Глава – 3
Логический подход к дискам и ОС
Жесткий диск не может управлять своим оборудованием сам по себе и нуждается в двух основных программах для выполнения своих операций: BIOS (базовая система ввода-вывода) и DOS (или операционная система). Операционная система диска не взаимодействует напрямую с оборудованием компьютера и жесткого диска, но ей нужен BIOS между ними. Вот почему BIOS играет важную роль в компьютере.
БИОС
Основная задача BIOS — обеспечить стандартный интерфейс между оборудованием или устройствами, подключенными к компьютеру, и DOS. Системный BIOS — это интерфейс самого низкого уровня между оборудованием вашей системы и программным обеспечением, которое на нем работает. Он выполняет несколько важных функций в управлении доступом к жестким дискам, таких как
- Процедуры прерывания BIOS
- Обнаружение и настройка жесткого диска
- Поддержка режима интерфейса жесткого диска
Для обеспечения взаимодействия различных аппаратных и программных продуктов BIOS системы настраивается под нужды ее оборудования и предоставляет стандартный способ, позволяющий программному обеспечению обращаться к оборудованию. Они называются службами BIOS и используются многими операционными системами и прикладными программами. Они предоставляют единый интерфейс для жесткого диска, поэтому приложениям не нужно знать, как общаться с каждым типом жесткого диска по отдельности.
Стандартные жесткие диски IDE/ATA настраиваются в BIOS с помощью различных настроек BIOS. Современные программы BIOS могут обнаруживать современные диски IDE/ATA, определять эти параметры и автоматически настраивать их. BIOS контролирует, какие типы режимов интерфейса могут использоваться с жестким диском, работая с системным чипсетом на материнской плате и системной шиной ввода-вывода.
Интерфейс INT 13H и расширения INT 13H
Основным интерфейсом к BIOS является программное прерывание 13H, которое обычно известно как INT 13H, где INT обозначает прерывание, а 13H — число 19 в шестнадцатеричной системе счисления.
Мы подробно изучим и обсудим использование прерываний в программировании на этапе программирования этой книги. Интерфейс Int13H поддерживает множество различных команд, которые могут быть даны BIOS, который затем передает их на жесткий диск. Прерывание 13H включает большинство задач, которые нам нужно выполнить с диском, таких как чтение, запись, форматирование и т. д.
Использование и работа с Int13H требует, чтобы вызывающая программа знала конкретные параметры жесткого диска и предоставляла процедурам точную адресацию головки, цилиндра и сектора для обеспечения доступа к диску.
BIOS использует геометрию жесткого диска, как она настроена в программе настройки BIOS. Интерфейс Int13H выделяет 24 бита для спецификации геометрии диска, разбитых следующим образом:
- 10 бит для номера цилиндра, или всего 1024 цилиндра.
- 8 бит для номера головки, или всего 256 головок.
- 6 бит для номера сектора, или всего 63 сектора.
Таким образом, максимально возможное количество секторов на диске может быть
= 1024 * 256 * 63
= 16515072
Как мы видим здесь, интерфейс INT 13H может поддерживать диски, содержащие до 16515072 секторов по 512 байт на сектор. Таким образом, максимальный размер диска может быть,
= 16515072 * 512
= 8455716864 байт
~ 8,456 ГБ
Таким образом, интерфейс INT 13H может поддерживать размер диска приблизительно до 8,456 ГБ (или 7,875 ГиБ).
Сегодня большинство пользователей компьютеров используют жесткие диски, емкость которых намного больше 8 ГБ, поэтому интерфейс INT 13H окончательно исчерпал свою полезность в современных компьютерных системах и был заменен более новым интерфейсом, называемым расширениями INT 13H. Однако INT 13H по-прежнему может использоваться DOS и некоторыми другими старыми операционными системами, а также для других целей совместимости.
Расширения Int 13H
Это действительно интересная история, что когда был разработан интерфейс INT 13H, никто не ожидал получить размер 8 ГБ на жестком диске. Однако сегодня мы можем почувствовать, что жесткий диск на 8 ГБ намного меньше по емкости, даже для домашнего персонального компьютера.
Старый стандарт имеет важное ограничение: он использует 24 бита адресной информации и, таким образом, может обрабатывать только диски, содержащие до 16515072 секторов по 512 байт на сектор, что обеспечивает максимальную емкость 8,456 ГБ (или 7,875 ГиБ).
Thus the problem was to widen the access path from 24 bits to something larger but it was not possible to expand the existing INT13H BIOS interface because if we try to do this a lot of older hardware and software would stop working. And practically, there is no hope to get the respectable place in computer world with a lot of older hardware and software not working with your development.
Therefore a new interface was developed to replace Int13H. These routines are called Int13H extensions. This new interface uses 64 bits instead of 24 bits for addressing and allows a maximum hard drive size of 9.4 * 10 21 bytes that is 9.4 trillion gigabytes .
We shall learn the use of both, the INT 13H and INT 13H extensions in the programming section of this book. There are a number of other size limitations that took place in the earlier days. Some of the popular logical and physical limits have been described below:
The 2.1 GB limit
This size limit was observed in some older BIOSes which only allocate 12 bits for the field in CMOS RAM that gives the number of cylinders. Therefore this number may be at most 111111111111B (Maximum possible 12-Bit Binary Number) which is equivalent to 4095. In this way the maximum disk size with 16 heads, which can be accessed, will be:
= 4095 * 16 * 63 * 512 Bytes
= 2113413120 Bytes are accessible.
The 33.8 GB limit
This hard disk size barrier was noticed in early 1999. Large disks report 16 heads, 63 sectors/track and 16383 cylinders. Many BIOSes compute an actual number of cylinders by dividing the total capacity by 16*63.
For disks larger than 33.8 GB this leads to a number of cylinders larger than 65535. In this particular case, some versions of Award BIOS cannot handle drives that have more than 65,535 cylinders. Now the BIOS crashes or hangs. Since hard disk parameters usually use 16 heads and 63 sectors, this works out to a capacity of about 33.8 GB or 31.5 GiB before trouble occurs.
The solution is to upgrade the BIOS or one can use a jumper to make the disk appear smaller.
ATA Specification for IDE Disks - The 137 GB limit
The old ATA specification does not allow access to a disk that is larger than 137 GB. Actually, it uses only 28 bits to specify a sector number. However, ATA-6 defines an extension with 48-bit sector number.
The limit of the disk size was generated with the combination of at most 65536 cylinders counting from 0 to 65535, 16 heads counting from 0 to15 and 255 sectors per track counting from 1 to 255, the maximum total capacity of disk,
= 65535 * 16 * 255 Sectors
= 267386880 Sectors
= 136902082560 Bytes (Sector of 512 Bytes Each)
~ 137 GB
Two and Four Disk BIOS IDE Support
Today Most of the modern BIOS programs support hard disk auto detection, which allows the BIOS to interrogate each hard disk to determine its logical geometry, supported transfer modes and other information. This can be done either at setup time or dynamically each time the machine is booted, depending on the BIOS.
The system BIOS provides native support for IDE/ATA hard disks therefore there may be a number of parameters that can be set to tell the BIOS what hard disks are in the system and how to control them. Each hard disk in the system will have its own settings so there is one set for the primary master and one for the primary slave and so on. However SCSI hard disks are configured through their host adapter and built-in SCSI BIOS.
Since the hard disk drives over 8 GB in size cannot be described using traditional IDE/ATA BIOS geometry parameters therefore the dynamic auto detection is the standard way of setting up modern drives, especially in case of older computer systems however user may still set some drive parameters manually.
Following are the settings normally found in the BIOS setup program for configuring IDE/ATA hard disks. Although on modern systems some of the oldest compatibility settings may not even be present any more:
- Disk Type: it was originally used to allow the user to pick his hard disk from a predefined list but now this is used to control automatic or manual parameter setup for the drive.
- Size: Size of the Hard Disk drive in decimal megabytes. It is calculated from the other parameters like Cylinders, Heads and Sectors etc.
- Cylinders: The number of logical cylinders on the disk.
Heads: The number of logical heads on the disk.
- Sectors: The number of logical sectors each of 512 bytes, in each logical track on the disk. Usually modern hard disk drives have 63 sectors on a single track.
- Write Precompensation: it is a compatibility setting that specifies at which cylinder number write adjustments should be made for very much older drives.
- Landing Zone (Parking Heads): Landing Zone is the cylinder where the heads are parked by the BIOS to avoid the data loss or creation of Bad Sectors, when the drive is shut off. As the modern hard disk drives automatically park their heads it is rarely needed today.
- Translation Mode: The BIOS translation mode used to support the hard disks over 504 MB.
- Block Mode: To Control the BIOS's ability to perform disk transfers in blocks.
- Programmed I/O (DMA) Mode: The programmed I/O mode or DMA mode used to perform transfers to and from the hard disk.
- 32-Bit Transfer Mode: Controls the use of higher-performance 32-bit data transfers.
Limitations in File Systems
Each file system supports a maximum volume size, file size, and number of files per volume.
Now for Example, generally FAT16 and FAT32 volumes are limited to 4 GB and 32 GB (Generally) respectively. There are some limitations related to FAT file systems you must know, given below:
- FAT12: FAT volumes smaller than 16 MB are formatted as FAT12. It is the oldest FAT type and uses a 12-bit binary to hold cluster numbers. A volume formatted using FAT12 can hold a maximum of 4,086 clusters, which is equal to 2 12 minus a few reserved values to be used in FAT. (We shall discuss it in detail in the logical structure of the disk given next in this chapter). Therefore FAT12 is most suitable for smaller volumes. It is used on floppy disks and hard disk partitions smaller than about 16 MB.
- FAT16: The FAT16 uses a 16-bit binary number to hold cluster numbers. A volume using FAT16 can hold a maximum of 65,526 clusters, which is equal to 2 16 minus a few reserved values to be used in FAT. (We shall discuss it in detail in the logical structure of the disk given next in this chapter). FAT16 is used for hard disk volumes ranging in size from 16 MB to 2,048 MB. FAT16 volumes larger than 2 GB are not accessible from computers running MS-DOS, Windows 95/98/ME and many other operating systems. This limitation occurs because these operating systems do not support cluster sizes larger than 32 KB, which results in the 2 GB limit. (See the Clusters limit given next in this chapter).
- FAT32: In theory, the maximum FAT32 volumes may be up to 2048 GB (approximately 2 Terabytes). The FAT32 is supported by Windows 95's OEM SR2 release, as well as Windows 98/ME. FAT32 uses a 28-bit binary cluster number (Remember! not 32, because 4 of the 32 bits are "Reserved"). Thus theoretically FAT32 can handle volumes with over 268 million clusters (Actually 268,435,456 clusters), and will support drives up to 2 TB in size. However to do this the size of the FAT grows very large. (We are going to discuss it in the topics given next in this chapter).
The comparison of FAT Types has been given next, in the table.
NTFS: NTFS stands for New Technology File System. It is used by Windows 2000/XP. In theory, the maximum NTFS partition size is (2 64 – 1) clusters.
The detailed description of NTFS File System is beyond the limit of this book however some limitations of it have been given in the following table:
| Description
|
Limit |
| Maximum file size
|
16 Exabytes – 1 KB (2 64 Bytes – 1 KB) |
| Maximum volume size
|
(2 64 – 1) clusters |
| Files (and Folders) per volume
|
4,294,967,295 (2 32 – 1 ) Flies and Folders |
Cluster
The smallest unit of space on the hard disk for allocation that any software can access is the sector , which contains 512 bytes. It is possible to have an allocation system for the disk where each file is assigned as many individual sectors as it needs. For example, a 1 MB file would require approximately 2,048 individual sectors to store its data.
In case of FAT file system or rather we can say in most of the file systems, individual sectors are not used. There are several performance reasons for this. When DOS writes some information onto the hard disk, it does not allocate the space sector wise, instead it uses a new unit of storage called cluster.
FAT was designed many years ago and is a simple file system, and is not capable of managing individual sectors. What FAT does instead is to group sectors into larger blocks that are called clusters or allocation units.
A cluster is the smallest unit of disk space that can be allocated to a file. This is the reason that the clusters are often called allocation units. It may be very difficult to manage the disk when files are broken into 512-byte pieces.
A 20 GB disk volume using 512 byte sectors managed individually would contain over 41 million individual sectors, and keeping track of this many pieces of information is time and resource consuming. However some operating systems do allocate space to files by the sector but they require some advanced intelligence to do this properly.
Clusters are the minimum space allocated by the DOS when storing any information on the disk. Even to store only one byte long information on the disk requires minimum one cluster area on the disk surface.
If one cluster can store 512 bytes of information then to store 513 bytes you will require two clusters. Every file must be allocated an integer number of clusters. This means that if a volume uses clusters that contain 4,096 bytes then a 610 byte file will use one cluster thus 4,096 bytes on the disk but a 4,097 byte file uses two clusters thus 8,192 bytes on the disk.
This is the reason that cluster size is so important to make you sure to maximize the efficient use of the disk. Thus we can understand that the larger cluster sizes result the more wasted space.
The figure given next, shows the properties of a file named BINARY.C and clarifies the fact of the space used by the file in the disk. The actual size of the file is 610 bytes but as the single cluster is of 4,096 bytes, the file uses one cluster (4,096 bytes) in the disk.
A cluster can be made of one or more sectors. It depends on the disk type being used. As a cluster can be made of more than one sector, use of clusters as the allocation unit reduces the size of the File Allocation Table that DOS uses to hold the information of the used and empty disk space.
The cluster size is determined primarily by the size of the disk volume. If not strictly speaking, generally larger volumes use larger cluster sizes. For hard disk volumes, each cluster ranges in size from 4 sectors (2,048 bytes) to 64 sectors (32,768 bytes).
Floppy disks use much smaller clusters, and in some cases use a cluster of size of just 1 sector. The sectors in a cluster are continuous, so each cluster is a continuous block of space on the disk.
The cluster size and thus partition or volume size because they are directly related, has an important impact on performance and disk utilization. The cluster size is determined when the disk volume is partitioned.
There are some utilities like Partition Magic available that can alter the cluster size of an existing partition being within the limits of specific conditions but for the general cases, once the partition size and cluster size is selected it is fixed.
As we have discussed earlier that cylinder or track number starts from 0 and the first sector number is always taken as 1 and one more thing you should remember is that the first cluster number is always taken as 2.
Cluster Size
Clusters are used to allocate the storage area for the data area only. FAT and directory area is not allocated according to the cluster size. On a disk that uses 512-byte sectors, a 512-byte cluster contains one sector, whereas a 4-KB cluster contains 8 sectors.
The following tables list the default cluster sizes used by the DOS for various disks formats. However the size of cluster may be different from the default size in some circumstances:
| Floppy Disk Drive (FDD) |
| Drive Types |
Sectors/Cluster |
Total Cluster size in bytes (Sectors of 512 bytes Each) |
| 5.25” 360Kb FDD |
2 sectors |
1,024 |
| 5.25”1.2Mb FDD |
1 sector |
512 |
| 3.5” 720Kb FDD |
2 sectors |
1,024 |
| 3.5”1.44Mb FDD |
1 sector |
512 |
| 3.5”2.88MB FDD |
2 sectors |
1,024 |
FAT16, FAT32, and NTFS each use different cluster sizes depending on the size of the partition and each file system has a maximum number of clusters it can support. The smaller the cluster size, the more efficiently a disk stores information because unused space within a cluster cannot be used by other files.
The following table shows the default cluster sizes for FAT16 , FAT32 , and NTFS File system partition. FAT 32 allows much more efficient storage and use of larger hard drives, 32 bit FAT is only compatible with Windows 95 OSR-2 and Windows 98/ME and. FAT 16 is supported by MS-DOS, Windows 3.1, Windows 95 and Windows NT. The operating systems Windows 2000/XP use the NTFS file system.
Note : Here 1 KiB has been written for 1 Binary Kilobyte that means that 1 KiB is of 1024 Bytes or we can say two sectors of 512 Bytes are equivalent of 1KiB.
As the size of FAT16 partition increases, the wastage of disk space is also increases. The use of FAT32 reduces the cluster sizes and thus provides an efficient storage. While FAT32 does allow the use of larger hard disks and greatly reduced cluster sizes, there is an important performance consideration in using FAT32 that the huge hard disks with dozens of gigabytes have made FAT32 essential for newer systems. Rather we can say that you often do not have a practical choice between FAT16 and FAT32 any more.
Let us consider a partition of 2,048 MB, the largest that FAT16 can support. If this partition is set up under FAT16, it will result in a file allocation table with 65,526 clusters in it, with each cluster taking up 32 KiB of disk space.
The large cluster size will indeed result a big wastage of disk space. Therefore it will be recommended that FAT32 should be used on this partition, which will result in the cluster size reduced from 32 KiB to 4 KiB.
In fact, this will reduce slack on the disk by an enormous amount which may be up to 30% and potentially free hundreds of megabytes of previously wasted disk space. It is usually the right thing to do in this situation. However it has another side of it. We do not get this reduced cluster size for free.
Since each cluster is smaller, there have to be more of them to cover the same amount of disk. So instead of 65,526 clusters, we will now have 524,208.
Further more, the FAT entries in FAT32 are 32–bits wide (Each entry of 4 Bytes) whereas the entries of FAT16 are of 16–bit (Entry of 2 Bytes each). The end result is that the size of the FAT is 16 times larger for FAT32 than it is for FAT16. The following table summarizes:
| FAT 16 and FAT 32 for 2,048 MB Disk Volume |
| FAT Type |
FAT16 |
FAT32 |
| Cluster Size |
32 KiB |
4 KiB |
| Number of FAT Entries |
65,526 |
524,208 |
| Size of FAT |
131052 Bytes
(~ 128 KiB) |
2096832 Bytes
(~ 2 MiB) |
If we increase the size of the FAT32 volume from 2 GB in size to 8 GB, the size of the FAT increases from around 2 MiB to 8 MiB. The significance of this is not the fact that the FAT32 volume will have to waste several megabytes of space on the disk to hold the FAT. Because only by doing this it is saving far more space than that by reducing the size of FAT. The real problem is that the FAT holds all the cluster pointers for every file in the volume. Having the FAT greatly increase in size can negatively impact system speed.
For this reason it is important to limit the size of the File Allocation Table to a reasonably-sized number. In fact, in most cases it is a matter of finding a balance between cluster size and FAT size. A good illustration of this is the cluster size selections made by FAT32 itself.
Since FAT32 can handle around 268 million maximum clusters, the 4 KiB cluster size is conceptually able to support a disk volume 1 TiB (1,024 GiB) in size but the problem in doing so is that the FAT size then would be reach over 1 GB as according to 268 million times 4 bytes per entry.
For this reason, FAT32 only uses 4 KiB clusters for volumes up to 8 GiB in size, and then larger clusters are used as shown in the table given before, for Cluster Sizes. The maximum partition size supported by FAT32, which is officially declare is 2,048 GiB (2 TiB).
Logical Structure of a Hard Disk
Basically, we can divide the logical structure of the hard disk in the following five logical terms:
- MBR (Master Boot Record)
- DBR (DOS Boot Record)
- FAT (File Allocation Tables)
- Root Directory
- Data Area
The following figure represents the conceptual arrangement of these logical terms forming the logical structure of a hard disk:
Logical Structure of a Hard Disk
The Master Boot Record (MBR) or sometimes referred as The master partition table (MPT), contains a small program to load and start the active (or bootable) partition from the hard disk drive. The Master boot Record contains information about all four primary partitions on the hard disk drive such as the starting sector, ending sector, size of the partition etc.
The MBR is located at Absolute Sector 0 or we can say at cylinder 0, head 0, and sector1 and if there is more than one partition are present in the disk there are Extended Master Boot Records, located at the beginning of each extended partition volume (See the figure given Next).
The MBR is created on the hard disk drive by executing FDISK.EXE command of DOS. However there are many other software are available to do the same task. Using the FDISK any one of these partition can be made active or bootable.
This allows the boot sector of the active partition to receive the control when the system is started. Since the floppy has no partitions on it therefore there is no MBR on a Floppy.
Since the DOS uses a single upper case alphabet to name a partition, the maximum number of all type of partitions together allowed by DOS is 24, starting from the drive letter C (C:) to Drive letter Z (Z:). Therefore if even there are more than one physical hard disk drives are present, the total number of partitions of all the drives can not exceed 24.
After the Power-On Self Test (POST), the BIOS loads the MBR (Master Boot Record) from the Hard Disk into memory and then executes it. First the MBR checks the Hard disk for an Active Partition, then it loads the DOS Boot Record (DBR) into memory and turns control over to the Operating System Boot code and then the Operating System Boot Record code loads the rest of the Operating System into Memory.
Master Boot Record Format
Master Boot Record Format
We may partition the Hard Disk Drive into several logical drives which are generally assigned their own drive letter by DOS. Only one partition at a time can be marked as the active (or bootable) Partition.
Master Boot Record Format
The Master Boot Record has the limit of four entries in the Master Partition Table. However the location of Extended Master Boot Record can be obtained with the help of Master Boot Record that contains Extended Partition Tables, whose format is exactly the same as of the main Partition Table except there is no boot code.
In extended Master Boot Record, this space of 446 Bytes is normally reserved for the boot code and remains empty. All the 512Bytes of The Master Boot Record are Broken as follows, given in the Table:
| Offset |
Description |
Size |
| 000H |
Initial Program Loader (IPL) , Executable Code (Provides very first booting to the Computer) |
446 Bytes |
| 1BEH |
First Partition Entry (See Next Table) |
16 Bytes |
| 1CEH |
Second Partition Entry |
16 Bytes |
| 1DEH |
Third Partition Entry |
16 Bytes |
| 1EEH |
Fourth Partition Entry |
16 Bytes |
| 1FEH |
Executable Marker or Bootable Sector Signature or Magic Number (AAH 55H) |
2 Bytes |
| Total = 512 Bytes |
All the extended partitions should exist within the space reserved by the extended partition entry. Only two of the extended partitions are meant to be used, the first as a normal partition and the second as another extended partition if exists. Thus with the help of one Master Partition Table We can get the location of another Extended Master Partition Table next to it, if present.
Partition Table Entry Format
The format of partition table entry of any Partition in MBR has been given in the next table. Every Partition Entry of any MBR may be broken into the following bytes with their specific meanings:
Boot Type Indicator Byte (1 Byte) : If this byte is 00H, it means the partition is not active and if the byte is 80H, it means the partition is an Active partition or Bootable partition. Although the presence of any other byte then these is not expected, yet if there is any other byte is present it may be due to partition table corruption or due to any VIRUS attack in the partition table.
Starting Cylinder – Head – Sector Number of the Partition (3 Bytes) : When we calculate the CHS (Cylinder, Head, and Sector) of any disk, The Physical CHS are counted as follows:
- The Physical Sector is counted starting from 1.
- The Physical Head is counted from 0.
- The Physical Cylinder is counted from 0 (See the Previous Chapter for Details)
- The Byte at offset 01H represents the starting Head Number in hexadecimal System for the partition.
6 Least Significant Bits of Byte at offset 02H make Starting Sector Number of the partition and Combination of remaining 2 Bits (as Two Most Significant Bits) plus 8 Bits of another Byte at offset 03H (Rest 8 least Significant Bits of the 10-Bit Number) make the Starting Cylinder Number of the Partition.
| Offset |
Meaning |
Size |
Description |
| 00H |
Boot Type Indicator Byte |
1 Byte |
If Byte is 00H, the Partition is Inactive and if Byte is 80H , The Partition is Active (or Bootable) |
| 01H |
Head Number of Beginning of the Partition |
1 Byte |
Starting Head number of the Partition in Hexadecimal System |
| 02H |
Sector and Cylinder Number of Beginning of the Partition |
2 Bytes |
6 Bits of First Byte make Starting Sector Number and Combination of remaining 2 Bits (as Two Most Significant Bits) plus 8 Bits of another Byte (Rest 8 least Significant Bits of the 10-Bit Number ) make the Starting Cylinder Number of the Partition |
| 04H |
File System indicator Byte |
1 Byte |
File System Indicator Byte in Hexadecimal system (See the Table given next for Indicators) |
| 05H |
Head Number of End of the Partition |
1 Byte |
Ending Head Number of the Partition in Hexadecimal System |
| 06H |
Sector and Cylinder Number of End of the Partition |
2 Bytes |
6 Bits of First Byte make Ending Sector Number and Combination of remaining 2 Bits (as Two Most Significant Bits) plus 8 Bits of another Byte (Rest 8 least Significant Bits of the 10-Bit Number ) make the Ending Cylinder Number of the Partition |
| 08H |
Relative Sector number of Beginning of the Partition |
4 Bytes |
Number of Sectors Between the MBR and the First Sector in the Partition |
| 0CH |
Number of Sectors of the Partition |
4 Bytes |
Number of Sectors in the Partition |
| Total = 16 Bytes |
The Cylinder and Sector Encoding has been given in the example of a sample partition table study performed next.
File System Indicator Byte (1 Byte) : File System Indicator Byte at offset 04H represents the file system of that partition. The table, listing the File System Indicator Byte for various File Systems has been given next in this chapter.
Ending Cylinder – Head – Sector Number of the Partition (3 Bytes) : Encoding is same as for Starting Cylinder – Head – Sector Number of the Partition.
Relative Sector number of Beginning of the Partition (4 Bytes) : Number of Sectors between the MBR and the First Sector in the Partition in Hexadecimal System.
Number of Sectors of the Partition (4 Bytes) : Number of Sectors in the Partition in Hexadecimal system.
It should always be remembered that the Cylinder, Head and Sector numbers are those which should be passed to BIOS. Thus, if BIOS is using translation (LBA mode or INT 13H Extensions Support), the values may not represent the physical CHS values. For large hard drives (Greater than 8.4 GB) the CHS values may be invalid. These values should generally be ignored and the absolute sector values are used instead.
The figure given next shows the MBR of a Disk with FAT32 partitions. The highlighted area of 64 bytes in the end of the figure represents the Master Partition Table of the MBR.
The Encoding for the Starting and Ending CHS is as Follows:
- At offset 00H, 80 (Hex) represents that the partition is an Active partition.
- At offset 01H, 01 (Hex) represents the Starting head number = 1.
- The combination of two bytes at offset 02H and 03H form the Starting sector
and cylinder number of the partition as per the encoding given next:
MBR of a Disk with FAT32 partitions
Thus Starting C-H-S of the partition= 0-0-1.
Similarly the Head number for the Ending of the partition is FE (Hex), which is 254 and the Encoding for the Ending Cylinder and Sector number of the partition have been given in the next table:
Thus the Ending C-H-S of the Partition = 701-254-63.
The Byte 0B (Hex) at offset 04H is the File System Indicator Byte for the Partition. The Byte 0B (H) Represents that the Partition is having the FAT32 file system. The table for various file systems and their file system indicator bytes have been given next:
| File system Indicator Byte in Hexadecimal |
Partition/ File system Description |
| 00H |
Unused/Empty Partition-Table Entry
(Remember this is not used to designate unused area on the disk, but marks an unused partition table entry) |
| 01H |
DOS 12-bit fat
(The type 01H is for partitions up to 15 MB) |
| 02H |
XENIX: root file system |
| 03H |
XENIX /usr file system (obsolete)
(XENIX is an old part of Unix V7. Microsoft XENIX Operating System was announced in August 1980. It was a portable and commercial version of the Unix operating system for the Intel 8086, Zilog Z8000, Motorola M68000 and Digital Equipment PDP-11. Microsoft introduced XENIX 3.0 in April 1983. SCO delivered its first XENIX for 8088/8086 in 1983.) |
| 04H |
16-bit FAT, DOS 3.0+ (Partition size < 32M)
(Some old DOS versions have had a bug which required this partition to be located in the 1st physical 32 MB of the hard disk ) |
| 05H |
DOS Extended (DOS 3.3+ Extended Volume)
Supports at most 8.4 GB disks. With this type 05H DOS/Windows will not use the extended BIOS call, even if it is available.) |
| 06H |
16-bit FAT, DOS Big, DOS 3.31+ (Partition Size >= 32M)
(Partitions are at most 2 GB for DOS and Windows 95/98 with maximum 65536 clusters with each cluster, at most 32 KB. Windows NT can create up to 4 GB FAT16 partition using 64 KB clusters.) |
| 07H |
OS/2 IFS (Installable File System) (HPFS is the best known example of this file system. OS/2 only looks at partitions with ID 7 for any installed IFS this is the reason that EXT2 IFS packet includes a special "Linux partition filter" device driver to fool OS/2 into thinking Linux partitions have ID 07). |
| 07H |
Advanced Unix |
| 07H |
Windows NT NTFS |
| 07H |
QNX2.x (pre-1988)
(For the actual file system of partition type 07H, one should inspect the partition boot record) |
| 08H |
OS/2 (v1.0 to v1.3 only) |
| 08H |
AIX boot partition
[AIX (Advanced Interactive Executive) is the IBM's version of Unix] |
| 08H |
SplitDrive |
| 08H |
DELL partition spanning multiple drives |
| 08H |
Commodore DOS |
| 08H |
QNX 1.x and 2.x
("qny" according to QNX partitions) |
| 09H |
AIX data partition |
| 09H |
Coherent file system
[Coherent was a UNIX like Operating System for the 286-386-486 systems, marketed by Mark Williams Company led by Bob Swartz. It was renowned for its good documentation. It was introduced in 1980 and died 1 Feb 1995. The last versions are V3.2 for 286-386-486 and V4.0 (May 1992, using protected mode) for 386-486 only. It sold for $99 a copy and it is rumored that 40000 copies have been sold. A Coherent partition has to be primary. ] |
| 09H |
QNX 1.x and 2.x ("qnz" according to QNX Partitions) |
| 0aH |
OS/2 Boot Manager
(OS/2 is the operating system designed by Microsoft and IBM to be the successor of MS-DOS) |
| 0aH |
Coherent swap partition |
| 0aH |
OPUS
(Open Parallel Unisys Server) |
| 0bH |
WIN95 OSR2 32-bit FAT
(OSR2 stands for Microsoft’s “OEM Service Release 2”. It is for Partitions up to 2047GB. Almost always, Windows 95/98/ME have the same File system which is FAT-32, within the same partitions limits) |
| 0cH |
LBA-mapped WIN95 OSR2 32-bit FAT
(It is using Logical Block Addressing – mode of Interrupt 13H extensions therefore we can say that this is the Extended INT 13H equivalent of 0BH. Almost always, Windows 95/98/ME have the same File system which is FAT-32, within the same partitions limits) |
| 0eH |
LBA-mapped WIN95: DOS 16-bit FAT or Logical Block Addressable VFAT
(It is same as 06H but using LBA-mode of INT 13H) |
| 0fH |
LBA-mapped WIN95: Extended partition or Logical Block Addressable VFAT
(It is same as 05H but using LBA-mode of INT 13H. Windows 95 uses 0EH and 0FH as the extended INT13H equivalents of 06H and 05H. Windows NT does not recognize the four Windows 95/98/ME types 0BH, 0CH, 0EH and 0FH) |
| 10H |
OPUS
(Octal Program Updating System) |
| 11H |
Hidden DOS 12-bit FAT or OS/2 Boot Manager hidden 12-bit FAT partition or DOS Seen From OS/2 (When OS/2 Boot manager boots a DOS partition, it will hide all primary DOS partitions except the one that is booted, by changing its ID and 01H, 04H, 06H and 07H becomes 11H, 14H, 16H and 17H, respectively. |
| 12H |
Compaq Configuration/diagnostics partition
(It is used by Compaq for their configuration utility partition. It is a FAT-compatible partition that boots into their utilities, and can be added to a LILO menu as if it were MS-DOS. ) |
| 14H |
(Hidden DOS 16-bit FAT or OS/2 Boot Manager Hidden DOS 16-bit FAT) <32M Partition
(Partition size is less than 32M. ID 14H is resulted from using Novell DOS 7.0 FDISK to delete Linux Native partition. ) |
| 15H |
Hidden DOS-Extended |
| 16H |
(Hidden DOS 16-bit FAT or OS/2 Boot Manager hidden 16-bit FAT ) >=32M Partition |
| 17H |
OS/2 Boot Manager hidden HPFS partition or Hidden IFS (e.g., HPFS) |
| 17H |
Hidden NTFS partition |
| 18H |
AST SmartSleep Partition or AST special Windows swap file ("Zero-Volt Suspend" partition)
[AST Research, Inc. (named from first initials of the founders, Albert Wong, Safi Qureshey and Thomas Yuen). Ascentia laptops have a “Zero – Volt Suspend Partition” or `SmartSleep Partition' of size 2MB+memory size.] |
| File system Indicator Byte in Hexadecimal |
Partition/ File system Description |
| 19H |
Willowtech Photon COS
(Code 19H is Claimed for Willowtech Photon COS by Willow Schlanger. |
| 1bH |
Hidden WIN95 OSR2 32-bit FAT or Hidden Windows 95 FAT32 Partition |
| 1cH |
LBA-mapped Hidden WIN95 OSR2 32-bit FAT
(It is hidden Windows95 FAT32 partition using LBA-mode of INT 13H Extensions) |
| 1eH |
LBA-mapped Hidden WIN95 16-bit FAT or Hidden LBA VFAT partition |
| 1FH |
LBA mapped Hidden WIN95 Extended or Hidden Extended LBA VFAT Partition |
| 20H |
OFSI
(Willowsoft Overture File System ) |
| 21H |
Officially listed as Reserved
(HP Volume Expansion, SpeedStor variant.) |
| 21H |
FSO2
(Claimed for FSO2 (Oxygen File System) by Dave Poirier) |
| 22H |
FSO2 Extended Partition
(Claimed for Oxygen Extended Partition by Dave Poirier) |
| 23H |
Officially listed as Reserved |
| 24H |
NEC DOS 3.x |
| 26H |
Officially listed as Reserved |
| 31H |
Officially listed as Reserved |
| 32H |
NOS (Network Operating System)
(32H is being used by the operating system NOS, being developed by Alien Internet Services in Melbourne Australia. The id 32H was chosen not only because of it was one of the few that are left available but also 32k is the size of the EEPROM the OS was originally targeted for. |
| 33H |
Officially listed as Reserved |
| 34H |
Officially listed as Reserved |
| 35H |
JFS on OS/2 or eCS
[35H is used by OS/2 Warp Server for e-Business, OS/2 Convenience Pack (aka version 4.5) and eComStation (eCS, an OEM version of OS/2 Convenience Pack) for the OS/2 implementation of JFS (IBM AIX Journaling File System)] |
| 36H |
Officially listed as Reserved |
| 38H |
THEOS v3.2 (2GB partition) |
| 39H |
Plan 9 partition
(Plan 9 is an operating system developed at Bell Labs for many architectures. Originally Plan 9 used an unallocated portion at the end of the disk. 3rd edition of Plan 9 uses partitions of type 39H, subdivided into sub partitions described in the Plan 9 partition table in the second sector of the partition.) |
| 39H |
THEOS v4 spanned partition |
| 3aH |
THEOS v4 (4GB partition) |
| 3bH |
THEOS v4 Extended partition
(THEOS is a multi-user multitasking Operating System for PCs founded by Timothy Williams in 1983.) |
| 3cH |
PartitionMagic recovery partition
(When a PowerQuest product like Partition Magic or Drive Image makes changes to the disk, it first changes the type flag to 3CH so that the Operating System will not try to modify it. At the end of the process, it is changed back to what it was at first. Therefore the only time you can see a 3CH type flag, is if the process was interrupted somehow such as power off, user reboot etc. If you change it back manually with a partition table editor or any disk editing program then most of the time everything is okay.) |
| 3dH |
Hidden NetWare |
| 40H |
Venix 80286
(It is a very old Unix-like operating system for PCs.) |
| 41H |
Linux/MINIX (sharing disk with DR-DOS)
(DR-DOS stands for Digital Research-Disk Operating System.) |
| 41H |
Personal RISC Boot |
| 41H |
PPC PReP (Power PC Reference Platform) Boot Partition |
| 42H |
Linux swap (sharing disk with DR-DOS) |
| 42H |
SFS (Secure File System)
(SFS is an encrypted file System driver for DOS on 386+ PCs, written by Peter Gutmann.) |
| File system Indicator Byte in Hexadecimal |
Partition/ File system Description |
| 42H |
Windows 2000 Dynamic Extended Partition Marker
(If a partition table entry of type 42H is present in the legacy partition table, then Windows 2000 ignores the legacy partition table and uses a proprietary partition table and a proprietary partitioning scheme (LDM or DDM). Pure dynamic disks (those not containing any hard-linked partitions) have only a single partition table entry, type 42H to define the entire disk. Dynamic disks store their volume configuration in a database located in a 1-MB private region at the end of each dynamic disk.) |
| 43H |
Linux native (sharing disk with DR-DOS) |
| 44H |
GoBack partition
(GoBack is a utility that records changes made to the disk, allowing you to view or go back to some earlier state. It takes over disk I/O like a Disk Manager would, and stores its logs in its own partition.) |
| 45H |
Boot-US boot manager
(Boot-US (Ulrich Straub) boot manager can be installed to MBR, a separate primary partition or diskette. When installed to a primary partition this partition gets the ID 45H. This partition does not contain a file system, it contains only the boot manager and occupies a single cylinder (below 8.4 GB). ) |
| 45H |
Priam |
| 45H |
EUMEL/Elan |
| 46H |
EUMEL/Elan |
| 47H |
EUMEL/Elan |
| 48H |
EUMEL/Elan
(EUMEL, later known as Ergos L3, are the multi-user multitasking systems developed by Jochen Liedtke at GMD, using Elan programming Language. It was used at German schools for the computer science education.) |
| 4aH |
AdaOS Aquila |
| 4aH |
ALFS/THIN lightweight filesystem for DOS |
| 4cH |
Oberon partition |
| 4dH |
QNX4.x |
| 4eH |
QNX4.x 2nd partition |
| 4fH |
QNX4.x 3rd partition
(QNX is a POSIX (Portable Operating System Interface for Unix)-certified, microkernel, distributed, fault-tolerant Operating System for the 386 and later, including support for the 386EX in embedded applications.) |
| 4fH |
Oberon boot/data partition |
| 50H |
OnTrack Disk Manager (older versions), Read-Only Partition (Disk Manager is a program of OnTrack to enable people to use IDE disks that are larger than 504MB under DOS. Linux kernel versions older than 1.3.14 do not coexist with DM.) |
| 50H |
Lynx RTOS (Real-Time Operating System)
(Lynx RTOS gives users the ability to place up to 14 partitions of 2 GB each on both SCSI and IDE drives, for a total of up to 28 GB of file system space.) |
| 50H |
Native Oberon |
| 51H |
OnTrack Disk Manager (DM6.0 Aux1), Read/Write Partition |
| 51H |
Novell |
| 52H |
CP/M |
| 52H |
Microport SysV/AT or Microport System V/386 |
| 53H |
OnTrack Disk Manager (DM6.0 Aux3), Write-Only partition |
| 54H |
OnTrack Disk Manager 6.0 Dynamic Drive Overlay |
| 55H |
EZ-Drive Partition
(EZ-Drive is another disk manager like program developed by MicroHouse in 1992. Now It is marketed by StorageSoft.) |
| 56H |
Golden Bow VFeature Partitioned Volume.
(This is also a Disk Manager like Utility software. This is a Non-Standard DOS Volume.) |
| 56H |
DM converted to EZ-BIOS |
| 57H |
DrivePro
(DrivePro was developed by MicroHouse in 1992. Now It is marketed by StorageSoft.) |
| 57H |
VNDI Partition |
| 5cH |
Priam EDisk Partitioned Volume
(Priam EDisk is Disk Manager type utility software. This is a Non-Standard DOS Volume.) |
| 61H |
SpeedStor
(Storage Dimensions SpeedStor Partitioned Volume. This is a Non-Standard DOS Volume. It is Disk Manager type utility software.) |
| 63H |
Unix System V/386, 386/ix, SCO, ISC Unix, UnixWare, Mach, MtXinu BSD 4.3 on Mach, GNU Hurd |
| 64H |
Novell NetWare 286, 2.xx |
| File system Indicator Byte in Hexadecimal |
Partition/ File system Description |
| 64H |
PC-ARMOUR protected partition
(64H is used by PC-ARMOUR disk protection by Dr. A. Solomon, intended to keep the disk inaccessible until the right password was given and then an INT 13H hook was loaded above top-of-memory that showed C-H-S = 0-0-2, with a copy of the real partition table, when 0-0-1 was requested). |
| 65H |
Novell NetWare 3.86, 3.xx or 4.xx
(Novell Netware 3.0 and later versions use one partition per drive. It allocates logical Volumes inside these partitions. The volumes can be split over several drives. The file system used is called Turbo FAT and it only very vaguely resembles the DOS FAT file system. Novell Netware used to be the main Network Operating System available. Netware 68 or S-Net (1983) was for a Motorola 68000, Netware 86 for an Intel 8086 or 8088. Netware 286 was for an Intel 80286 and existed in various versions that were later merged to Netware 2.2. Netware 386 was a rewrite in C for the Intel 386 which was later renamed to Netware 3.x (3.0, 3.1, 3.10, 3.11 and 3.12 etc) versions. Its successor Netware 4.xx had versions 4.00, 4.01, 4.02, 4.10 and 4.11. Then came Intranetware) |
| 66H |
Novell Netware SMS Partition
(SMS stands for Storage Management Services. It is not used now.) |
| 67H |
Novell |
| 68H |
Novell |
| 69H |
Novell Netware 5+ and Novell Netware NSS Partition
(NSS stands for Novell Storage Services.) |
| 70H |
DiskSecure Multi-Boot |
| 71H |
Officially listed as reserved |
| 73H |
Officially listed as reserved |
| 74H |
Officially listed as reserved |
| 74H |
Scramdisk partition
(Scramdisk is a disk encryption software. It supports container files, dedicated partitions type 74H and disks hidden in WAV audio files.) |
| 75H |
IBM PC/IX |
| 76H |
Officially listed as reserved |
| 77H |
M2FS/M2CS partition |
| 77H |
QNX 4.x |
| 78H |
XOSL File System
(XOSL Boot loader file system) |
| 78H |
QNY 4.x |
| 79H |
QNZ 4.x |
| 7EH |
F.I.X. |
| 7Fh |
Alt-OS-Development Partition Standard |
| 80H |
Old MINIX, MINIX v1.1 to v1.4a |
| 81H |
MINIX 1.4b and Later
(MINIX is a Unix-like operating system written by Andy Tanenbaum and students at the Vrije University, Amsterdam, around 1989-1991. It runs on PCs (8086 and up), Macintosh, Atari, Amiga, Sparc. |
| 81H |
Early Linux |
| 81H |
Mitac Advanced Disk Manager |
| 82H |
Prime |
| 82H |
Solaris x86
(Solaris creates a single partition with ID 82H and then uses Sun disk labels within the partition to split it further.) |
| 82H |
Linux Swap partition |
| 83H |
Linux Native Partition or Linux native file system or Linux Ext2fs
(Linux is a Unix-like operating system written by Linus Torvalds and many others on the internet since 1991. It runs on PCs 386 and later and a variety of other hardware. It is distributed under GPL (General Public License) . Various file system types like xiafs, ext2, ext3, reiserfs, etc. all use ID 83H.) |
| 84H |
OS/2 hidden C: drive or OS/2-renumbered type 04 partition.
(OS/2-renumbered type 04h partition is related to hiding DOS C: drive) |
| 84H |
Hibernation partition
(Reported for various laptop models, e.g., used on Dell Latitudes (with Dell BIOS) that use the MKS2D utility.) |
| 85H |
Linux Extended partition |
| 86H |
Old Linux RAID partition super block |
| 86H |
FAT16 volume/stripe set (Windows NT) or NTFS volume set
(It is Legacy Fault Tolerant FAT16 volume.) |
| 87H |
HPFS Fault-Tolerant mirrored partition or NTFS volume set or NTFS volume/stripe set
(Legacy Fault Tolerant NTFS volume. HPFS Fault-Tolerant mirrored partition. ) |
| 8aH |
Linux Kernel Partition
(It is used by AiR-BOOT) |
| File system Indicator Byte in Hexadecimal |
Partition/ File system Description |
| 8bH |
Legacy Fault Tolerant FAT32 volume |
| 8cH |
Legacy Fault Tolerant FAT32 volume using BIOS Extended INT 13H. |
| 8dH |
Free FDISK hidden Primary DOS FAT12 partition
(Free FDISK is the FDISK used by FreeDOS. It hides types 01H, 04H, 05H, 06H, 0BH, 0CH, 0EH and 0FH by adding decimal Number 140 (8CH).) |
| 8eH |
Linux Logical Volume Manager partition |
| 90H |
Free FDISK hidden Primary DOS FAT16 partition |
| 91H |
Free FDISK hidden DOS extended partition |
| 92H |
Free FDISK hidden Primary DOS large FAT16 partition |
| 93H |
Hidden Linux native partition |
| 93H |
Amoeba file system |
| 94H |
Amoeba bad block table
(Amoeba is a distributed operating system written by Andy Tanenbaum, together with Frans Kaashoek, Sape Mullender, Robert van Renesse and others since 1981. It runs on PCs (386 and up), Sun3, Sparc, 68030. It is free for universities for research and teaching purposes.) |
| 95H |
MIT EXOPC native partition |
| 97H |
Free FDISK hidden Primary DOS FAT32 partition |
| 98H |
Free FDISK hidden Primary DOS FAT32 partition (LBA) |
| 99H |
Mylex EISA SCSI or DCE376 logical drive
(It is used by the Mylex DCE376 EISA SCSI adaptor for partitions which are beyond the 1024 cylinder of a drive.) |
| 9aH |
Free FDISK hidden Primary DOS FAT16 partition (LBA) |
| 9bH |
Free FDISK hidden DOS extended partition (LBA) |
| 9fH |
BSD/OS |
| a0H |
Phoenix NoteBIOS Power Management "Save-to-Disk" partition or Laptop hibernation partition
(It is Reported for various laptops like IBM Thinkpad, Phoenix NoteBIOS, Toshiba under names like zero-volt suspend partition, suspend-to-disk partition, save-to-disk partition, power-management partition, hibernation partition, usually at the start or end of the disk area.) |
| a1H |
Laptop hibernation partition
(Used as "Save-to-Disk" partition on a NEC 6000H notebook. Types A0H and A1H are used on systems with Phoenix BIOS. The Phoenix PHDISK utility is used with these.) |
| a1H |
HP Volume Expansion (SpeedStor variant) |
| a3H |
Officially listed as Reserved |
| a4H |
Officially listed as Reserved |
| a5H |
BSD/386, 386BSD, NetBSD, FreeBSD
(386BSD is a Unix-like operating system, a port of 4.3BSD Net/2 to the PC done by Bill Jolitz around 1991.) |
| a6H |
OpenBSD
(OpenBSD, led by Theo de Raadt, split off from NetBSD. It tries to emphasize on security.) |
| a7H |
NEXTSTEP
(NEXTSTEP is Based on Mach 2.6 and features of Mach 3.0. It is a true object-oriented operating system and user environment. |
| a8H |
Mac OS-X
(Apple's OS-X uses this type for its file system partition) |
| a9H |
NetBSD |
| aaH |
Olivetti Fat 12 1.44MB Service Partition
(It Contains a bare DOS 6.22 and a utility to exchange types 06H and AAH in the partition table.) |
| abH |
Mac OS-X Boot partition
(Apple's OS-X (Darwin Intel) uses this type for its boot partition.) |
| abH |
GO! partition |
| aeH |
ShagOS file system |
| afH |
ShagOS swap partition |
| b0H |
BootStar Dummy
(The boot manager BootStar manages its own partition table, with up to 15 primary partitions. It fills unused entries in the MBR with BootStar Dummy values.) |
| b1H |
Officially listed as Reserved |
| b3H |
Officially listed as Reserved |
| b4H |
Officially listed as Reserved |
| b6H |
Officially listed as Reserved |
| B6H |
Windows NT mirror set (master), FAT16 file system |
| b7H |
BSDI file system (secondarily swap), BSDI BSD/386 file system |
| B7H |
Windows NT mirror set (master), NTFS file system |
| File system Indicator Byte in Hexadecimal |
Partition/ File system Description |
| b8H |
BSDI BSD/386 swap partition (secondarily file system)
(BSDI (Berkeley Software Design, Inc.) was founded by former CSRG (UCB Computer Systems Research Group) members. Their operating system, based on Net/2, was called BSD/386.) |
| bbH |
Boot Wizard hidden |
| beH |
Solaris 8 boot partition |
| c0H |
DR-DOS/Novell DOS secured partition |
| C0H |
CTOS |
| c0H |
REAL/32 secure small partition |
| c0H |
NTFT Partition |
| c1H |
DR DOS 6.0 LOGIN.EXE-secured 12-bit FAT partition |
| c2H |
Reserved for DR-DOS 7+ |
| c2H |
Hidden Linux |
| c3H |
Hidden Linux swap |
| c4H |
DR DOS 6.0 LOGIN.EXE-secured 16-bit FAT partition |
| c5H |
DRDOS/secured (Extended) |
| c6H |
DRDOS/secured (FAT-16, >= 32M)
(DR-DOS 6.0 will add C0H to the partition type for a LOGIN.EXE - secured partition so that User can not avoid the password check by booting from an MS-DOS floppy. Otherwise it seems that the types C1H, C4H, C5H, C6H and D1H, D4H, D5H, D6H are used precisely like 1H, 4H, 5H, and 6H.) |
| c6H |
Corrupted FAT16 volume/stripe set (Windows NT)
(NTFS will add C0H to the partition type for disabled parts of a Fault Tolerant set. Thus, one gets types C6H, C7H.) |
| c7H |
Windows NT corrupted NTFS volume/stripe set |
| c7H |
Syrinx boot |
| c8H |
Officially listed as Reserved |
| c9H |
Officially listed as Reserved |
| caH |
Officially listed as Reserved |
| cbH |
Reserved for DR-DOS secured FAT32 |
| ccH |
Reserved for DR-DOS secured FAT32 (LBA) |
| cdH |
CTOS Memdump |
| ceH |
Reserved for DR-DOS secured FAT16 (LBA) |
| d0H |
REAL/32 secure big partition
(REAL/32 is a continuation of DR Multi-user DOS.) |
| d1H |
Old Multi-user DOS secured FAT12 |
| d4H |
Old Multi-user DOS secured FAT16 <32M |
| d5H |
Old Multi-user DOS secured extended partition |
| d6H |
Old Multi-user DOS secured FAT16 >=32M |
| d8H |
CP/M-86 |
| daH |
Non-FS Data |
| dbH |
Digital Research CP/M, Concurrent CP/M, Concurrent DOS |
| dbH |
CTOS (Convergent Technologies OS -Unisys) |
| dbH |
KDG Telemetry SCPU boot
(KDG Telemetry uses ID DBH to store a protected-mode binary image of the code to be run on a 'x86-based SCPU (Supervisory CPU) module from the DT800 range.) |
| ddH |
Hidden CTOS Memdump |
| deH |
Dell PowerEdge Server utilities (FAT) |
| dfH |
DG/UX virtual disk manager partition |
| dfH |
BootIt EMBRM
(The boot manager BootIt manages its own partition table, with up to 255 primary partitions.) |
| e0H |
Reserved by ST Microelectronics for a file system called ST AVFS. |
| e1H |
DOS access or SpeedStor 12-bit FAT extended partition
(It is a SSTOR partition on cylinders more than 1023.) |
| E2H |
DOS Read-Only |
| e3H |
Storage Dimensions |
| e4H |
SpeedStor 16-bit FAT extended partition < 1024 cylinders |
| e5H |
Officially listed as Reserved |
| e5H |
Tandy DOS with logical sectored FAT |
| e6H |
Officially listed as Reserved |
| ebH |
BeOS BFS (BFS1)
(BeOS is an operating system that runs on Power PCs) |
| edH |
Reserved for Matthias Paul’s Sprytix |
| eeH |
Indication that this legacy MBR is followed by an EFI Header |
| efH |
Partition that contains an EFI file system |
| f0H |
Linux/PA-RISC boot loader |
| f1H |
Storage Dimensions |
| f2H |
DOS 3.3+ secondary partition |
| f2H |
Unisys DOS with logical sectored FAT |
| f3H |
Officially listed as Reserved |
| f4H |
SpeedStor large partition |
| F4H |
Prologue single-volume partition |
| File system Indicator Byte in Hexadecimal |
Partition/ File system Description |
| f5H |
Prologue multi-volume partition
(The type F4H partition contains one volume, and is not used anymore. The type F5H partition contains 1 to 10 volumes called MD0 to MD9. It supports one or more systems. Each volume can have as file system the NGF file system or TwinFS file system. ) |
| f6H |
Officially listed as Reserved |
| F6H |
Storage Dimensions SpeedStor |
| faH |
MandrakeSoft's Bochs x86 emulator |
| fbH |
VMware File System partition |
| fcH |
VMware Swap partition
(VMware offers virtual machines in which one can run Linux, Windows, FreeBSD.) |
| fdH |
Linux raid partition with auto detect using persistent super block |
| feH |
SpeedStor more than 1024 cylinders |
| feH |
LANstep |
| feH |
IBM PS/2 IML (Initial Microcode Load) partition
(It is located at the end of the disk.) |
| feH |
Windows NT Disk Administrator hidden partition
(Windows NT Disk Administrator marks hidden partitions, i.e. present but not to be accessed, as type FEH.) |
| feH |
Linux Logical Volume Manager partition (old) |
| ffH |
XENIX Bad Block Table |
DOS Boot Record (DBR) / DOS Boot Sector
After the partition table, the DOS Boot Record (DBR) or sometimes called DOS Boot Sector is the second most important information on your hard drive. Most commercial applications for disc-recovery are capable of regenerating destroyed boot-records
The DOS Boot Record (DBR) for the first partition on a hard disk is usually found at Absolute Sector 63 (the 64th sector on the disk drive) or in CHS form we can say C–H–S = 0–1–1 for most drives.
However this location may vary depending upon the SPT (Sectors per Track) of the Drive. For example, on an old 245MB drive having only 31 SPT, the Boot Record was located on the 32nd sector (Absolute Sector 31).
The DBR is created by the FORMAT command of DOS. This program can be executed from a DOS floppy disk (or directly from another volume, following some OS limits) to create the DBR after partitioning is done using the FDISK command.
The sector on which DBR resides becomes logical sector 1 of that particular partition for the DOS. The sector number used by DOS starts from the physical sector on which DBR is located.
First logical sector of each DOS partition will contain a DOS Boot Record (DBR) or DOS Boot Sector. The job of the DBR is to load the operating system from the hard disk drive into the main memory of computer and give the systems control to the loaded program.
For doing this, the DBR contains a small program which is executed by the Master Boot Record (MBR) Executable program. All DOS partitions contain the program code to boot the machine i.e. load the operating system, but only that partition is given control by the Master Boot Record which as specified as active partition, in the partition table entry.
The Boot program in the DBR looks for the two program files IBMBIO.COM or IO.SYS and IBMDOS.COM or MSDOS.SYS, in the root directory of the partition. IBMBIO.COM and IBMDOS.COM are two hidden system program files on the PC-DOS systems or original IBM systems. Whereas IO.SYS and MSDOS.SYS are two hidden system program files on a MS-DOS operating system provided with IBM compatible systems.
After that, the IO.SYS (or IBMBIO.COM) program loads the MSDOS.SYS (or IBMDOS.COM) program and the COMMAND.COM program. This complete process is called “booting” of the computer. If these system files are not available in the directory then this MBR program displays error messages soothing like,
“Invalid system disk or Disk I/O error,
Replace the disk, and then press any key…”
On the screen and waits for the user to put a bootable disk with the above mentioned programs in the floppy drive and press a key.
Since the floppy has no partitions on it therefore it has no MBR or Master Partition Table on its absolute sector 0, instead it contains the DBR on its very first sector.
The following table gives a simple map of a 3½ Inches, 1.44 MB floppy disk’s layout after having been formatted with the FAT12 file system. It shows where the Boot Record, both copies of the FAT, the Root Directory and the beginning of the Data Area are located:
| Logical Map of 3½ Inches, 1.44 MB floppy disk, Formatted with the FAT12 File System and having 18 Sectors Per Track, 80 Tracks, 2 Sides and 512 bytes per Sector (using 1 Sector per Cluster). |
| Absolute Sectors |
Contents |
| 0 |
Boot Record |
| 1 – 9 |
FAT 1 |
| 10 – 18 |
FAT 2 |
| 19 – 32 |
Root Directory |
| 33 – 2879 |
Data Area |
You can also create sub-directories in the Data Area with files that appear to be contained inside them. In Fact, Subdirectories are nothing more than a special file which lists all of the files seemingly contained inside this directory and all the relevant data about each file such as, the location of each file's Starting Cluster, date, time and file size etc.
The DBR also contains some important information about the disk geometry. This information is located in the first sector of every partition, such as:
- Jump Code + NOP
- OEM Name and Version
- Bytes Per Sector
- Sectors Per Cluster
- Reserved Sectors
- Number of Copies of FAT
- Maximum Root Directory Entries (but Not Available for FAT32)
- Number of Sectors in Partition Smaller than 32MB (Therefore Not Available for FAT32)
- Media Descriptor (F8h for Hard Disks)
- Sectors Per FAT (In Older FAT Systems and Not Available for FAT32)
- Sectors Per Track
- Number of Heads
- Number of Hidden Sectors in Partition
- Number of Sectors in Partition
- Number of Sectors Per FAT
- FAT Information Descriptor Flags
- Version of FAT32 Drive
- Cluster Number of the Start of the Root Directory
- Sector Number of the File System Information Sector
- Sector Number of the Backup Boot Sector
- Reserved
- Logical Drive Number of Partition
- Extended Signature (29H)
- Serial Number of Partition
- Volume Name of Partition
- FAT Name
- Executable Code
- Executable Marker or Magic Number (AAH 55H)
The first 3 Bytes of DBR contain a JMP instruction to skip the information and make extensions possible because the MBR loads this sector into memory and transfers execution to it. Usually these three bytes are hexadecimal numbers in format something like E9 XX XX (Hex) or EB XX 90 (Hex).
Following the initial JMP instruction OEM ID is an 8–Bit Field that is reserved by Microsoft for OEM Identification. The OEM ID describes the program that created the boot record. This is often "MSWIN4.0" for Windows 95/98/ME, "IBM 20.0" for OS/2 and "MSDOS5.0" for MS-DOS 4.0 and later.
The third major component of the boot sector is the BIOS Parameter Block (BPB). The disk parameter block is very important data area for DOS. It helps the DOS to find:
- Bytes Per Sector
- Sectors Per Cluster
- Reserved Sectors
- Number of FAT
- Number of Root Directory Entries
| FAT32 DOS Boot Record Format |
| Offset |
Description |
Size |
| 00H |
Jump Code + NOP |
3 Bytes |
| 03H |
OEM Name and Version |
8 Bytes |
| 0BH |
Bytes Per Sector |
2 Bytes |
| 0DH |
Sectors Per Cluster |
1 Byte |
| 0EH |
Reserved Sectors |
2 Bytes |
| 10H |
Number of Copies of FAT |
1 Byte |
| 11H |
Maximum Root Directory Entries (but Not Available for FAT32) |
2 Bytes |
| 13H |
Number of Sectors in Partition Smaller than 32MB (Therefore Not Available for FAT32) |
2 Bytes |
| 15H |
Media Descriptor (F8H for Hard Disks) |
1 Byte |
| 16H |
Sectors Per FAT (In Older FAT Systems and Not Available for FAT32) |
2 Bytes |
| 18H |
Sectors Per Track |
2 Bytes |
| 1AH |
Number of Heads |
2 Bytes |
| 1CH |
Number of Hidden Sectors in Partition |
4 Bytes |
| 20H |
Number of Sectors in Partition |
4 Bytes |
| 24H |
Number of Sectors Per FAT |
4 Bytes |
| 28H |
Flags (Bits 0-4 Indicate Active FAT Copy) (Bit 7 Indicates whether FAT Mirroring is Enabled or Disabled <Clear is Enabled>) (If FAT Mirroring is Disabled, the FAT Information is only written to the copy indicated by bits 0-4) |
2 Bytes |
| 2AH |
Version of FAT32 Drive (High Byte = Major Version, Low Byte = Minor Version) |
2 Bytes |
| 2CH |
Cluster Number of the Start of the Root Directory |
4 Bytes |
| 30H |
Sector Number of the File System Information Sector (Referenced from the Start of the Partition) |
2 Bytes |
| 32H |
Sector Number of the Backup Boot Sector (Referenced from the Start of the Partition) |
2 Bytes |
| 34H |
Reserved |
12 Bytes |
| 40H |
Logical Drive Number of Partition |
1 Byte |
| 41H |
Unused (Could be High Byte of Previous Entry) |
1 Byte |
| 42H |
Extended Signature (29H) |
1 Byte |
| 43H |
Serial Number or 32 – Bit Binary ID of Partition
(Binary ID of 32 Bits provided by the OS itself) |
4 Bytes |
| 47H |
Volume Name of Partition |
11 Bytes |
| 52H |
FAT Name (FAT32 in this case) |
8 Bytes |
| 5AH |
Executable Code |
420 Bytes |
| 1FEH |
Executable Marker or Magic Number (AAH 55H) |
2 Bytes |
- Total Sectors in Logical Volume (Small, For Logical Volume Size Less than or Equal to 32 MB)
- Media Descriptor Byte
- Number of Sectors Per FA
This information helps us to find the location of FAT and some other important values. Putting wrong information here or corrupting these values makes booting from the hard disk drive impossible. Sometimes having wrong information in the disk parameter block will prevents the booting from hard disk drive as well as from the floppy disk drive.
Bytes per sector are almost always 512. If not so even then it must be an integer power of 2 (e.g. 64, 128, and 256).
The number of Sectors per cluster depends on the size of cluster. (See the Clusters section given in this chapter earlier). Number of Copies of FAT is almost always 2.
Number of Root Directories: It depends on the File system and Volume size. (See File System Limits given before and description of Root Directory given next).
Total number of sectors: Excludes hidden sectors. If it is 0 in the BPB, the field in the extended boot record information is used and vice versa. Note that it is possible to determine if the extended information (DOS 4.0 and later) is available by examining the signature byte at offset 26H.
Any sectors before the boot sector of a logical DOS drive are considered to be 'hidden' sectors. The DOS does not interpret hidden sectors. Normal floppy drives have 0 hidden sectors. Hard drive partitions will have a number reflecting their location on the drive. Note that the whole first head of the first cylinder is usually reserved for the partition table, even though it is only the first sector which is actually used.
Media descriptor: Used to give an indication of the media or disk type. Normal values are 0 for an extended DOS partition and F8H for a hard drive. The values of Media Descriptor Bytes have been given in the following table.
| Media Descriptors |
| Type |
Capacity |
Size and type |
| F0H |
2.88 MB |
3.5", 2-Sided, 36 Sectors per Track |
| F0H |
1.44 MB |
3.5", 2-Sided, 18 Sectors per Track |
| F9H |
720 KB |
3.5", 2-Sided, 9 Sectors per Track |
| F9H |
1.2 MB |
5.25", 2-Sided, 15 Sectors per Track |
| FDH |
360 KB |
5.25", 2-Sided, 9 Sectors per Track |
| FFH |
320 KB |
5.25", 2-Sided, 8 Sectors per Track |
| FCH |
180 KB |
5.25", 1-Sided, 9 Sectors per Track |
| FEH |
160 KB |
5.25", 1-Sided, 8 Sectors per Track |
| F8H |
--------- |
Fixed Disk |
Number of Sectors of FAT: It must be calculated. The method of calculating the size of FAT has been given in the description of FAT given in the chapter.
The DBR of a FAT32 File System has been given in the figure given next:
Sectors of FAT
Sectors Per Track (or Sectors Per Head): Sectors Per Head is the number of sectors grouped under onehead. Likewise, Heads per Cylinder reflects the number of cylinders per head. If this partition is a CHS partition, these values must be the same as those returned by BIOS. If they are not the same, you must consider that the disk has been misconfigured and that the partition may be unusable.
Hidden Sectors: As we have already discussed, this is the number of sectors on the physical disk preceding the start of the volume, before the boot sector itself. It is used during the boot sequence in order to calculate the absolute offset to the root directory and data areas. Think of it as the number of sectors between the beginning of this partition and the partition table itself.
This field should be the same as the "number of sectors preceding the partition" in the partition table. Note that it is not necessarily the physical LBA address of the first sector, as secondary partitions may exist.
If the Hidden Sectors are not the same as in the partition table, you may consider the boot sector as corrupted and the partition unusable. Note also that the high word usually contains garbage in old versions of DOS.
If you suspect that a Boot Sector has become corrupt, you can check several of the fields listed above to see whether the values listed there make sense.
For example, Bytes per Sector will be 512 in the vast majority of cases. You may also expect to see text strings in the executable code section of the boot sector that are appropriate for the operating system that formatted the disk.
For Example, Typical text strings on FAT volumes formatted by MS-DOS include: "Invalid system disk.", "Disk I/O error.", "Replace the disk, and then press any key", "Non-System disk or disk error", "Replace and press any key when ready.” and "Disk Boot failure." Text strings on FAT volumes formatted by Windows NT include: "BOOT: Unable to (or Could not) find NTLDR", "I/O error reading disk." and "Please insert another disk."
But remember that you should not regard this list as being all inclusive. If you find other messages in the boot sector, this does not necessarily indicate that there is a problem with the boot sector. Different versions of MS-DOS and Windows NT may sometimes have slightly different message strings in their boot sectors.
On the other hand, if you find no text whatsoever, or if the text is clearly not related to MS-DOS or Windows NT, you should consider the possibility that your boot sector may have been infected by a virus or that some other form of data corruption may have taken place.
To recover from a boot sector that has been infected by a virus, it is usually best to use a commercial anti-virus program. Many viruses and Trojans will do much more than just write data to the boot sector, so manual repair of the boot sector is not recommended, as it may not completely eliminate the virus or Trojan and in some cases, may do more harm than good. However we are going to deal with DBR in programming section of this book.
If you suspect that the boot sector was damaged for some other reason, it may be possible to recover from boot sector damage without reformatting the drive by manually modifying the fields described above. We shall try to overcome such problems with programming in programming techniques of recovery in this book.
File Allocation Table (FAT)
Following DBR are the File Allocation Tables. The File Allocation Table (FAT) was introduced in 1977 to store data on floppy disks for Microsoft stand-alone Disk Basic. The FAT has been modified several times to accommodate expanding needs. It was developed to fulfill the requirements of a fast and flexible system for managing data on both removable and fixed media.
In 1996, the FAT32 was introduced with Windows 95 OSR2. As we have discussed earlier, Windows 98/ME supports FAT32 with the size of hard drives. Now with these operating systems the FAT32 file system is commonly used.
The first DOS FAT file system (DOS 1.x) used 12-bit FAT system which is still in use today for floppy disks. DOS 2.x added support for hard disks, shifted to 16-bit FAT entries because of larger volumes.
Around 1987, DOS 4.0 changed low-level sector-handling to use 32-bit parameters to over come the large disk support problem as we have already discussed the limitations of file systems.
FAT keeps a map of the complete surface of the disk drive such that, which area is free, which area is bad, which area is taken up by which file etc. When some data stored on the disk surface is to be accessed, the DOS consults the FAT to find out the areas of the hard disk surface that contains the data.
The type of the FAT to be used is decided by the FDISK program during the partition of the hard disk drive. But the actual FAT is written by the FORMAT program of DOS.
The FAT does not keep track of each and every sector on the disk surface instead it manages the disk area in a group of sectors called “cluster” or “allocation unit” (See the Cluster Discussed before, in the same chapter).
A cluster is the smallest unit of hard disk drive space that DOS allocates to a file, it consist of one or more sectors depending on the drive size. The cluster size is decided and fixed by the DOS FORMAT program during the high level formatting of the hard disk drive. (See the “size of clusters” discussion, given before)
Actually, the FAT is an index of the clusters of the entire volume. The FAT has one entry for each cluster. The first two entries in a FAT contain information about the FAT. The third and subsequent entries in the FAT are assigned to clusters of disk space, starting with the first cluster available for use by files
Because FAT is such an important item, DOS keeps two copies of the FAT, primary FAT or FAT1 and secondary FAT or FAT2 (there are normally two copies, however many new operating systems create more than two copies of FAT).
Each FAT occupies contiguous sectors on the disk, with the 2nd FAT immediately following the1st FAT does not make the DOS use 2nd FAT to correct the problem, instead when the 1st FAT is updated DOS copies it to the 2nd FAT, corrupting the 2nd FAT as well, in the process.
This updating is done every time DOS finds that the 1st and 2nd FAT does not match. So, in case of any corruption of the 1st FAT, one should immediately do the repair by using some disk editor software and comparing the 1st FAT with the 2nd FAT. This should be done before DOS copies the corrupted FAT to the second FAT.
With the introduction of FAT32, both the FAT entries and the sector numbering are now 32-bit. That means that there are now 4,294,967,296 distinct 32-bit values multiplied by 512 bytes per sector yielding 2 terabytes (2,199,023,255,552 bytes) as the maximum possible disk size under FAT32.
The size of the directory entry for each file in FAT 32 is 4 bytes to contain the value of the starting cluster of the file rather than the 2 bytes needed under FAT16. The larger value accommodates the larger number of possible clusters.
Traditionally, each directory entry is a 32-byte record, and this remains the same. In the middle of the directory record there is 10 bytes (bytes 12 to 21) that Microsoft has reserved for its own future use. Two of those bytes are now used to accommodate the extra bytes needed to specify the starting cluster under FAT32.
As we have already discussed that there have been 12 bit, 16 bit, and 32 bit versions of FAT. While 32 bit FAT allows much more efficient storage which may be up to 30% more efficient and use of larger hard drives.
When the File System of an Operating System is invoked by a program to find the contents of a file, the first cluster value, in the directory entry for that file, is read and used to find the FAT chain. The FAT chain is the list of clusters that contain data belonging to a file.
| FAT32 Drive Layout |
| Offset |
Description |
| Start of Partition |
Boot Sector |
| Start of Partition + Number of Reserved Sectors |
FAT Tables |
Start of Partition + Number of Reserved Sector + (Number of Sectors Per FAT * 2)
[Assuming that FAT Mirroring is Enabled, this is almost always true] |
Root Directory |
| Start of Partition + Number of Reserved Sectors + (Number of Sectors Per FAT * 2) + Number of Sectors in root directory |
Data Area |
FAT entries can contain values that indicate:
- The next cluster in a FAT chain for a given file
- The Free clusters i.e., the clusters which are not in use by any file
- The information of Bad Sectors i.e., the cluster containing one or more sectors that are physically damaged & should not be used.
- The final cluster of a file
| Entries of FAT Table |
| Number (Hex.) |
Description |
| 0 |
Free cluster |
| ???? |
Cluster in use, next cluster in chain |
| FF0-FF6 / FFF0-FFF6 |
Cluster is reserved |
| FF7 /FFF7 |
Cluster contains bad sectors |
| FF8-FFF / FFF8-FFFF |
End of file |
Each FAT entry represents a cluster address and contains a pointer to the next cluster address (FAT entry) for the file. The last FAT entry for a file contains the final cluster value instead of a pointer. The first two entries in a FAT contain information about the FAT. These Bytes of the FAT contain a media descriptor byte. This byte can be used to find the type of the disk media of which this FAT entry is.
The third and subsequent entries in the FAT are assigned to clusters of disk space, starting with the first cluster available for use by files. A FAT entry can have any of the values given in the above table, based on the information it wants to convey.
A 000H in 12–Bit FAT or 0000H in 16–Bit FAT indicates that the cluster corresponding to this FAT location is unallocated or is empty. Any value from FF8H to FFFH in 12–Bit FAT or FFF8H to FFFFH in 16 – Bit FAT indicates that this cluster is the last cluster in a chain of clusters of a file.
Value from FF0H to FF7H in 12 – Bit FAT indicates reserved clusters. An FF7H in a 12–Bit FAT or FFF7H in 16–Bit FAT indicates that the cluster corresponding to the location of the FAT is a bad cluster i.e. this is basically a cluster containing bad sectors. This cluster is not used for data storage.
Any other value in the FAT table is a pointer to the next cluster in the file allocation chain.
How Windows detects the Improper – Shutdown
It is very common thing and I hope you have noticed it many times when using windows that if there is any Improperly – Shutdown in your computer, due to any reason like, power failure, software corruption, accidental shutdown etc, when you further restart your computer, the message of Improper – Shutdown is displayed on the screen during the booting process and the Operating System Scans the disk for errors.
The next two figures show the 256 Bytes of the beginning of a 32 – Bit FAT however we only need initial 8 bytes to discuss this.
Actually, when the Windows Operating Systems has loaded itself into Memory i.e. the Windows has started, the 8th Byte (or offset 7H) of FAT becomes 07H or F7H from 0FH or FFH.
Microsoft uses the byte 0FH only for the volume that contains the running Operating System, and the byte FFH for any other volume that it is accessing.
Once Windows starts booting, the 8th Byte is changed to 07H or F7H which will be set back to a 0FH or FFH only if Windows is properly shut down.
If there is a power failure, or the Power switch of the computer is accidentally turned OFF or the system is manually rebooted due to some software problem, then this byte will remain as 07H or F7H which informs the Windows Operating System when next time it is booted that there was some kind of improper shut down and then Windows uses it’s disk scanning program (Scandisk) to verify the disk for errors.
Root Directory
Following the last FAT is the Root Directory. The root directory is like a table of contents for the information stored on the hard disk drive. The location of the Root Directory can easily be established by adding up the values from boot record, as it is positioned following the FATs.
The directory area keeps the information about the file name, date and time of the file creation, file attribute, file size and starting cluster of the particular file. Each directory entry describing this information about a file is a 32 byte information.
The root directory contains information about the files and directories branching from the root directory. All further directories are themselves stored as files, in the same format as the root directory. Previously the root directory used to be fixed in size and located at a fixed position on disk but now it is free to grow as necessary as it is now treated as a file.
The number of files that one can store on the root directory depends on the FAT type being used. For Example, for a 3½ Inch 1.44Mb floppy Disk with 12–Bit FAT, it is limited to 224 entries, if one tries to store 225th file DOS will display a “File creation error”. When a 16–Bit FAT is used one can have a total 512 entries in the root directory. Each main directory on a floppy or hard disk, also acts as a root directory entry.
The following table lists the limits of root entries for different media and FAT:
|
Media and File System Description |
Maximum Root Directory Entries |
| Single-sided 5¼ Inch 180K FDD |
64 |
| Double-sided 5¼ Inch 320K FDD |
64 |
| Double-sided 5¼ Inch 360K FDD |
112 |
| Double-sided 3½ Inch 720K FDD |
112 |
| Double-sided 5¼ Inch 1.2-megabyte FDD |
224 |
| Double-sided 3½ Inch 1.44-megabyte FDD |
224 |
| Double-sided 3½ Inch 1.68-megabyte DMF format disks (This is why Microsoft created CAB Files!) |
16 |
| Double-sided 3½ Inch 2.88-megabyte FDD |
240 |
| Hard Drives (FAT12 & FAT16) |
512 |
| Hard Drives with FAT 32 (As it treats the route directory as a file) |
65,536 |
This does not mean that with 16–Bit FAT one is limited to storing only 512 files on the hard disk drive. One can use sub-directories to store any number of files limited only by the size of the drive.
Remember that the volume label for a floppy is usually stored within the boot sector, but the volume label for a hard drive is stored as a root directory entry and the space reserved in the boot sector is left blank with spaces. The DIR command of DOS returns the one in the directory if present, or the one in the boot sector if not.
Directory entries contain the entry into the chain of clusters and the filename. Therefore the most important Directory Entries are of the root directory, because it contains cluster indexes that points to all Sub–Directories.
All directories contain two entries, "." for Current directory (This Sub Directory) and ".." for parent directory (Parent Directory of this Sub Directory). We can track these entries easily as they will always be positioned in the beginning of a cluster if the cluster contains a directory.
The following table shows the format of a directory entry in the Root Directory. The table given next Shows, how the 32 Bytes of directory entry of a file in Root Directory are sliced to store the various information about it:
| Offset |
Size |
Description |
| 00H |
8 Bytes |
Filename
(Also see the next table for the special meaning of first character of file name) |
| 08H |
3 Bytes |
Extension |
| 0BH |
1 Byte |
File attributes(See The Table Of File Attributes) |
| 0CH |
10 Bytes |
Reserved |
| 16H |
2 Bytes |
Time Created or Last Updated (See Date–Time Format Table) |
| 18H |
2 Bytes |
Date Created or Last Updated (See Date–Time Format Table) |
| 1AH |
2 Bytes |
Starting or First cluster of file
(The value 0000H is used in Parent Directory ('..') entries to indicate that the Parent Directory is the Root Directory) |
| 1CH |
4 Bytes |
File size in Bytes. |
Filename contains the name in uppercase and if the size of filename is smaller than the 8 characters the spaces are filled with space characters of ASCII Number 32. Extension field contains the extension of file, in uppercase.
If the Filename is longer than the 8 characters, Windows creates a short filename from a long one by truncating it to six uppercase characters and adding "~1" to the end of the base filename.
If there is already another filename with the same first six characters, the number is incremented. The extension is kept the same, and any character that was illegal in earlier versions of Windows and DOS is replaced with an underscore.
Long filenames are stored in specially formatted 32-Byte Long File Name (LFN) directory entries marked with attribute bytes set to 0FH. For a given file or subdirectory, a group of one or more Long filename directory entries immediately precedes the single 8.3 directory entry on the disk.
Each LFN directory entry contains up to 13 characters of the long filename, and the operating system strings together as many as needed to comprise an entire long filename.
This is the cause, why the long file names decreases the maximum possible number of root directory entries in a File system. How Windows Supports Long File Names, We shall Discuss in detail, Later in this Chapter.
The first Byte of the filename may also contain some important information about file. The information given by this byte may be one of as given in the following table:
| First Character of File Name |
| Value |
Meaning |
| 00H |
Indicates that this directory entry is unused. |
| 05H |
Indicates that 1st character of filename is character E5H But actually the file has not been deleted. (See the Meaning of E5H) |
| E5H |
The file has been Erased and this directory entry is a deleted file’s directory entry. The data area previously occupied by that file is now free for allocation for another new file. |
| 2EH |
This is a Sub-directory. The cluster number field of this entry will contain the cluster number of the directory. |
| 2EH 2EH |
Two 2EH in a directory entry indicate the parent directory entry of a Sub–Directory. The cluster number of this entry will contain the cluster number of the parent directory of this directory. The cluster number will be zero 0000H if the parent directory is root directory. |
The Attributes is an 8–Bit binary coded field. The following table tells about the Status for flag of attributes for the given file:
| Attribute Bits |
| Attribute |
Bit |
Binary |
Hex |
| Read Only File Flag |
0 |
.......? |
01H |
| Hidden File Flag |
1 |
......?. |
02H |
| System File Flag |
2 |
.....?.. |
04H |
Volume Label Flag
(Indicates that the entry is a volume label) |
3 |
....?... |
08H |
Sub–directory
(in same format as directory) |
4 |
...?.... |
10H |
Archive Bit
(File Modified Since Last Backup) |
5 |
..?..... |
20H |
| Reserved (Contains 0) |
6 |
.0...... |
- |
| Reserved (Contains 0) |
7 |
0....... |
- |
One File may have multiple attributes. For example, a single File may be a Read–Only as well as Hidden–File or a single file may have both attributes, The System–File and The Hidden–File. (See the Example given next for the Encoding of Directory Entries).
Time and Date is a specially coded field of 32–Bits (16-Bits of Time and 16-Bits for Date). The division of these Bits encoding to compose the Time of created or last updated and the Date of created or last updated for a File, has been given in the Following table:
The entry for Time of Create or Last Update of file, which is the 16th and 17th Byte in the directory entry, has the format given in the above table. The encoding is as follows:
- H is binary number for hour, that could range from 0 to 23
- M is a binary number for minute, that could range from 0 to 59
- S is a binary number for seconds in 2 seconds increment
- The entry for Data of Create or Last Update of File, which is the 18th and
- 19th Byte in the directory entry, has the following format:
- Y is binary number between 0 to 127or year 1980 to 2107
- M is binary number for month, this could range from 1 to 12
- D is a binary number for date, this could range from 1 to 31
This directory entry is linked with the FAT entry based on the first cluster value. Once the DOS has the starting cluster value of any file from the Directory, the DOS can find out the complete file using the FAT. The Entry Cluster in the chain is the first cluster that makes up the file. If the attributes’ directory flag is set, this field points to a new directory entry.
The entry of Size of file is 4 Bytes. By this we can calculate, how FAT32 supports the maximum size of a file up to 4,294,967,295 Bytes which is about 4 GiB. The 4 Bytes have 32 Bits and the maximum possible File size composed by any 32–Bit Binary could be,
= 11111111 11111111 11111111 11111111 (B) Bytes
= 4,294,967,295 (D) Bytes
~ 4 GiB
Thus the FAT32 supports the maximum File size up to 4 GiB.
Root Directory entry
The Size of File and starting cluster of file may be a valuable resource for data recovery in recovering damaged files since we can calculate how many clusters the file is supposed to consist of.
The Figure given before shows the Root Directory entry for seven Different files. The encoding for these entries has been given in the following table:
Long File Name (LFN)
As we have already discussed earlier in Root Directory Discussion, Previously the root directory used to be fixed in size and located at a fixed position on disk but now it is free to grow as necessary as it is now treated as a file.
This is very important to long filenames because each long filename uses multiple directory entries. Adding long filename support to an operating system that uses 8.3 filenames is not as simple as expanding directory entries to hold more than 11 characters.
If this new operating system returns 255-character filenames, many older applications, which expect to receive no more than 11 characters, would crash because a program has to set aside memory to store the filenames it reads, and if it sets aside 16 Bytes for a filename and the operating system copies (say) 32 characters into that space, then other data gets overwritten. A sure way to break an application is to copy random data into its data space.
To overcome this problem, a clever solution was found in Windows 95, to the problem of supporting long filenames while preserving compatibility with previous versions of DOS and Windows applications.
When most applications (except for low-level disk utilities such as the Norton Disk Doctor) query the system for file and subdirectory names, they do so not by reading directory entries directly off the disk, but by using enumeration functions built into the operating system.
As we know that a directory entry is marked with the combination of read-only, hidden, system, and volume label attributes Bits. Likely, if the attribute byte of Directory Entry holds the value 0FH the enumeration functions built into all existing versions of DOS and all Pre-Windows 95 versions of Windows will skip over that directory entry as if it were not there.
Then, the solution was to store two names for every file and subdirectory, a short name that is visible to all applications and a long name that is visible only to Windows 95 (and Later) applications and to applications that have been rewritten to add support for long filenames. Short filenames are stored in 8.3 formats in conventional 32-byte directory entries.
We have already discussed that Windows creates a short filename from a long one by truncating it to six uppercase characters and adding "~1" to the end of the base filename.
If there is already another filename with the same first six characters, the number is incremented. The extension is kept the same, and any character that was illegal in earlier versions of Windows and DOS is replaced with an underscore.
The Long filenames are stored in specially formatted 32-Byte Long File Name (LFN) Directory Entries marked with attribute bytes set to 0FH. For a given file or subdirectory, a group of one or more Long File Name directory entries immediately precedes the single 8.3 directory entry on the disk.
Each Long File Name directory entry contains up to 13 characters of the long filename, and the operating system strings together as many as needed to comprise an entire long filename.
For a Long File Name directory entry, filenames are stored in Unicode format, which requires 2 Bytes per character as opposed to 1 Byte of ASCII. Filename characters are spread among three separate fields:
- The first 10 Bytes (five characters) in length,
- The second 12 Bytes (six characters),
- The third 4 Bytes (two characters).
- The lowest five Bits of the first byte of directory entry hold a sequence number that identifies the position of directory entry relative to other
- Long File Name directory entries associated with the same file.
If a long filename requires three LFN directory entries, the sequence number of the first will be 1, that of the second will be 2, and the sequence number of the third will be 3 and Bit 6 of the first Byte of third entry is set to 1 to indicate that it is the last entry in the sequence.
The attribute field appears at the same location in LFN directory entries as in 8.3 directory entries because the file system does not know which type of directory entry it is dealing with until after it examines the attribute byte. The starting cluster number field also appears at the same location, but in LFN directory entries its value is always 0. The type indicator field also holds 0 in every long filename.
One of the problems with long filenames is that they consume more disk space than short ones. That is not a big deal when long names are stored in subdirectories, because as long as disk space is available, subdirectories can grow to accommodate added directory entries but the maximum number of directory entries available in the root directory is fixed, and long filenames waste space in the root directory which is limited in size.
Now for Example, if the root directory of a hard disks contains at most 512 directory entries, because a 128-character name requires 11 entries, 10 for the long name and 1 for the short name, you could create only 46 files and subdirectories in the root directory if each were given a 128-character name.
The problem goes away for FAT32 also because the root directory under FAT32 can grow as well because in FAT32 system the root directory is treated as a File which can grow in size.
Data Area (or Files Area)
Following the Root Directory the Data Area (or Files Area) starts. Rather we can say that the remainder of the volume after Root Directory is the Data Area.
The data area contains the actual data stored on the disk surface. DOS uses cluster number 2 for the first sector of the data area therefore we should keep it in mind while performing various calculations that the cluster number should start from 2.
When we format a hard disk drive the FORMAT command of DOS does not destroy or overwrite the data on the data area. The FORMAT command only removes the directory entry and FAT entries and it does not touch the actual data area.
This makes the recovery of accidentally formatted hard disk drive possible, which is not possible in all cases of accidentally formatted floppy disk. As in full Format by Windows the Data area of Floppy is filled by F6H characters and all the information is overwritten.
DOS uses a 16-Bit/32-Bit pointer called a “Last Cluster Used” (LCU) pointer to store the last used cluster number. Initially this pointer value is zero, when some information is written on a particular cluster, that cluster number is stored into LCU pointer.
After this, every time if the new information is to be written, DOS searches for a free cluster from the LCU number onwards. This forces new data written on the disk to remain contiguous as the data is written to the new, unused area.
Now understanding of data in case of an accidental deletion would be much easier as the file is in one contiguous area on the disk. Once the end of disk is reached or the system is reset, the LCU pointer value is reset to zero.
But the problem does not last here. It is not practically possible that you only create new files on your disk and you never delete or modify any file from the previously stored ones. Using only LCU has the problems if you do a lot of creation and deletion of files as this will force the new data to move further and further into the inner tracks of the hard disk.
Therefore if any file, which was stored in the disk, is moved or deleted, the clusters in the data area which were occupied by the file are now set as unallocated clusters available in the data area and ready to be written new data on them. By doing this, operating system do not need to move all the data to the inner tracks of the disk.
But a lot of deletion and creation of files fragments the data on the disk and this causes the Fragmentation in the data.
Fragmented and Defragmented Data
We have already discussed that each file in the disk is stored as a linked list of clusters by which the data that is contained in a file and can be located anywhere on the disk. If you have a 10 MB file stored on a disk using 4,096-byte clusters, it is using 2,560 clusters. These clusters can be on different tracks, different platters of the disk, in fact, they can be anywhere.
Though a file can be spread all over the disk, this is far from the preferred situation. The reason is the undesirable slow performance. Hard disks are relatively slow devices, mainly because they have mechanical parts in them. Each time the hard disk has to move the heads to a different track, it takes time that is equivalent to thousands and thousands of processor cycles.
Therefore, we want to minimize the degree to which each file is spread around the disk. In the ideal case, every file would in fact be completely contiguous. That means each cluster it uses would be located one after the other on the disk. This would enable the entire file to be read, if necessary, without a lot of mechanical movement by the hard disk.
Actually, the file system starts out with all or most of its file contiguous but as a result of the creation and deletion of files over a period of time the data on the disk becomes more and more fragmented.
Let us consider a simple example to understand the fragmentation. The table below represents the usage of the 12 clusters. Initially, the table is empty:
| cluster 1 |
cluster 2 |
cluster 3 |
cluster 4 |
cluster 5 |
cluster 6 |
| cluster 7 |
cluster 8 |
cluster 9 |
cluster 10 |
cluster 11 |
cluster 12 |
Now let us suppose that we create four files, File A, B, C and D in this disk. File A takes 1 cluster, file B takes 4, file C takes 2, and file D takes 3. We store them in the free available space, and they start out all contiguous as shown in the next figure:
After some time let we delete the file C and by doing this, both the clusters which were occupied by file C, are now free or unallocated. This leaves the disk looking like the following figure:
Now, we create a new File E that needs 3 clusters. But, as there are no contiguous blocks on the disk left that are 3 clusters long, so we have to split E into two fragments, using part of the space formerly occupied by C. Now our disk is going to look like the figure given next:
After a slice of time period, let we delete files A and E and create file F which takes up 5 clusters. The disk now looks like the figure given below:
Now we see that the file F ends up being broken into three fragments. This type of data in the disk is called the fragmented data. The example given above is a very simplified example of fragmentation, because the real disks have thousands of files and thousands of clusters, so the problem there is magnified. This gives you the general idea of what happens though.
What a defragmentation program (Like Microsoft’s DEFRAG Program, Norton’s SpeedDisk) does is to rearrange the disk to get the files back into contiguous form. After running the disk defragmentation utility, the Defragmented data on the disk which we were talking about will look like the figure given below:
The Fragmented and Defragmented data have a lot of importance during the data recovery, in many cases.
Let us consider that we have two crashed disks for data recovery, one has fragmented data and one was defragmented recently. And you have to do data recovery by collecting the data from the surface of both the disks as the FAT and Root information of the files is damaged. In such type of cases the percentage of recovery will be proportional to the defragmentation of the data in the disk.
Obviously, the data recovery from the Defragmented disk will be easy and percentage of data recovery will also be high but on the other hand, the data recovery from the fragmented disk will be difficult and time–taking as well as the percentage of recovered data will also be disappointing.
Identifying the cause of data corruption
There are some specific steps which if followed in a sequence, may help us to find the area of corruption. These steps have been described with recovery procedure as follows:
Boot the system with bootable floppy
Boot your system with a bootable floppy or CD of the operating system you were using. Try to read the logical drives C: or D: or whatever. If the drive(s) is accessible, just copy all the data off the drive. Now you can figure out why the disk is not booting properly, with less stress.
Verify the MBR Information
The first and most important piece of data on the hard disk is the MBR and the table that it carries within it, the partition table. The small disk Editing tool named “TTEDITOR.EXE” has been given in the disk included with this book. Or you can use any other program to analyze the hard disk.
Diskedit will be the most suitable program to analyze the disk for data recovery purpose. Well, whichever program you feel easy to use is upon you. Try to read MBR and especially its partition table.
As you have seen in the description of MBR, discussed in this chapter, In the second half portion of MBR, there is some readable text which displayed as error message by this, if there is something wrong with it. These text messages are displayed something like:
If these error messages are not available this indicates the corruption of MBR. There may also some illegal message instead of this like, “Your system has been hacked by…..” or any other unexpected message. It indicates that there is something seriously wrong with the MBR, and most probably, it is due to some VIRAL infection
Now check the partition table of MBR after the initial 446 bytes. If the partition table is blank, you will not see any error message at boot time. DOS ignores a non partitioned drive. If there is not any bootable floppy in drive A:, the system will request for a bootable floppy to be inserted in drive A:.
The important thing to be noticed here is that the partition table should not be blank on a drive that was previously working, so something has erased it. If the partition table is blank, restore the MBR from the backup.
If the backup does not work, even after the successful completion of restoring process, there is physical damage on this sector. Try the programming techniques of data recovery, given in the next chapters to recover the data. If you are not a programmer at all, better to go to any good data recovery center.
If you not have any backup of MBR try to write partition table manually with some disk editing tool, like Diskedit, how ever it is very difficult to do so in some cases.
For those users who are not the programmers and also do not have any backup, may use the method which I have been using since my data recovery project development time, in my college days.
What you have to do is, just search the computer near you, which has almost same size of disk, with same number of partitions and the most important thing the same operating system which was in your computer.
However it works completely, most of the time. But if not so, at least it may help you to access the first partition of your disk. Even your operating system will also boot normally, if it was installed in the first partition and if the other information are not corrupted.
If MBR is okay, Verify DBR
If the MBR is all right, verify the DBR (DOS Boot Record). As we have already discussed, this is the first sector in the DOS partition and contains a small program that loads the hidden files and boots the operating system.
The DBR also contains much important information about the FAT, root directory clusters and size of the partition etc. Use some Diskedit like utility to read the DBR information if the DBR is corrupted or has some illegal information restore the DBR from the Backup.
All the professional software for data recovery, are capable to rewrite the DBR. We shall discuss about, how to rewrite the DBR of the partition with programming, in the next chapters of the book.
You can also rewrite the DBR of the partition with the help of Diskedit by providing appropriate information.
There is also a very easy way to find out the area of corruption. The error messages which are displayed on the screen have some specific cause to be displayed. The description of some important error messages is as follows:
| Message |
Description |
| “Sector not found reading drive” |
This message can appear during any DOS operation. Generally, it is caused either by fading or the loss of a sector ID. |
| “Data error reading drive” |
This message can appear during any DOS operation. It is caused by failing the data check – CRC (Cyclic Redundancy Check) or ECC (Error Correction Code). This “Data check” refers to the mechanism used to check whether the data read from the disk is reliable. |
| “ 0 hard disk(s) found" |
It is displayed if the hard disk is not detected by the BIOS of the computer. Check the power and data cable connections of the hard disk. If connections are all right, the problem may be due to some hardware error of hard disk. |
| “Hard Drive failure, press F1 to continue” |
Same as above |
| “Invalid drive specification” |
It is displayed in the condition when either the system does not recognize the hardware, or there is no partition information, or the device driver of the drive is missing. |
| “Invalid configuration press F1 to continue” |
If the hard disk is available, Either the battery in the motherboard is dead, and the system has lost its configuration SETUP information or the disk is not responding. |
| “Invalid partition table” |
This is the MBR error message. It is displayed when the partition table of the MBR does not have the valid partition information. |
| “Error loading operating system” |
This is the MBR error message. It is displayed due to any type of MBR information corruption. |
| “Missing operating system” |
Same as above. |
| “Disk boot failure” |
Это сообщение об ошибке DBR. Обычно жесткий диск должен быть доступен, если вы загружаетесь с дискеты. Хотя он не загрузочный, это не должно влиять на доступ к данным на диске. |
| «несистемный диск или ошибка диска» |
То же, что и выше. |
| «Плохой или отсутствующий интерпретатор команд» |
Это сообщение отображается из-за плохого или отсутствующего интерпретатора команд. Например, если операционная система не находит command.com в текущем пути или command.com поврежден. |
