Extended boot record explained

An extended boot record (EBR),[1] or extended partition boot record (EPBR), is a descriptor for a logical partition under the common DOS disk drive partitioning system. In that system, when one (and only one) partition record entry in the master boot record (MBR) is designated an extended partition, then that partition can be subdivided into a number of logical partitions. The actual structure of that extended partition is described by one or more EBRs, which are located inside the extended partition. The first (and sometimes only) EBR will always be located on the first sector of the extended partition.

Unlike primary partitions, which are all described by a single partition table within the MBR, and thus limited in number, each EBR precedes the logical partition it describes. If another logical partition follows, then the first EBR will contain an entry pointing to the next EBR; thus, multiple EBRs form a linked list. This means the number of logical drives that can be formed within an extended partition is limited only by the amount of available disk space in the given extended partition.

While in Windows versions up to XP logical partitions within the extended partition were aligned following conventions called "drive geometry" or "CHS", since Windows Vista they are aligned to a 1-MiB boundary. Due to this difference in alignment, the Logical Disk Manager of XP (Disk Management) may delete these extended partitions without warning.[2]

EBR structure and values

EBRs have essentially the same structure as the MBR; except only the first two entries of the partition table are supposed to be used, besides having the mandatory boot record signature (or magic number) of at the end of the sector. This 2-byte signature appears in a disk editor as first and last, because IBM-compatible PCs store hexadecimal words in little-endian order (see table below).

Structures

Common Structure of Extended Boot Records:
Offsets within EBR sectorsContentsSize
HexDecbytes
Generally unused; normally filled with zeroes;
may contain another boot loader i.e. a partition boot record, for example in conjunction with Advanced Active Partitions
446
1BE – 1CD446 – 461 Partition table's first entry16
1CE – 1DD462 – 477 Partition table's second entry16
1DE – 1ED478 – 493 Unused[3] third entry filled with zeroes16
1EE – 1FD494 – 509 Unused fourth entry filled with zeroes16
1FE - 1FF510 - 511Signature in big-endian network order,
same as little-endian . On disk: at offset 510 and at offset 511.
2
EBR, total size: 446 +(4×16) +2 =512

The IBM Boot Manager (included with OS/2 operating systems and some early versions of Partition Magic), adds at least one 9-byte entry (starting at offset) to each EBR sector. The entry consists of a flag value byte (indicating if the partition is on the IBM Boot Manager menu) followed by an 8-byte ASCII string which is the name to be used on the menu. If the partition is not included on the boot menu (such as data only partitions), the flag byte is zero; in which case, the following 8-byte field may contain an ASCII representation of that partition's starting sector number (in hexadecimal).

Structure of an MBR or EBR 16-byte Partition Table Entry:
Offsetswithin entry BytesDescription
HexDec
1?E10 1Boot indicator (80h for active; otherwise, 00h)
1?F - 1?1 1 –  33CHS cylinder-head-sector address: partition start
1?241Partition type code
1?3 - 1?5 5 –  73CHS cylinder-head-sector address: partition end
1?6 - 1?9 8 – 114LBA logical block address: partition start
1?A - 1?D12 – 154Partition size (in sectors)
1

For 1?E read 1BE or 1CE to get the hex. offset of the first or second entry, respectively

The partition type of an extended partition is (addressing) or (LBA addressing).[4] DR DOS 6.0 and higher support secured extended partitions using, which are invisible to other operating systems. Since non-LBA-enabled versions of DR-DOS up to including 7.03 do not recognize the partition type and other operating systems do not recognize the type, this can also be utilized to occupy space up to the first 8 GB of the disk for use under DR-DOS (for logical drives in secured or non-secured partitions), and still use to allocate the remainder of the disk for LBA-enabled operating systems in a non-conflictive fashion.Similarly, Linux supports the concept of a second extended partition chain with type - this type is hidden (unknown) for other operating systems supporting only one chain.[5] Other extended partition types which may hold EBRs include the deliberately hidden types,, and, the access-restricted types and, and the secured types and . However, these should be treated private to the operating systems and tools supporting them and should not be mounted otherwise.

The CHS addresses of a partition are hard to interpret without knowledge of the (virtual) disk geometry, because CHS to LBA translations are based on the number of heads and the number of sectors per track. However, the given LBA start address and the given partition size in sectors permit to calculate a disk geometry matching the given CHS addresses where that is at all possible. CHS addressing with 24 bits always uses 6 bits for up to 63 sectors per track (1...63), and INT 13h disk access generally uses 8 bits for up to 256 heads (0...255), leaving 10 bits for up to 1024 cylinders (0...1023). ATA CHS addresses always use 4 bits for up to 16 heads (0...15), this leaves 14 bits for up to 16,383 cylinders in ATA-5 24 bits CHS address translations.[6]

Values

The following are general rules that apply only to values found in the 4-byte fields of an EBR's partition table entries (cf. tables above). These values depend upon the partitioning tool(s) used to create or alter them, and in fact, most operating systems that use the extended partitioning scheme (including Microsoft MS-DOS and Windows, and Linux) ignore the "partition size" value in entries which point to another EBR sector. One exception is that value must be one or greater for Linux operating systems.

The first entry of an EBR partition table points to the logical partition belonging to that EBR:

Note: This is often the same value for each EBR on the same hard disk; usually 63 for Windows XP or older.

Note: Any unused sectors between EBR and logical drive are not considered part of the logical drive.

The second entry of an EBR partition table will contain zero-bytes if it's the last EBR in the extended partition; otherwise, it points to the next EBR in the EBR chain.

in other words, the EBR must have a valid partition type, just as a partition must have a valid partition type.

in other words: Starting sector = LBA address of next EBR minus LBA address of extended partition's first EBR

Note: Unlike the first entry in an EBR's partition table, this number of sectors count includes the next logical partition's EBR sector along with the other sectors in its otherwise unused track. (Compare Diagram 1 and 2 below.)

Remarks:
The diagrams above are not to scale: The thin white lines between each "EBR" and its logical "partition" represent the remainder of an unused area usually 63 sectors in length; including the single EBR sector (shown at a greatly exaggerated size).

On some systems, a large gap of unused space may exist between the end of a logical partition and the next EBR, or between the last logical partition and the end of the whole extended partition itself, if any previously created logical partition has been deleted or resized (shrunk).

The interleaving of EBRs and partitions shown above is typical but not required. It is legitimate to have two or more consecutive EBRs followed by two or more regions of partition data.

Naming

Linux and similar operating systems designate IDE hard disks as /dev/hda for the first hard disk, /dev/hdb for the second hard disk, and so on. Likewise SCSI and in later kernels also IDE and SATA hard disks are identified as /dev/sda for the first disk, etc.

The up to four partitions defined in the master boot record are designated as /dev/hda1 ... /dev/hda4 for /dev/hda. The fifth partition in this scheme, e.g., /dev/hda5, corresponds to the first logical drive. The sixth partition /dev/hda6 would then correspond to the second logical drive, or in other words, the extended partition containers are not counted. Only the outermost extended partition defined in the MBR (one of /dev/hda1 ... /dev/hda4) has a name in this scheme.[7]

Examples

This shows an extended partition with 6,000 sectors and 3 logical partitions.
Remark: Neither a tiny extended partition with only 3 MB nor a hard drive with 20 sectors per track are realistic but these values have been chosen to make this example more readable.

Snapshot

The following output of a command line tool shows the layout of a disk with two logical drives. Details for the FAT and NTFS partitions stripped, the line annotated with Linux is /dev/hda6 with an extended file system. The begin of /dev/hda5 shows that the involved operating systems PC DOS 7, Windows NT, and Debian do not insist on any extended partition alignment with a gap:

 \\.\PHYSICALDRIVE0 (assuming geometry CHS 99999 255 63)  id. [3189-3188]
   MBR CHS     0   0  1 at          0, end     0   0  1, size          1
unused CHS     0   0  2 at          1, end     0   0 63, size         62
1:*06: CHS     0   1  1 at         63, end   260 254 63, size    4192902 bigFAT
2: 05: CHS   261   0  1 at    4192965, end   757 254 63, size    7984305 => EXT
3: 17: CHS   758   0  1 at   12177270, end  1522 254 63, size   12289725 NTFS
4: 1C: CHS  1523   0  1 at   24466995, end  1825 254 63, size    4867695 FAT32
          (extended offset    4192965)                  total   29334690
=> EXT CHS   261   0  1 at          0, end   261   0  1, size          1
5: 06: CHS   261   0  2 at          1, end   384 254 63, size    1992059 bigFAT
6: 05: CHS   385   0  1 at    1992060, end   757 254 63, size    5992245 => EXT
          (extended offset    6185025)                  total    7984305
=> EXT CHS   385   0  1 at          0, end   385   0  1, size          1
unused CHS   385   0  2 at          1, end   385   0 63, size         62
6: 83: CHS   385   1  1 at         63, end   757 254 63, size    5992182 Linux
7: 00: CHS     0   0  0 at          0, end     0   0  0, size          0 unused
                                                        total    5992245

bigFAT CHS     0   1  1 at         63, end   260 254 63, size    4192902
PC DOS 7    (cluster size  64, number      65506)       total    4192902

  NTFS CHS   758   0  1 at   12177270, end  1522 254 63, size   12289725
[1C81-013D] (cluster size   8, number    1536215)       total   12289725

 FAT32 CHS  1523   0  1 at   24466995, end  1825 254 63, size    4867695
[C417-9E22] (cluster size   8, number     607271)       total    4867695

bigFAT CHS   261   0  2 at    4192966, end   384 254 63, size    1992059
FAT SWAP    (cluster size  32, number      62236)       total    1992059

For another example see the "Linux Partition HOWTO".[8]

See also

References

  1. Web site: Disk Concepts and Troubleshooting. Microsoft Technet. Windows 2000 Web and Application Services Technical Overview. 2000 . 2011-07-19.
  2. Web site: The partition that hosts Windows Vista may disappear if you use Windows XP to create a partition on a computer that has both Windows XP and Windows Vista installed. Microsoft Support. 2007-12-02. 2015-08-29.
  3. Web site: Troubleshooting Disks and File Systems. 2005-11-03. Microsoft TechNet. Windows XP Resource Kit. 2011-09-15.
  4. Web site: List of partition identifiers for PCs. 2011. Andries E. Brouwer. Andries Brouwer. [0x05 s]upports at most 8.4 GB disks: with type 05 DOS/Windows will not use the extended BIOS call, even if it is available. See type 0f below. Using type 05 for extended partitions beyond 8 GB may lead to data corruption with MSDOS.. 2011-07-19.
  5. Web site: Extended and logical partitions. Large Disk HOWTO. Andries Brouwer. Andries Brouwer. 2004. 2011-07-19.
  6. Web site: ATA-5 . INCITS Technical Committee T10 SCSI Storage Interfaces . 2000 . T13/1321D . 2011-07-30 . dead . https://web.archive.org/web/20110728081430/http://www.t10.org/t13/project/d1321r3-ATA-ATAPI-5.pdf . 2011-07-28.
  7. Web site: Extended partitions. linux.about.com. Juergen Haas. 2011-07-19. 2016-05-10. https://web.archive.org/web/20160510012244/http://linux.about.com/cs/linux101/g/Extended_partit.htm. dead.
  8. Web site: Partitioning with fdisk. Anthony Lissot. Linux Partition HOWTO Revision 3.5. 2005. 2011-07-19.