Master Boot Record

The Master Boot Record (MBR) is located at the physical beginning of hard drive (Head 0
Cylinder 0 Sector 1), editable using the Hex editor. It consists of a master bootstrap loader
code (446 bytes) and four subsequent, identically structure partition records. Finally, the
hexadecimal signature 55AA completes a valid MBR.

Address Content
0000H-00D9H Master bootstrap loader
00DAH-01BDH Reserved
01BEH-01CDH Partition 1
01CEH-01DDH Partition 2
01DEH-01EDH Partition 3
01EEH-01FDH Partition 4
01FEH-01FFH 55AAH

The format of a partition record is as follows:

Offset Size Description

0 8-bit A value of 80 designates an active partition
1 8-bit Partition start head
2 8-bit Partition start sector (bits 0-5)
3 8-bit Partition start track (total length is 10 bits; bit
9 and bit 8 are located in bit 7 and bit 6 in the
start sector bits).
*If 02H is X and 03H is Y, the total tracks
number= (X>>6)*16^2+Y
4 8-bit Operating system indicator
5 8-bit Partition end head
6 8-bit Partition end sector (bits 0-5)
7 8-bit Partition end track (total length is 10 bits; bit
9 and bit 8 are located in bit 7 and bit 6 in the
start sector bits).
8 32-bit Sectors preceding partition
C 32-bit Length of partition in sectors

1
 Master Boot Record

Operating system indicators: (hexadecimal, incomplete list)

00 Empty partition-table entry

01 DOS FAT12
04 DOS FAT16 (up to 32 MB)
05 DOS 3.3+ extended partition
06 DOS 3.31+ FAT16 (over 32 MB)
07 OS/2 HPFS, Windows NT NTFS, Advanced Unix
08 OS/2 v1.0-1.3, AIX bootable partition, SplitDrive
09 AIX data partition
0A OS/2 Boot Manager
0B Windows 95+ FAT32
0C Windows 95+ FAT32 (using LBA-mode INT 13 extensions)
0E DOS FAT16 (over 32 MB, using INT 13 extensions)
0F Extended partition (using INT 13 extensions)
17 Hidden NTFS partition
1B Hidden Windows 95 FAT32 partition
1C Hidden Windows 95 FAT32 partition (using LBA-mode INT 13 extensions)
1E Hidden LBA VFAT partition
42 Dynamic disk volume
50 OnTrack Disk Manager, read-only partition
51 OnTrack Disk Manager, read/write partition
81 Linux
82 Linux Swap partition, Solaris (Unix)
83 Linux native file system (ext2fs/xiafs)
85 Linux EXT
86 FAT16 volume/stripe set (Windows NT)
87 HPFS fault-tolerant mirrored partition, NTFS volume/stripe set
BE Solaris boot partition
C0 DR-DOS/Novell DOS secured partition
C6 Corrupted FAT16 volume/stripe set (Windows NT)
C7 Corrupted NTFS volume/stripe set
F2 DOS 3.3+ secondary partition

2
 Master Boot Record

For example: There’re 2 Primary NTFS partitions and the second one is active. Also, there
are seven Extended partitions and the fifth one is NTFS while the others are FAT32. The
MBR of this drive will be shown as:

3
 Master Boot Record

Analysis of MBR
Master bootstrap loader code
33 C0 8E D0 BC 00 7C FB …
01BEH-01CDH is the partition record of
Partition 1. This is not an active
partition. It starts from Head 1 Cylinder
70 Sector 1. The OS is HPFS,
Windows NT NTFS, Advanced UNIX.

01CEH-01DDH is the partition record of

Partition 2. This is an active partition. It
starts from Head 1 Cylinder 340 Sector
1. The OS is HPFS, Windows NT
NTFS, Advanced UNIX.

01DEH-01EDH is the partition record of

Partition 3. This is not active partition.
The operating system indicator of 0F
indicates that this is an Extended
Partition (using INT 13 extension). The
Extended Partition Record starts from
Head 0 Cylinder 435 Sector 1.

4
 Master Boot Record

th
The 4 partition record is empty.

55AAH is the ending signature of MBR.

The content of the Extended Partition Table at the address of Head 0 Cylinder 435 Sector 1
is shown below, where the structure is the same as Main Partition Table in MBR.

5
 Master Boot Record

Analysis of Extended Partition Table

st
The 1 extended partition
starts from Head 1 Cylinder
435 Sector 1. The OS is
Windows 95+FAT32.

The operating system

indicates a DOC extended
partition. It points to the next
Extended Partition Table
which locates at Head 0
Cylinder 777 Sector 1.

Partition table entry #3 00

Partition table entry #4 00

There will be another 6 Extended Partition Tables which have the same structures as the
one shown above.