which values need to be set. For example, Windows 98 and ME use the CHS addresses for partitions in the first 7.8GB of the disk, but Windows 2000 and beyond always ignore the CHS addresses [Microsoft 2003]. Some partitioning tools set both when possible for backward compatibility. The usage of these fields is application-dependent. The partition type field identifies the file system type that should be in the partition. A list of common partition types is given in Table 5.3. A more detailed list of partition types can be found in Partition types [Brouwer 2004]. Table 5.3 Some of the type values for DOS partitions. Туре Description 0x00 Empty 0x01 FAT12, CHS 0x04 FAT16, 16-32 MB, CHS

CHAPTER 5 PC-BASED PARTITIONS 3. When an entry for a non-extended partition is processed, its starting sector and size are displayed. The ending sector address can be determined by adding the starting sector address and the size together and subtracting one. DATA STRUCTURES The previous section reviewed the DOS partition system. This section provides a detailed discussion of the structures that make the system work. If you are not interested in data structures, you can skip this; however, there is an interesting example of extended partitions. This section is organized into three subsections describing the MBR, extended partitions, and show tool output from an example image. MBR Data Structure DOS Partition tables exist in the MBR and in the first sector of each extended partition. Conveniently, they all use the same 512-byte structure. The first 446 bytes are reserved for assembly boot code. Code needs to exist in the MBR because it is used when the computer is started, but the extended partitions do not need it and could contain hidden data. The MBR layout in tabular form can be found in Table 5.1. Table 5.1 Data structures for the DOS partition table. Description Boot Code Byte Range Essential 0-445 No 446-461 Partition Table Entry #1 (see Table 5.2) Yes 462-477 Partition Table Entry #2 (see Table 5.2) Yes 478-493 Partition Table Entry #3 (see Table 5.2) Yes 494-509 510-511 Partition Table Entry #4 (see Table 5.2) Signature value (OxAA55) Yes No The partition table has four 16-byte entries. The entries' structures are given in Table 5.2. Note that the CHS addresses are essential for older systems that rely on them, but are not essential on newer systems. Table 5.2 Data structure for DOS partition entries. Byte Range Description Essential 0-0 Bootable Flag No 1-3 Starting CHS Address Yes 44 Partition Type (see Table 5.3) No 5-7 Ending CHS Address Yes 8-11 Starting LBA Address Yes 12-15 Size in Sectors Yes The bootable flag is not always necessary. The standard boot code for a system with only one OS looks for an entry whose flag is set to 0x80. For example, if a system has Microsoft Windows on it and the disk is partitioned into two partitions, the partition with the operating system on it (C:\windows, for example) will have the bootable flag set. On the other hand, if the boot code prompts the user to choose which partition to boot from, the bootable flag is not necessary. Although, some boot programs will set the bootable flag after the user chooses to boot that partition. The starting and ending CHS addresses have an 8-bit head value, a 6-bit sector value, and a 10-bit cylinder value. In theory, either the CHS addresses or the LBA addresses need to be set for each partition, but not both. It is up to the OS and the code that is used to boot the system to determine which values need to be set. For example, Windows 98 and ME use the CHS addresses for partitions in the first 7.8GB of the disk, but Windows 2000 and beyond always ignore the CHS addresses [Microsoft 2003]. Some partitioning tools set both when possible for backward compatibility. The usage of these fields is application-dependent. The partition type field identifies the file system type that should be in the partition. A list of common partition types is given in Table 5.3. A more detailed list of partition types can be found in Partition types [Brouwer 2004]. Table 5.3 Some of the type values for DOS partitions. Туре Description 0x00 Empty 0x01 FAT12, CHS 0x04 FAT16, 16-32 MB, CHS