Sponsored by:

Fully Managed Technology Services

•  Introduction
•  The Master Boot Record (MBR)
•  Primary Partitions
•  A Partition Table Entry
•  Decoding the CHS values


•  Extended Partitions
•  An Extended Boot Record (EBR)


•  Extended partitions are chained, not nested


•  Partition Table Examples
•  20 GB Hard Drive (with NTFS, FAT32 and Linux Partitions)

An Extended Boot Record

Extended Boot Records are similar in structure to the MBR, but the majority of them will contain nothing more than partition table data and the AA55h Boot Record signature; the first 446 bytes being zero-filled. Exceptions occur in cases where a programmer decides to use this normally "unused area" for his own code or data^[5] (just as the programmers of many DDOs, such as EZ-drive or Maxblast, had done in the past. For example, the Linux boot managers, LILO and GRUB also make use of the so-called "unused area" between the MBR and first possible Volume Boot Record sector).

The usual contents of an Extended Boot Record's partition table:

This next diagram shows only one of many possible ways the extended partition in Figure 2 may actually be divided:

Figure 3.

So, we consider it just as important to copy and store the data contained in any EBR sectors as you would for the MBR, and to store these copies elsewhere (not on the same hard disk) and/or write down just the data bytes from each partition table entry in a notebook. If the OS can no longer read any EBR sector's contents, you'll have a better chance of fixing problems (or recovering your data) knowing the contents of these tables! You may use Power Quest's PartInfo^[6] program (which lists all the data from each of the daisy-chained Extended partition tables; as well as the MBR) to save the data as a single text file on a floppy diskette; along with a binary copy of your MBR sector. But even if you delete the partition table data or overwrite an MBR sector, you can still recover your partitions using TestDisk.

Nesting of Extended partitions only a concept; not reality!

Although some authors have described each logical drive (or partition) within an Extended partition as being nested inside all preceding logical partitions,^[7] we've never found any concrete examples which support those statements! As a matter of fact, every single partitioning utility we've tested so far,^[8] has always produced EBRs with partition table data (and corresponding partitions) which could be displayed the same way you'd find them in a Windows™ 2000 or XP Disk Management Snap-in MMC (see Figure 3 above): Each logical drive is independently situated within the single all-encompassing Extended partition; even though data in the first and each successive EBR links their logical partitions, like pendants strung together by an invisible chain.

The following comments concern various disk structures and areas in Figure 4 below (each item is labeled with red numbers in the diagram).

1: The MBR (Master Boot Record) is always located on the first sector of any hard disk at LBA 0 or CHS (0, 0, 1). Under Microsoft® Windows™ Vista, the first sector will appear like other MBRs, but it's only there to keep old utility programs from corrupting Vista partitions; which they'd see as unallocated space without the old partition table entries. (See: GUID Partition Table for more info on Vista's actual partition table).

2: The area shown in pink and labeled 2 in our diagram below is sometimes called a "reserved area" when it includes the MBR sector. It's size is equal to the number of Sectors per Track (or Head; usually 63 for most drives today), so 63 minus the MBR sector = 62 sectors. This area is found on all "Basic Disk" partitioned hard disks, and although it's "unused" by the OS, you may find some very interesting data here. When GRUB, or some other boot manager, installs boot code into the MBR, it may also fill a dozen or so sectors of this area with part of its own second stage code. In the past, both DDO (Dynamic Drive Overlay) software and boot viruses would fill many of these sectors, and some unruly application may have stuffed data here as well. A few manfacturers still insert information about your computer and/or its hard disk into some of these sectors too, so users should carefully examine every sector here, just to know what might be stored in them.

Areas 3, 4 and 6 are the first (1st), second (2nd) and fourth (4th) Primary partitions on this disk with data about their locations and sizes normally found in entries 1, 2 and 4, respectively, of the MBR's Partition Table; unless some OS or utility program mixed up their order.

Note: The Microsoft® and IBM® partitioning tool FDISK doesn't allow for more than one Primary partition before requiring an Extended partition be created. The Disk Management tools of Windows™ 2000 and later do not have this restriction. Thus, the Primary partitions in 4 (2nd) and 6 (4th) could have been created under those operating systems; just as they can with the fdisk tool under Linux and various stand-alone utilities.

7: This is just a large area of "Free Space" arbitrarily left unpartitioned by the user.^[9] Item 5, the third (3rd) Primary partition, happens to be an Extended partition (which we've expanded in the diagram below to clarify its structure).

Figure 4.

8: EBR. The first EBR (Extended Boot Record) sector within the extended partition.
9: Inter-partition space (also see pink strips following #11 and #14 as well). These areas between all the EBR sectors and their partitions are similar to the "unused area" between the MBR and the first possible location for a partition on a Basic Disk; most often equal in size to the number of sectors per head (or SPT, sectors/track) minus one (the EBR sector); normally 62 sectors.
10: Unused Space. Presumably, this was originally the first logical drive created within the extended partition, but at some later time, it was deleted. Upon deletion, its partition entry was removed from the first EBR, leaving only the link to the next logical partition's EBR sector (#11).
11: EBR for the logical drive partition in #12 and also a pointer to the EBR sector at #14.
12: A valid logical partition within the extended partition; could be unformatted or formatted, you need to check its entry for the partition type and the partition itself for valid boot records to actually know for sure.
13: Unused Space. This area could have been part of the original extended partition's second logical drive at creation, in which case some utility program, such as Partition Magic or GNU Parted, resized (shrunk) the data to the sectors colored in blue above (#12). Or, it may have contained an original 3 of 4 logical partitions that was later deleted (with an EBR sector located somewhere within this area). If that's the case, the utility or OS used to delete the partition also edited the EBR entry at #11 to jump over the original EBR sector pointing to it. Some programs will not do that... they would have simply removed the logical drive's partition table entry data, and left the pointer to the EBR sector at #14.
14: EBR. The last EBR within this extended partition.
15: Another valid logical partition or drive within this extended partition.
16: Some unused space at the end of the extended partition. Either the original logical partition was resized, or the partition's entry data in its EBR sector was altered (made smaller) before being formatted, if it ever was (again, you must always check the data within the partition itself to know what if anything is in there! The EBR entries only tell you what type of partition it's supposed to be).

Some Real Partition Table Examples

⁵[Return to Text] One such exception being the IBM Boot Manager [ introduced with OS/2; also used by Power Quest as Partition Magic's first boot manager, which was later changed under version 4.x. Boot Manager is still being used by some 'die-hard fans of OS/2' under the last version of OS/2 Warp ], which stores boot menu data about each logical drive within its EBR as a compact 9-byte entry (at offsets 18Ah-192h). The first byte indicates if that logical drive is included on the boot menu, and if so, the remaining 8 bytes form the title it displays.

⁶[Return to Text] Also available from the same FTP site listed in Footnote 3: Partition Information for the Windows™ NT/2000/XP operating systems, or PartInfo for DOS .

⁷[Return to Text] For example, the archived state (on 5 Jun 2007) of Wikipedia's article on the File Allocation Table, under the section, Extended partition and logical drives, contained the statement: "The logical drives were described by on-disk structures which closely resemble the Master Boot Record (MBR) of the disk (which describes the primary partitions), probably to simplify coding, and they were chained/nested in a way analogous to Russian matryoshka dolls." That last phrase concerning the Russian dolls (smaller and smaller ones found inside each successive one you open) is far from a correct analogy here! An Extended partition's logical drives are rather like the individual pages of a letter (all unfolded) within a large envelope! And after you open the envelope and begin reading its first page, the second entry in each EBR can be thought of as a heading on each page which tells us which page number to look for on the next one to be read.

NOTE: Reading articles at Wikipedia can be quite rewarding if you read with caution. For example, ask yourself questions, such as: Where did this material originate? What sources can I find elsewhere to verify this data? And for anything important, you really should read the "discussion" pages, checking for posts about controversial material (anything the article's editors disagree on; though some posts are just rants). You might check the edit "history" page, and attempt to determine if the page has been vandalized (by emotional, personal, sarcastic, lewd or derogatory remarks; or worse, false information being added, or simply to see if any of the article has recently been deleted). In short, what you read there is only as good as the people who created and edited its pages; but that's true for anything you see/read on the Net, including my own pages!

The best sources would be those which have undergone scrutiny by many researchers looking only for truth and had the ability to test the facts of any statements made there. Occasionally, a page which seems to be correct, may only be the efforts of people with the same bias; all paying homage to the same preconceived notion which none have attempted to prove as true or false. ( Note: History, can be quite difficult to judge, since few of its 'facts' can ever be tested by experiments; only by weighing the accounts of its witnesses, even though some of its lessons have been repeated on many occasions! )

⁸[Return to Text] Including the FDISK utilities for both Microsoft® MS-DOS 3.3, MS-DOS 5.0, 6.0, 6.2 AND 6.22, IBM® PC-DOS 5.02, Digital Research, Inc. DR-DOS 6.0; along with the install CDs for Windows™ 2000 and Windows™ XP and their Disk Management utilities for paritioning a hard disk while those operating systems were running. Add to this the Linux fdisk utilities of RedHat, Debian, SuSE (now Novell/?), Fedora Core and others, and Power Quest's (now Symantec/Norton) Partition Magic 8.0. If you have a hard disk with Extended partitions that you'd care to test, the easiest methods would be to use the Power Quest, Partition Table Editor or their PartInfo utility. For anyone who wishes to participate in this sort of inductive proof, we'll supply other utilities to read info from your drive(s) if they contain partitions created by tools we do not have access to. Proof for a commercial tool (no matter how old) that actually creates nested Extended partitions will receive our immediate attention.

⁹[Return to Text] Though all DOS partitioning tools leave the last cylinder of every disk unpartitioned for use as a test cylinder (which is never used), many Windows NT partitioning tools now leave a cylinder (usually, 255 heads x 63 sectors/head = 16,065 sectors; or at 512 bytes/sector = 8,225,280 bytes) of about 7.8 MiB at the end of a drive in order to have room for converting a Basic Disk to a Dynamic Disk; should its user so desire.

<-- Previous Page | Next Page -->

Last Update: July 22, 2007. (2007.07.22)

You can write to us here: contact page (opens in a new window).

MBR and Boot Records Index

The Starman's Realm Index Page