How it Works -- Partition Tables Version 1c by Hale Landis (landis@sugs.tware.com) THE "HOW IT WORKS" SERIES This is one of several How It Works documents. The series currently includes the following: * How It Works -- CHS Translation * How It Works -- Master Boot Record * How It Works -- DOS Floppy Boot Sector * How It Works -- OS2 Boot Sector * How It Works -- Partition Tables PARTITION SECTOR/RECORD/TABLE BASICS FDISK creates all partition records (sectors). The primary purpose of a partition record is to hold a partition table. The rules for how FDISK works are unwritten but so far most FDISK programs (DOS, OS/2, WinNT, etc) seem to follow the same basic idea. First, all partition table records (sectors) have the same format. This includes the partition table record at cylinder 0, head 0, sector 1 -- what is known as the Master Boot Record (MBR). The last 66 bytes of a partition table record contain a partition table and a 2 byte signature. The first 446 bytes of these sectors usually contain a program but only the program in the MBR is ever executed (so extended partition table records could contain something other than a program in the first 466 bytes). See "How It Works -- The Master Boot Record". Second, extended partitions are "nested" inside one another and extended partition table records form a "linked list". I will attempt to show this in a diagram below. PARTITION TABLE ENTRY FORMAT Each partition table entry is 16 bytes and contains things like the start and end location of a partition in CHS, the start in LBA, the size in sectors, the partition "type" and the "active" flag. Warning: older versions of FDISK may compute incorrect LBA or size values. And note: When your computer boots itself, only the CHS fields of the partition table entries are used (another reason LBA doesn't solve the >528MB problem). The CHS fields in the partition tables are in L-CHS format -- see "How It Works -- CHS Translation". There is no central clearing house to assign the codes used in the one byte "type" field. But codes are assigned (or used) to define most every type of file system that anyone has ever implemented on the x86 PC: 12-bit FAT, 16-bit FAT, HPFS, NTFS, etc. Plus, an extended partition also has a unique type code. Note: I know of no complete list of all the type codes that have been used to date. However, I try to include such a list in a future version of this document. The 16 bytes of a partition table entry are used as follows: +--- Bit 7 is the active partition flag, bits 6-0 are zero. | | +--- Starting CHS in INT 13 call format. | | | | +--- Partition type byte. | | | | | | +--- Ending CHS in INT 13 call format. | | | | | | | | +-- Starting LBA. | | | | | | | | | | +-- Size in sectors. | | | | | | v <--+---> v <--+--> v v 0 1 2 3 4 5 6 7 8 9 A B C D E F DH DL CH CL TB DL CH CL LBA..... SIZE.... 80 01 01 00 06 0e be 94 3e000000 0c610900 1st entry 00 00 81 95 05 0e fe 7d 4a610900 724e0300 2nd entry 00 00 00 00 00 00 00 00 00000000 00000000 3rd entry 00 00 00 00 00 00 00 00 00000000 00000000 4th entry Bytes 0-3 are used by the small program in the Master Boot Record to read the first sector of an active partition into memory. The DH, DL, CH and CL above show which x86 register is loaded when the MBR program calls INT 13H AH=02H to read the active partition's boot sector. See "How It Works -- Master Boot Record". These entries define the following partitions: 1) The first partition, a primary partition DOS FAT, starts at CHS 0H,1H,1H (LBA 3EH) and ends at CHS 294H,EH,3EH with a size of 9610CH sectors. 2) The second partition, an extended partition, starts at CHS 295H,0H,1H (LBA 9614AH) and ends at CHS 37DH,EH,3EH with a size of 34E72H sectors. 3) The third and fourth table entries are unused. PARTITION TABLE RULES Keep in mind that there are NO written rules and NO industry standards on how FDISK should work but here are some basic rules that seem to be followed by most versions of FDISK: 1) In the MBR there can be 0-4 "primary" partitions, OR, 0-3 primary partitions and 0-1 extended partition entry. 2) In an extended partition there can be 0-1 "secondary" partition entries and 0-1 extended partition entries. 3) Only 1 primary partition in the MBR can be marked "active" at any given time. 4) In most versions of FDISK, the first sector of a partition will be aligned such that it is at head 0, sector 1 of a cylinder. This means that there may be unused sectors on the track(s) prior to the first sector of a partition and that there may be unused sectors following a partition table sector. For example, most new versions of FDISK start the first partition (primary or extended) at cylinder 0, head 1, sector 1. This leaves the sectors at cylinder 0, head 0, sectors 2...n as unused sectors. This same layout may be seen on the first track of an extended partition. See example 2 below. Also note that software drivers like Ontrack's Disk Manager depend on these unused sectors because these drivers will "hide" their code there (in cylinder 0, head 0, sectors 2...n). This is also a good place for boot sector virus programs to hang out. 5) The partition table entries (slots) can be used in any order. Some versions of FDISK fill the table from the bottom up and some versions of FDISK fill the table from the top down. Deleting a partition can leave an unused entry (slot) in the middle of a table. 6) And then there is the "hack" that some newer OS's (OS/2 and Linux) use in order to place a partition spanning or passed cylinder 1024 on a system that does not have a CHS translating BIOS. These systems create a partition table entry with the partition's starting and ending CHS information set to all FFH. The starting and ending LBA information is used to describe the location of the partition. The LBA can be converted back to a CHS -- most likely a CHS with more than 1024 cylinders. Since such a CHS can't be used by the system BIOS, these partitions can not be booted or accessed until the OS's kernel and hard disk device drivers are loaded. It is not known if the systems using this "hack" follow the same rules for the creation of these type of partitions. There are NO written rules as to how an OS scans the partition table entries so each OS can have a different method. For DOS, this means that different versions could assign different drive letters to the same FAT file system partitions. PARTITION NESTING What do I mean when I say the partitions are "nested" within each other? Lets look at this example: M = Master Boot Record (and any unused sectors on the same track) E = Extended partition record (and any unused sectors on the same track) pri = a primary partition (first sector is a "boot" sector) sec = a secondary partition (first sector is a "boot" sector) |<----------------the entire disk-------------->| | | |M | | | | E<---rest of 1st ext part---------->| | | | E<---rest of 2nd ext part---->| The first extended partition is described in the MBR and it occupies the entire disk following the primary partition. The second extended partition is described in the first extended partition record and it occupies the entire disk following the first secondary partition. PARTITION TABLE LINKING What do I mean when I say the partition records (tables) form a "linked" list? This means that the MBR has an entry that describes (points to) the first extended partition, the first extended partition table has an entry that describes (points to) the second extended partition table, and so on. There is, in theory, no limited to out long this linked list is. When you ask FDISK to show the DOS "logical drives" it scans the linked list looking for all of the DOS FAT type partitions that may exist. Remember that in an extended partition table, only two entries of the four can be used (rule 2 above). And one more thing... Within a partition, the layout of the file system data varies greatly. However, the first sector of a partition is expected to be a "boot" sector. A DOS FAT file system has: a boot sector, first FAT sectors, second FAT sectors, root directory sectors and finally the file data area. See "How It Works -- OS2 Boot Sector". EXAMPLE 1 A disk containing four DOS FAT partitions (C, D, E and F): |<---------------------the entire disk------------------->| | | |M<---C:---> | | | | E<---D:---><-rest of 1st ext part------------>| | | | E<---E:---><-rest of 2nd ext part->| | | | E<---------F:---------->| EXAMPLE 2 So here is an example of a disk with two primary partitions, one DOS FAT and one OS/2 HPFS, plus an extended partition with another DOS FAT: |<------------------the entire disk------------------>| | | |M | | | | | | | | E| Or in more detail ('n' is the highest cylinder, head or sector number allowed in the indicated field of the CHS)... +-------------------------------------+ CHS=0,0,1 | Master Boot Record containing | | partition table search program and | | a partition table | | +---------------------------------+ | | | DOS FAT partition description | | points to CHS=0,1,1 | +---------------------------------+ | points to CHS=a | | OS/2 HPFS partition description | | | +---------------------------------+ | | | unused table entry | | | +---------------------------------+ | | | extended partition entry | | points to CHS=b | +---------------------------------+ | +-------------------------------------+ CHS=0,0,2 | the rest of "track 0" -- this is | : to | where the software drivers such as | : normally CHS=0,0,n | Ontrack's Disk Manager or Micro | : unused | House's EZ Drive are located. | : +-------------------------------------+ CHS=0,1,1 | Boot sector for the DOS FAT | : | partition | : a DOS FAT +-------------------------------------+ : file CHS=0,1,2 | rest of the DOS FAT partition | : system to | (FAT table, root directory and | : CHS=x-1,n,n | user data area) | : +-------------------------------------+ CHS=x,0,1 | Boot sector for the OS/2 HPFS | : | file system partition | : an OS/2 +-------------------------------------+ : HPFS file CHS=x,0,2 | rest of the OS/2 HPFS file system | : system to | partition | : CHS=y-1,n,n | | : +-------------------------------------+ CHS=y,0,1 | Partition record for the extended | | partition containing a partition | | record program (never executed) and | | a partition table | | +---------------------------------+ | | | DOS FAT partition description | | points to CHS=b+1 | +---------------------------------+ | | | unused table entry | | | +---------------------------------+ | | | unused table entry | | | +---------------------------------+ | | | unused table entry | | | +---------------------------------+ | +-------------------------------------+ CHS=y,0,2 | the rest of the first track of the | : normally to | extended partition | : unused CHS=y,0,n | | : +-------------------------------------+ CHS=y,1,1 | Boot sector for the DOS FAT | : | partition | : a DOS FAT +-------------------------------------+ : file CHS=y,1,2 | rest of the DOS FAT partition | : system to | (FAT table, root directory and | : CHS=n,n,n | user data area) | : +-------------------------------------+ EXAMPLE 3 Here is a partition record from an extended partition (the first sector of an extended partition). Note that it contains no program code. It contains only the partition table and the signature data. OFFSET 0 1 2 3 4 5 6 7 8 9 A B C D E F *0123456789ABCDEF* 000000 00000000 00000000 00000000 00000000 *................* 000010 TO 0001af SAME AS ABOVE 0001b0 00000000 00000000 00000000 00000001 *................* 0001c0 8195060e fe7d3e00 0000344e 03000000 *.....}>...4N....* 0001d0 00000000 00000000 00000000 00000000 *................* 0001e0 00000000 00000000 00000000 00000000 *................* 0001f0 00000000 00000000 00000000 000055aa *..............U.* NOTES Thanks to yue@heron.Stanford.EDU (Kenneth C. Yue) for pointing out that in V0 of this document I did not properly describe the unused sectors normally found around the partition table sectors. /end/ -- \\===============\\=======================\\ \\ Hale Landis \\ 303-548-0567 \\ // Niwot, CO USA // landis@sugs.tware.com // //===============//=======================//