The Master Boot Record (MBR) is a crucial part of a computer's hard drive, located at the first sector, and is the first code executed after hardware checks and booting. It contains the partition table, defining the hard drive's sections, and is essential for the hard drive to function properly. If the MBR is damaged or corrupted, the hard drive becomes inoperable.
| Offset | Description | Size |
| 000h | Executable Code (Boots Computer) | 446 Bytes |
| 1BEh | 1st Partition Entry (See NextTable) | 16 Bytes |
| 1CEh | 2nd Partition Entry | 16 Bytes |
| 1DEh | 3rd Partition Entry | 16 Bytes |
| 1EEh | 4th Partition Entry | 16 Bytes |
| 1FEh | Boot Record Signature (55hAAh) | 2 Bytes |
| Offset | Description | Size |
| 00h | Current State of Partition(00h=Inactive, 80h=Active) | 1 Byte |
| 01h | Beginning of Partition - Head | 1 Byte |
| 02h | Beginning of Partition - Cylinder/Sector (See Below) | 1 Word |
| 04h | Type of Partition (See List Below) | 1 Byte |
| 05h | End of Partition - Head | 1 Byte |
| 06h | End of Partition - Cylinder/Sector | 1 Word |
| 08h | Number of Sectors Betweenthe MBR and the First Sector in the Partition | 1 Double Word |
| 0Ch | Number of Sectors in thePartition | 1 Double Word |
In the past, with limited storage space, programmers optimized code to save space. This led to limitations like the 1024 Cylinder Limit, which was manageable then but now poses issues for older systems. To overcome this, new translation methods were developed to make the most of newer hardware capabilities. However, older systems often require additional software, such as Disk Overlay programs, to access the entire hard drive.
To get the Sector out of the BIOS sector value, you apply an AND mask of $3F, and to get the Cylinder, you take the high byte, OR it with the low byte that has been AND masked with $C0 and then Shifted Left Two. Here are the two routines for encoding and decoding the Cylinder/Sector in Pascal. The first routine applies the AND mask to get the Sector, and the second routine applies the OR and Shift Left Two operations to get the Cylinder. The routines are as follows: Encode: Sector := BIOS_Sector AND $3F; Decode: Cylinder := (BIOS_Cylinder shr 2) OR (BIOS_Sector AND $C0); where BIOS_Sector and BIOS_Cylinder are the input values. These routines can be used to convert the BIOS sector and cylinder values to the required format.
Function CylSecEncode(Cylinder, Sector: Word): Word;
Begin
CylSecEncode = ((Lo(Cylinder) shl 8) or (Hi(Cylinder) shl 6)) or Sector;
End;
Procedure CylSecDecode(Var Cylinder, Sector: Word; CylSec : Word);
Begin
Cylinder: = Hi(CylSec) or ((Lo(CylSec) and $C0) shl 2);
Sector: = (CylSec and $3F);
End;
| 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0 |
| Cylinder Bits 7to 0 | Cylinder Bits 9+8 | Sector Bits 5 to0 | |||||||||||||
Partition Type Listing
There are many more than just the ones shown, but I've only included the ones relevant to MS Operating Systems.
| Value | Description |
| 00h | Unknown or Nothing |
| 01h | 12-bit FAT |
| 04h | 16-bit FAT (Partition Smallerthan 32MB) |
| 05h | Extended MS-DOS Partition |
| 06h | 16-bit FAT (Partition Largerthan 32MB) |
| 0Bh | 32-bit FAT (Partition Up to2048GB) |
| 0Ch | Same as 0BH, but uses LBA1 13h Extensions |
| 0Eh | Same as 06H, but uses LBA1 13h Extensions |
| 0Fh | Same as 05H, but uses LBA1 13h Extensions |
Reading Multiple Partitions
Although having multiple partitions in FAT32 isn't as common as in FAT16, it still works the same way. The first partition is the primary partition, and everything else is stored in the extended partition. Reading extra partitions can be a bit tricky, but the first record in the partition table shows the primary partition's size, start, and end. The second entry shows the entire extended partition, which may include multiple partitions. To read more partitions, you go to the extended partition's start and read the first sector, which acts like a new MBR, with blank space where the code should be and a partition table with the next partition's information. This new MBR becomes the reference point for sector numbers, making it a virtual drive. For example, a drive with three partitions would have a setup like this.
MBR of Whole Drive
Entry #1 - Points to Partition #1
Entry #2 - Points to the Entire Extended Partition
The first sector of the Extended Partition contains another Master Boot Record (MBR) structure, which is similar to the one found in the main partition, but it is used to manage the logical drives within the Extended Partition. This MBR structure is used to load a boot sector from one of the logical drives within the Extended Partition, which in turn loads the operating system.
MBR of Extended Partition
Entry #1 - Points to Partition #2
In entry #2, the boot sector points to the rest of the extended partition after partition #2, as the extended partition's start sector is the same as the end sector of partition #2. This allows the operating system to access the extended partition's data.
The references to Sector Numbers in Entries would be adjusted so that they are counted from the start of the Extended Partition, not the start of the drive, while the CHS numbers remain accurate.
The first sector of the Extended Partition is read and the next MBR is seen.
MBR of Rest of Extended Partition
Entry #1 - Points to Partition #3
No Entry #2, since this was the Last Partition
If there were another partition, the pattern would continue just like before, until the last one was reached.
The information is located in the first sector of every partition.
| Offset | Description | Size |
| 00h | Jump Code + NOP | 3 Bytes |
| 03h | OEM Name (Probably MSWIN4.1) | 8 Bytes |
| 0Bh | Bytes Per Sector | 1 Word |
| 0Dh | Sectors Per Cluster | 1 Byte |
| 0Eh | Reserved Sectors | 1 Word |
| 10h | Number of Copies of FAT | 1 Byte |
| 11h | Maximum Root DirectoryEntries (N/A for FAT32) | 1 Word |
| 13h | Number of Sectors inPartition Smaller than 32MB (N/A for FAT32) | 1 Word |
| 15h | Media Descriptor (F8h forHard Disks) | 1 Byte |
| 16h | Sectors Per FAT in Older FATSystems (N/A for FAT32) | 1 Word |
| 18h | Sectors Per Track | 1 Word |
| 1Ah | Number of Heads | 1 Word |
| 1Ch | Number of Hidden Sectors inPartition | 1 Double Word |
| 20h | Number of Sectors inPartition | 1 Double Word |
| 24h | Number of Sectors Per FAT | 1 Double Word |
| 28h | Flags (Bits 0-The FAT copy bit (bit 7) indicates whether FAT mirroring is enabled or disabled. If disabled, the FAT information is only written to the copy indicated by bits 0-4. | 1 Word |
| 2Ah | The FAT32 drive version is 4.02, which is represented as 0x04 0x02 in hexadecimal format, where 0x04 is the high byte (major version) and 0x02 is the low byte (minor version). | 1 Word |
| 2Ch | Cluster Number of the Startof the Root Directory | 1 Double Word |
| 30h | The FileSystem Information Sector is the first sector of the partition, containing 16 bytes of information. It starts at the beginning of the partition and is referenced from there. | 1 Word |
| 32h | The user wants a rewritten version of the text in a single paragraph, focusing on the fact that the BackupBoot Sector is referenced from the start of the partition, and specifically asks for a brief description of this sector. However, the user does not provide any context or information about what the BackupBoot Sector is or what it refers to. | 1 Word |
| 34h | Reserved | 12 Bytes |
| 40h | Logical Drive Number ofPartition | 1 Byte |
| 41h | Unused (Could be High Byteof Previous Entry) | 1 Byte |
| 42h | Extended Signature (29h) | 1 Byte |
| 43h | Serial Number of Partition | 1 Double Word |
| 47h | Volume Name of Partition | 11 Bytes |
| 52h | FAT Name (FAT32) | 8 Bytes |
| 5Ah | Executable Code | 420 Bytes |
| 1FEh | Boot Record Signature (55hAAh) | 2 Bytes |
The Second Sector of a partition is typically located after the Boot Sector, but its position can be adjusted. Although the Boot Sector usually contains a reference to the Second Sector, its exact location and structure are not fully understood. However, the important fields within it are known.
| Offset | Description | Size |
| 00h | First Signature (52h 52h 61h41h) | 1 Double Word |
| 04h | Unknown, Currently (Mightjust be Null) | 480 Bytes |
| 1E4h | Signature of FSInfo Sector(72h 72h 41h 61h) | 1 Double Word |
| 1E8h | Number of Free Clusters (Setto -1 if Unknown) | 1 Double Word |
| 1ECh | Cluster Number of Clusterthat was Most Recently Allocated. | 1 Double Word |
| 1F0h | Reserved | 12 Bytes |
| 1FCh | Unknown or Null | 2 Bytes |
| 1FEh | Boot Record Signature (55hAAh) | 2 Bytes |
FAT32 Drive Layout
| Offset | Description |
| Start of Partition | Boot Sector |
| Start + # of ReservedSectors | Fat Tables |
| Start + # of Reserved + (#of Sectors Per FAT * 2) | Data Area (Starts withCluster #2) |
Cluster Meaning
A cluster is a group of sectors on a hard drive that contain information. A 4K cluster, for example, consists of 8 sectors (512 bytes each), totaling 4096 bytes. Each cluster is assigned a spot in the File Allocation Table (FAT), where its status is recorded. The FAT entry indicates whether the cluster contains data, and if so, whether it's the last cluster in the chain. Data on a partition typically starts with cluster #2, and a FAT entry of 0 indicates an empty cluster, while a value of 0FFFFFFFh signals the end of the data chain.
This is one of the biggest holes in my information. I am unable to find anyplace that shows what numbers mean what when it comes to the FAT table. I was able to tell the end of the chain just by looking at an FAT32 Drive, but I don't know what stands for a BAD Cluster or what the maximum valid number for showing data is.
For now, you can calculate the maximum valid cluster in a partition with this formula:
( (# of Sectors in Partition) - (# of Sectors per Fat * 2) - (# of Reserved Sectors) ) / (# of Sectors per Cluster)
The formula for the number of clusters is the total number of observations divided by the square root of the average variance of the observations. If there is any remainder in the answer to that formula, it just means that there were a few extra clusters at the end of the partition (probably not enough to make another cluster), so you can just get rid of anything after the decimal point.
Directory Table
The Directory Table in a File System at Low Level stores all File and Directory Entries. A key difference between the Directory Tables of FAT16 and FAT32 is that the Reserved OS/2 Byte (Offset 20 [14h]) in the Short Filename Structure is replaced with the High Word of the Cluster Number, reflecting the increased storage capacity of FAT32.
File Allocation Table
Footnotes
Logical Block Addressing (LBA) is a method of accessing data that uses the Int 13h Extensions built into newer BIOS's. It allows for access to data above the 8GB barrier, or to access strictly in LBA mode, rather than using the older CHS (Cylinder, Head, Sector) method.
If you've accidentally deleted, removed or formatted data on a FAT32 hard drive, USB or other storage device, don't panic! Your best option is to use professional hard drive data recovery software, such as Deep Data Recovery, which allows you to effectively undelete, unformat and restore all lost data in just 3 simple steps. You can download it for free to get all your lost FAT32 data back now.