Sponsored by:
Fully Managed Technology Services
Fully Managed Technology Services
|
For information on the UNIX/Linux fdisk programs: fdisk, sfdisk, cfdisk, etc., try the commands: "man fdisk" and "man sfdisk" (at your *nix console prompt). For the FreeFDISK
used by FreeDOS,
You can try emulating the MS-DOS
4.xx, 5.xx, 6.xx, 7.0 and 7.1 versions
of FDISK using FreeFDISK; or just use it as the official
fdisk of FreeDOS. A few other alternatives for the older MS-FDISK versions would be GDISK and GDISK32 from Norton Ghost, AEFDISK and the utility, Ranish Partition Manager, which can also format the partitions it creates (supports FAT12, FAT16 and FAT32). |
Reference Guides for Master Boot Record pages:
The Standard MBR created by versions of
FDISK.EXE from MS-DOS 3.30 through Windows 95 (with MS-DOS 7.0)
The MBR created by MS-Windows 95B, 98, 98SE (all
three being MS-DOS 7.1) and WinME's (MS-DOS 8.0) FDISK
Here's another important page which describes exactly:
What Does MS-FDISK
do to a Hard Disk Drive?
Index to this page:
Confused? If you have a specific question about the
MBR, FDISK or Volume Boot Records, you can Send
me an e-mail from here.
FDISK /MBR (for all of you who wanted
to know!)
No matter what version of FDISK you have (from MS-DOS
5.0 or higher that is), you can always enter the command: FDISK
/? at a DOS prompt, and your Windows machine should respond with:
Configures a hard disk for use with MS-DOS. [ Ah! And Windows too! ]
FDISK [/STATUS] /X
/STATUS Displays partition information. [ A nice safe switch. ]
/X Ignores extended disk-access support. Use this switch if you
receive disk access or stack overflow messages.
So, where's the /MBR
switch? Well, that's the reason it's often called an undocumented switch!
It's never displayed here; neither are any of the many others... But these various
switches are documented in a number of Microsoft books and web pages...
Especially in their Knowledge Base articles; see for example: 
FDISK /MBR Rewrites the Master Boot Record (Q69013) (which has a
nice summary of what this switch does). |
Conclusion:
Before you even have a problem that forces you to study
about the MBR... Make a binary copy of your Master Boot Record and
STORE it on two or more Floppy disks! |
MS-DOS 3.3 - Although
partitions still had a maximum capacity of 32MB, this version was the first to
introduce Extended DOS partitions*
(a maximum of 24 partitions using the drive letters C: through Z:). But, only
two physical drives were supported at that time.
Partition Type Capacity ranges from FAT type
-------------- -------------------- --------
01 0 through 15 MB 12-bit
04 16 MB through 32 MB 16-bit
05 Extended Partitions N/A
____________
*
Technically, MS-DOS 3.2
introduced an extended partition type first, but that version supported
only one logical drive apart from the primary partition.
MS-DOS 4.0 - Partition sizes increased to a maximum capacity of 2.1 GB, but full use of these partitions required the MS-DOS program Share.exe to be loaded first. A new partition type (06) was added for partition sizes over 32 MB.
Partition Type Capacity ranges from FAT type
-------------- -------------------- --------
06 32 MB through 2.1 GB 16-bit
MS-DOS 5.0 - The number of physical drives
which could be accessed increased to eight. (Share.exe no longer required for
large drives.) Although FDISK could still create only one Primary partition per
physical drive, a little known fact is that support for more than one Primary
MS-DOS partition was added to the MS-DOS 5.0 kernel.
OS Type Filename File Size Release Date ----------- --------- --------- --------------- MS-DOS 3.30 FDISK.COM 48,919 07-24-87 12:00a
MS-DOS 4.01 FDISK.EXE 60,935 04-07-89 12:00a (Only 3 copies of the MBR code can be found inside FDISK prior to MS-DOS 5.0) MS-DOS 5.0 FDISK.EXE 57,224 11-11-91 5:00a MS-DOS 6.2 FDISK.EXE 29,334 09-30-93 6:20a
MS-DOS 6.22 FDISK.EXE 29,336 05-31-94 6:22a (MD5 checksum is: 1b7010dcc3b84db402744751da321da8)
Windows 95(A) (MS-DOS 7.0) FDISK.EXE 59,128 07-11-95 9:50a
Windows 95B (MS-DOS 7.1) FDISK.EXE 63,116 08-24-96 11:11a
Windows 98 (MS-DOS 7.1) FDISK.EXE 63,900 05-11-98 7:01p
(MD5 checksum is: cf1024be244cb51adddf9aeaa8199084)
Windows 98 SE (MS-DOS 7.1) FDISK.EXE 63,916 04-23-99 10:22p (MD5 checksum is: 7da2cc665c38784c555225b727f7660e)
Windows ME (MS-DOS 8.0) FDISK.EXE 66,060 06-08-00 5:00p
[ Note:
Windows NT/2000/XP OSs do not have an FDISK program; in
order to partition a hard drive, they use what's called: the Disk Management
MMC which is built into the OS; we'll have more to say about this below.
]
Notes that Apply to All Versions of FDISK examined here
All of the FDISK.EXE files are
packed with at least one EXE packer. The older DOS files were
also PKlite'd to further reduce the overall size since DOS was sold on
floppy disks and users were still concerned about how little free
space they had on their 250 to 500 MB drives. [ Details on how to
unpack the files are available upon request. ]
|
Inside every FDISK program (from DOS version
5.0 or higher), there are nine duplicate copies of the code
for the MBR. Why does FDISK need nine copies? If anyone knows
for sure, please e-mail me
so I can post the info here. (The FDISK in DOS 3.30 through 4.01
has only three copies of the MBR code inside it; even so, why more
than one or at most two?) 
If you compare the bytes 'highlighted in yellow' with those on my page "95BMEMBR.htm", you'll find that this is indeed the code section of an MBR plus the "Magic Number" of AA55h. There are also some extra bytes (underlined in the pic above) which may be related to how many zero-bytes are to be placed in which locations by the program. |
NOTES on MBR Error Message Creation :
Ever since the original version of Windows 95 (or '95A' if you prefer), none of
the FDISK programs have included exact copies of the MBR code as they had in the
MS-DOS versions! The differences though are only related to its error messages:
none of the error messages appear in any of the nine copies of the MBR
within the FDISK program.
Instead, the error messages which FDISK places into the nine MBR copies are all
taken from a single location in the code. For Windows 95B,
the text appears between 3b1ah
and 3b6bh.
For Win ME, it's between 3d39h
and 3d8ah.
And here's a pic of this portion of the code which is exactly the same for both
Windows 98 and 98SE (and appears between offsets 3d35h
and 3d86h:
 |
|
| Note: The circled bytes (18h,
1Fh and 19h) are NOT part of the error messages; they're used by the FDISK program to simply count the number of bytes which follow that are to be copied to the final MBR code! For example, the first error message is 24 (18h) bytes long; including the ASCII-Z Zero byte (00h) string terminator. [1Fh is 31 bytes, and 19h is 25 bytes.] |
|
There are also two bytes in the nine copies of the MBR which are always
changed when the code is finally written to the hard disk: For example, in the
Windows 95A version of FDISK ( the Standard MBR ), these bytes are located
at 074h and 079h
(or 0674h and 0679h at execution time in memory). These are the bytes which
are used as pointers to the 2nd and 3rd error messages, and both of them contain
an 8Bh instead of the Standard MBR values
of A3h and C2h.
Thus, all three of the error msg. routines are pointing to the same byte where
the error messages would normally begin; only there's nothing but zero bytes
there (in its unpacked form that is) all the way from 8Bh
to the MBR sector's signature ID of AA55h
in these nine copies.
Perhaps, buried deep inside of the FDISK code, there's some way that the standard
error messages can be changed under certain conditions... but trying
to disassemble FDISK to determine this (something I might never be able to do
anyway!), is not a task I really want to bother with. Someone from Europe once
suggested that the reason for why they did this seemed rather obvious:
Because of all the different languages that FDISK's error messages must
be translated into (which vary in length from their original English versions).
However, since the error messages for other languages are already
contained in those versions of FDISK, just as they are in the English version,
this does not really explain why all the extra code is necessary;
code which would allow for the messages to be changed while the FDISK
program is running!
In the past, I started to think that this extra
programming might be related to the strange error messages I've seen in some
Windows 98/98SE MBRs which contain the phrase, "Setup
cannot continue." (see below), but there doesn't seem to be any
relationship between the two. The odd error messages (and the removal of the
third standard one!) always seem to be found in MBRs that were used by a CD-ROM
install of Windows 98.
[ If you can shed any light on why these program routines were created
and and how they are used, please send me an e-mail so I can post the
info here. ]
For reference, here's the same area (as shown in the pic above) for the French
version of Win98SE's FDISK:
1Bh
= 27 decimal
4130 65 63 20 2F 43 4D 42 52 2E 0D 0A(1B)54 61 62 6C ec /CMBR....Tabl 4140 65 20 64 65 20 70 61 72 74 69 74 69 6F 6E 20 65 e de partition e 4150 72 72 6F 6E 82 65 00(34)45 72 72 65 75 72 20 6C rron.e.4Erreur l 4160 6F 72 73 20 64 75 20 63 68 61 72 67 65 6D 65 6E ors du chargemen 4170 74 20 64 75 20 73 79 73 74 8A 6D 65 20 64 27 65 t du syst.me d'e 4180 78 70 6C 6F 69 74 61 74 69 6F 6E 00(20)53 79 73 xploitation. Sys 4190 74 8A 6D 65 20 64 27 65 78 70 6C 6F 69 74 61 74 t.me d'exploitat 41A0 69 6F 6E 20 6D 61 6E 71 75 61 6E 74 00 34 BD 04 ion manquant.4.. 34h = 52 decimal 20h = 32 decimalThe circled bytes above (1Bh, 34h and 20h) will, of course, vary for other languages whenever the length of their error messages are different.
MS-DOS 5.0, 6.2 and 6.22
All three of these FDISK programs are packed with
EXEPACK 5.31.009 (LINK 3.69), but the version 6 series is also PKlite'd (PKLITE
1.15). All three contain the phrase "MS Run-Time Library
- Copyright (c) 1988"*
. The DOS 5.0 program also contains the phrase "DOS
Version 5.00 (C)Copyright 1981-1991" while each of the DOS
6 files contain: "DOS Version 6 (C)Copyright 1981-" with version
6.2 ending in 1993 and version 6.22 ending
in 1994.
*
One reader states concerning the phrases found above: This is “a
tell-tale sign that this program was compiled with Microsoft C 5.1. The newer
version of EXEPACK was probably to avoid the bug that EXEPACKed programs do
not load below 64K without relying on the 20-bit address wraparound.”
The string of parameters which FDISK accepts on the command line looks like
this inside all three of these FDISK files:
/PRI /EXT /LOG /Q /STATUS /?
/MBR
Here's my page about all the other Undocumented FDISK.EXE Switches for DOS and Windows.
Windows 95(A)
Windows 95's FDISK contains the phrases: "MS
Run-Time Library - Copyright (c) 1992"*
and "MS-DOS Version 7 (C)Copyright
1981-1995"
The string of parameters is no different than that found in MS-DOS 6.2
*
The same reader we quoted above, adds here: This is a “sign that
the program was compiled with Microsoft C 7.0 or
Visual C++ 1.x.”
This version added support for two new partition types (0Eh and 0Fh) if the computer's BIOS had INT13 Extensions for the LBA (Logical Block Addressing) method of accessing the sectors on a large hard drive.
Partition Type Capacity ranges from FAT type
-------------- -------------------- --------
0E 32 MB through 2.1 GB 16-bit
0F Extended Partitions N/A
Both Windows 95B and 98 contain the same phrases and copyright dates as
those found in Win 95, but here we have a half-dozen new switches
that were added to the string of parameters which FDISK accepts on the
command line! The string looks like this inside FDISK:
/PRI /EXT /LOG /PRIO /LOGO /Q /STATUS /? /MBR
/X /ACTOK /CMBR /FPRMT
Win 95 OSR2 and Windows 98 introduced two new partition types for
the FAT32 file system: Partition Type Capacity ranges from FAT type
-------------- -------------------- --------
0B 512 MB - 2 terabytes 32-bit
0C 512 MB - 2 terabytes 32-bit
Type 0Ch requires the computer's BIOS to support the LBA method of
accessing large hard drive's using INT13 Extensions.
When you start FDISK, you'll be presented with the following notice:
Your computer has a disk larger than 512 MB. This version of Windows includes improved support for large disks, resulting in more efficient use of disk space on large drives, and allowing disks over 2 GB to be formatted as a single drive. IMPORTANT: If you enable large disk support and create any new drives on this disk, you will not be able to access the new drive(s) using other operating systems, including some versions of Windows 95 and Windows NT, as well as earlier versions of Windows and MS-DOS. In addition, disk utilites that were not designed explicitly for the FAT32 file system will not be able to work with this disk. If you need to access this disk with other operating systems or older disk utilities, do not enable large drive support. Do you wish to enable large disk support (Y/N)...........? [Y]
If you have an existing NTFS partition on your computer, you may also see the following:
Your computer has NTFS partitions which may require large drive support. If you are using another operating system, such as Windows NT, which supports large drives you should enable treating these partitions as large. NOTE: If you answer Y and the partition display looks incorrect or a hang or crash occurs do nothing, run FDISK again, and answer N to this question. Should NTFS partitions on all drives be treated as large (Y/N)? [Y]
Windows 98SE still contains the same
Run Time phrase and Copyright dates as Windows 95, but one new switch
was added near the end of the string of parameters inside FDISK:
/XMBR
For some strange reason, many Windows 98 users who examine their MBR will find the phrase: "Setup cannot continue." added to the end of each of the first two standard MBR error messages; and the third message has been eliminated altogether... because, I assume, there is not enough empty space remaining!
From the small amount of data I've gathered so far, it appears that these messages are created directly from a Windows CD-ROM installation. I can only guess that this might happen when using an OEM version vs. the full Retail version, but don't have enough data to know for sure.
If you see this message in your MBR, and know for
sure how your drive was first partitioned (by MS-FDISK from a Boot Diskette
or from a CD-ROM and which version, etc.), then please send me
the information. If you don't find these alternate 'error messages' in your
own MBR at the present time, you might find them near the end of a file on your
Win 98 drive called "SUHDLOG.DAT"
(this is a Hidden, Read-only file in C:\ and the messages were
in my file) which appears to be a record of the changes made to the MBR(s).
Windows ME's FDISK contains the new phrase: "MS-DOS Version 8 (C)Copyright 1981-1999" Except for that, this FDISK program is essentially the same as the Windows 98SE version.
Windows 2000/XP/2003
As stated above (at the end
of our "Versions" section), the Windows NT/2000/XP/2003 OSs do *not*
contain any FDISK program; although you will find a copy of FORMAT.COM inside
of any CMD or Command window (for use on floppy diskettes).
If you wish to partition a hard drive for use
by these or any other OS, you must run the Disk Management MMC
"snap-in" tool in the Computer Management window; it's
found under the item "Storage" (in a tree view). You can access
"Disk Management" from the "Administrative Tools"
menu; and must have Administrator privileges to use it.
NOTE: When using Windows 2000/XP to partition a drive, you should
never use what are known as Dynamic
Volumes; unless you have a very good reason for doing so!
The use of Basic Volumes will, for example, still allow you to
access an NTFS partition from a special DOS boot diskette, whereas you can not
do so if it's a Dynamic volume! At this
time, Dynamic volumes can only be accessed by your Windows boot OS, and make
data recovery much more difficult. Why? Because they move
the MBR and other system structures to a different (and varying) location
called a "private region database," and place a 42h
byte in what is then called the 'legacy' MBR's Partition Table entry/entries
for these volumes (to identify them and the disk as being Dynamic). For
more information, see
here. [ If you have Windows 2000/XP,
then look up 'Disk Management' in the general HELP, and read about Dynamic disks
and volumes in your OS's own Help file. ]
Wayback Machine copy of: firmware.com/support/bios/fdisk.htm Notes
on DOS FDISK Command. READ THIS TEXT. A
good article covering major versions of FDISK.exe and their peculiarities up
to the beginning of the FAT32 file system. Unfortunately,
the material was never updated beyond a problem with the first version of Windows
98 (text is dated: 04/22/1999).
MS-DOS Partitioning Summary (Q69912). A Knowledge
Base article which briefly describes all of the MS-DOS and Windows partitions
through Windows 98.
Dynamic vs. Basic Disk Storage in Windows XP (Q314343).
A Knowledge Base article briefly describing Dynamic
Storage concepts and how it differs from that of "Basic" disks. You
should also read "Upgrading
the System or Boot Drive to Dynamic (Rooting)" (KB article Q222188).
See KB article: Q175761
for Windows 2000 Dynamic disks/volumes.
Last Update: 18 November 2007.
You can write to me using this: online
reply form. (It opens in a new window.)
The Starman's FREE TOOLS Page
MBR and Boot Records Index
The Starman's Realm Index Page