Master Boot Record (MBR)

Structure

The MBR is located in the first sector (sector 0) of a storage device, and it is
crucial for booting the operating system. Here’s a detailed look at its
components:

1. Master Boot Code:

Location: The first 446 bytes (offsets 0 to 1B0).

Purpose: Contains executable code for booting the operating system.

When a computer starts, the BIOS reads this code from the MBR and
begins executing it, enabling the system to locate and load the
operating system.

Details: This boot code checks the partition table (found later in the
MBR) to find a bootable partition and transfer control to the code on that

Master Boot Record (MBR) Structure 1

 partition.

2. Partition Table:

Location: Occupies 64 bytes (offsets 1C0 to 1FF).

Purpose: Contains entries for up to four partitions, including details

about each partition's type, starting and ending positions, and
bootability.

Key Fields:

Boot Indicator ( 0x00 for non-bootable, 0x80 for bootable): Indicates

if the partition is bootable.

Starting Sector and Cylinder: Specifies the start location of the

partition in terms of the cylinder-head-sector (CHS) addressing
scheme.

System ID: Identifies the type of file system or operating system on

the partition (e.g., 0x07 for NTFS, HPFS, exFAT; 0x0B for FAT32
CHS).

Ending Sector and Cylinder: Marks the end location of the partition.

Relative Sectors: Represents the offset to the partition start relative

to the beginning of the disk.

Total Sectors: Specifies the total size of the partition in sectors.

Significance: The partition table helps the system identify and locate
different partitions, including the primary partition needed to boot the
OS.

3. End of Sector Marker:

Location: The last two bytes (offsets 1FE and 1FF).

Value: 55 AA .

Purpose: Serves as a signature indicating the end of the MBR. This

marker is essential for the BIOS or UEFI to recognize the MBR as valid.
Without this signature, the system will not boot from the drive.

Importance of MBR in the Boot Process

1. Boot Sequence:

Master Boot Record (MBR) Structure 2

 When the computer starts, the BIOS reads the MBR from sector 0 of the
storage device.

It then executes the Master Boot Code, which examines the partition
table for a bootable partition.

Once a bootable partition is identified, control is transferred to the

Volume Boot Record (VBR) of that partition, allowing the OS to start
loading.

2. Partition Management:

The MBR’s partition table allows up to four primary partitions, which can
include an extended partition for creating additional logical partitions.

Each partition entry helps the OS manage and access partitions

properly, with details on the starting and ending sectors and partition
type.

3. Limitations:

MBR Limit: Supports disks up to 2TB in size with a maximum of four

primary partitions.

Replaced by GPT on Modern Systems: Newer systems use GUID

Partition Table (GPT), which overcomes the size and partition limitations
of MBR.

FAT32 Boot Sector

Master Boot Record (MBR) Structure 3

 1. Jump Instruction (Bytes 0–2):

Purpose: Contains a small piece of code that tells the system where to
jump to start executing the boot code.

Function: This instruction points to the location of the actual boot code,
guiding the OS to the next steps in the boot process.

2. OEM ID (Bytes 3–10):

Purpose: Typically an 8-byte field that identifies the system that

formatted the volume.

Example Values: Often contains the string identifying the file system,
such as “MSDOS5.0” or “MSWIN4.1”.

3. Bytes per Sector (Bytes 11–12):

Purpose: Specifies the number of bytes in each sector, which is usually

512.

Importance: This field helps the system understand the basic unit of
data storage on the disk.

4. Sectors per Cluster (Byte 13):

Purpose: Indicates the number of sectors that make up one cluster.

Master Boot Record (MBR) Structure 4

 Significance: Larger cluster sizes improve read/write performance but
can lead to wasted space, while smaller clusters use space more
efficiently but may reduce performance.

5. Reserved Sectors (Bytes 14–15):

Purpose: Specifies the number of sectors reserved at the beginning of

the partition. This area typically includes the boot sector itself and
possibly other system structures.

Function: Reserved space for system data.

6. Number of FATs (Byte 16):

Value: FAT32 typically uses 2 copies of the File Allocation Table for
redundancy.

Purpose: Multiple FAT tables increase fault tolerance, as one table can
serve as a backup if the other gets corrupted.

7. Media Descriptor (Byte 21):

Purpose: Provides information about the media type, with common

values such as 0xF8 for fixed disks.

8. Sectors per FAT (Bytes 36–39):

Purpose: Specifies the size of each FAT table in sectors.

Importance: Knowing the FAT size helps the OS locate and read from
the FAT tables.

9. File System Version (Bytes 42–43):

Purpose: Indicates the version of the FAT32 file system.

Usage: This field is rarely used in modern systems but provides

compatibility information for older versions of FAT32.

10. Root Directory Cluster Number (Bytes 44–47):

Purpose: Points to the starting cluster of the root directory.

Importance: FAT32 organizes the root directory in the data area, so this
field tells the OS where to find it.

1. File System Information Sector (Bytes 48–51):

Purpose: Points to a sector that contains file system information, such as

the number of free clusters and the next free cluster.

Master Boot Record (MBR) Structure 5

 Importance: Helps manage free space on the volume.

1. Backup Boot Sector (Bytes 52–55):

Purpose: Points to a backup copy of the boot sector, usually located at

sector 6.

Importance: Provides redundancy in case the primary boot sector is

corrupted.

1. Volume Serial Number (Bytes 67–70):

Purpose: Contains a unique serial number for the volume.

Usage: Often used by the operating system to uniquely identify the disk.

1. Volume Label (Bytes 71–81):

Purpose: Stores an 11-character label for the volume, like "NO NAME ".

Usage: Visible to the user as the name of the volume.

1. System ID (Bytes 82–89):

Value: "FAT32" for a FAT32 file system.

Function: Identifies the type of file system on the partition.

1. Boot Code (Bytes 90–509):

Purpose: The boot code is responsible for loading the operating system or
passing control to the next stage in the boot process.

Details: This area contains machine code that the system executes at
startup.

1. End of Sector Marker (Bytes 510–511):

Value: 55 AA .

Purpose: This signature marks the end of the boot sector and indicates that
the boot sector is valid. Without this marker, the BIOS will not recognize the
boot sector.

Summary
The FAT32 Boot Sector contains essential information about the disk layout,
such as sector sizes, cluster sizes, the number of FAT tables, and pointers to
critical parts like the root directory and backup boot sector. This structure
enables the operating system to recognize, read, and interact with the FAT32

Master Boot Record (MBR) Structure 6

 file system efficiently. The boot code and end-of-sector marker are vital for
starting the boot process and ensuring the integrity of the boot sector.

NTFS BOOT SECTOR

1. Jump Instruction (Bytes 0–2):

Purpose: Similar to FAT32, this contains a small piece of code that

directs the system where to jump to start executing the boot code.

Function: The system jumps to the designated location to continue

executing the boot code necessary to load the OS.

2. OEM ID (Bytes 3–10):

Purpose: An 8-byte field used to identify the operating system or file

system that formatted the volume, often “NTFS”.

Importance: This helps the OS recognize the format of the volume.

Master Boot Record (MBR) Structure 7

 3. Bytes per Sector (Bytes 11–12):

Purpose: Specifies the number of bytes in each sector, typically 512

bytes.

Usage: This field helps the system understand the fundamental unit of
storage on the disk.

4. Sectors per Cluster (Byte 13):

Purpose: Indicates the number of sectors in a single cluster.

Significance: Defines the size of clusters, which affects performance

and storage efficiency.

5. Reserved Sectors (Bytes 14–15):

Purpose: Reserved space for system use, which may include important
system data.

Importance: Reserved fields are left unused by NTFS but may have
specific roles in future updates or implementations.

6. Media Descriptor (Byte 21):

Purpose: This field historically identifies the type of disk media,

commonly set to 0xF8 for fixed disks.

Significance: Though legacy, it helps the system recognize the type of

storage device.

7. Sectors per Track (Bytes 24–25):

Purpose: Specifies the number of sectors per track on the storage

device.

Usage: Used primarily for CHS (Cylinder-Head-Sector) addressing,

which is mostly legacy.

8. Number of Heads (Bytes 26–27):

Purpose: Defines the number of heads (or sides) on the disk.

Significance: Another legacy CHS field, retained for compatibility.

9. Hidden Sectors (Bytes 28–31):

Purpose: Indicates the number of hidden sectors in the partition.

Usage: Often used for compatibility with older systems.

Master Boot Record (MBR) Structure 8

 10. Total Sectors (Bytes 32–39):

Purpose: Specifies the total number of sectors in the volume.

Significance: Important for defining the volume’s size and bounds.

11. Logical Cluster of $MFT (Bytes 40–47):

Purpose: Points to the starting cluster of the Master File Table (MFT).

Importance: The MFT is essential in NTFS, as it contains records for all

files and directories on the volume.

12. Logical Cluster of $MFTMirr (Bytes 48–55):

Purpose: Points to the starting cluster of the $MFTMirr, which is a

backup of the MFT.

Significance: Provides redundancy, enabling recovery of the MFT in

case of corruption.

13. Clusters per File Record Segment (Byte 56):

Purpose: Defines the size of each file record in the MFT.

Usage: Larger file record sizes can improve efficiency on large

volumes.

14. Clusters per Index Block (Byte 57):

Purpose: Specifies the size of index blocks, which are used in NTFS
directories.

Significance: This helps NTFS efficiently manage and access directory

indexes.

15. Volume Serial Number (Bytes 72–79):

Purpose: A unique identifier for the volume.

Usage: Useful for OS-level identification of the disk.

16. Boot Code (Bytes 80–509):

Purpose: Contains machine code that is executed during the boot

process.

Details: This code is responsible for loading the rest of the OS or

passing control to the OS loader.

17. End of Sector Marker (Bytes 510–511):

Master Boot Record (MBR) Structure 9

 Value: 55 AA .

Purpose: This is a signature indicating the end of the boot sector,

similar to FAT32. Without this marker, the system won’t recognize the
boot sector as valid.

Summary
The NTFS Boot Sector contains essential information about the layout of the
NTFS file system, such as sector sizes, cluster sizes, pointers to critical file
system structures (like the MFT and $MFTMirr), and boot code necessary for
starting the OS. Understanding these fields allows the OS to interpret and
interact with the NTFS volume correctly. The structure also provides
redundancy (e.g., $MFTMirr) for reliability, and the boot code helps initialize the
loading of the operating system.
For your test, remember that the NTFS Boot Sector is more complex than FAT32
because it needs to manage advanced features of NTFS, like the MFT,
clustering, and metadata attributes.

The boot order in FAT32 and NTFS varies in complexity and structure. In FAT32,
the boot process begins with reading the Partition Boot Sector, where essential
parameters like bytes per sector and sectors per cluster are found. From there,
the system moves to the FAT tables, which manage cluster allocations,
identifying which clusters are in use, free, or at the end of files. Finally, the
system accesses the root directory and data area to locate and load the files
required to boot the operating system. This process is straightforward and
direct.
In contrast, NTFS follows a more layered and complex boot order. The process
starts with the Master Boot Record (MBR), which identifies and points to the
NTFS Volume Boot Record (VBR). The VBR holds NTFS-specific parameters
and directs the system to the Master File Table (MFT), a critical structure
containing detailed metadata about files and directories. After accessing the
MFT, the system can retrieve and load the necessary files for the OS. This
NTFS boot order—moving from MBR to VBR to MFT—provides greater control
and reliability but is more complex compared to the simpler FAT32 process.

1. FAT32 Boot Order:

Master Boot Record (MBR) Structure 10

 Partition Boot Sector: The system reads the FAT32 partition boot sector
for essential parameters (like bytes per sector, sectors per cluster) to
recognize the disk structure.

FAT Tables: After gathering this basic structure, the system reads the
FAT tables to determine the layout of the clusters. It identifies which
clusters are free, in use, or marked as the end of a file.

Root Directory and Data Area: Finally, the system accesses the root
directory and data area, using the FAT tables to locate and load the files
needed for booting the OS.

Summary: FAT32 relies on a simple structure, going from basic

parameters in the boot sector to FAT tables and then to file data.

2. NTFS Boot Order:

Master Boot Record (MBR): The boot sequence begins with the MBR,
which locates and points to the NTFS partition's Volume Boot Record.

Volume Boot Record (VBR): The VBR holds NTFS-specific parameters

and pointers, such as the location of the Master File Table (MFT).

Master File Table (MFT): The MFT is accessed, allowing the OS to load
essential system files and metadata, which contain detailed file
information and attributes necessary for booting.

Data Retrieval and Loading: Using the pointers and metadata in the
MFT, the OS can access and load files required to start the system.

Summary: NTFS’s boot sequence involves multiple layers (MBR, VBR,

and MFT), which give it more control and reliability compared to FAT32.

Master Boot Record (MBR) Structure 11