China DOS Union

Hard Disk Master Boot Sector = Hard Disk Master Boot Record (MBR) + Hard Disk Partition Table (DPT)
--------------------------------------------------------------
Physical location: Cylinder 0, Side 0, Sector 1
Size: 512 bytes
Among them: MBR 446 bytes (0000--01BD), DPT 64 bytes (01BE--01FD), ending flag 2 bytes (55 AA)
Function: The MBR guides the system to jump to the DBR by checking the DPT partition information;
Reading: Use NORTON DISKEDIT, select DRIVE——>PHYSICAL DISK-—HARD DISK in the OBJECT menu, then select DISK PARTITION TABLE in the OBJECT menu to read, and use the WRITE OBJECT TO option in the TOOLS menu to save to a specified file for backup;
Writing: Use NORTON DISKEDIT, select DRIVE——>FLOOPY DISK in the OBJECT menu, select the backed-up DPT file, then use the WRITE OBJECT TO——>PHYSICAL SECTOR option in the TOOLS menu to write to 001 (Cylinder 0, Side 0, Sector 1);

Detailed explanation:
000H--08AH MBR boot program (find boot partition)
08BH--0D9H MBR boot string
0DAH--1BCH Reserved ("0")
1BEH--1FDH Hard disk partition table
1FEH--1FFH Ending flag (55AA)


Active Partition Boot Sector (DBR)
--------------------------
Physical location: Cylinder 0, Side 1, Sector 1
Size: FAT16 1 sector 512 bytes, FAT32 3 sectors 1536 bytes
Function: Contains machine CMOS and other information (0000--0059), checks this information and boots the specified system file, such as NTLDR, etc.;
Reading: Use NORTON DISKEDIT, select DRIVE——>LOGICAL DISK-—DISK C in the OBJECT menu, then select BOOT RECORD in the OBJECT menu to read, and use the WRITE OBJECT TO option in the TOOLS menu to save to a specified file for backup;
Writing: Use NORTON DISKEDIT, select DRIVE——>FLOOPY DISK in the OBJECT menu, select the backed-up DBR file, then use the WRITE OBJECT TO——>PHYSICAL SECTOR option in the TOOLS menu to write to 011 (Cylinder 0, Side 1, Sector 1);


Detailed explanation:

000H--002H 3-byte jump instruction (go to boot program, jump to 03EH)
003H--03DH BIOS parameter area
03EH--19DH DOS boot program
19EH--1E5H Boot string
1E6H--1FDH File name (IO.SYS, MSDOS.SYS)
1FEH--1FFH Ending mark (55AA)


Hard Disk Partition Table (DPT)
---------------------
Offset address Number of bytes Meaning analysis

01BE 1 Partition type: 00 means inactive partition; 80 means active partition; others are invalid partitions.

01BF~01C1 3 *Starting address of the partition (side/sector/cylinder), usually the starting address of the first partition starts at Side 1, Cylinder 0, Sector 1, so these three bytes should be 010100

01C2 1 #Type of the operating system of the partition.

01C3~01C5 3 *Ending address of the partition (side/sector/cylinder)

01C6~01C9 4 Starting logical sector of the partition

01CA~01CD 4 Total number of sectors occupied by the partition

Note: * Pay attention to the byte allocation in the starting address (side/sector/cylinder) and ending address (side/sector/cylinder) of the partition:

00000000 01000001 00010101
^^^^^^^^ ==~~~~~~ ========

^ Side (head) 8 bits
~ Sector 6 bits
= Cylinder 10 bits

# Operating system type of the partition (file format flag code)

4---DOS FAT16 32M
7---NTFS(OS/2)
83---LINUX>64M


The DPT is a total of 64 bytes (01BE--01FD). As shown above, each partition occupies 16 bytes, so it can represent four partitions. This is why the sum of the primary partition and the extended partition of a disk can only be four in total.


Logical Drive
-----------
The information of the extended partition is located in the hard disk partition table (DPT) shown above, and the information of the logical drive is located in the starting sector of the extended partition, that is, the sector corresponding to the starting address (side/sector/cylinder) of the partition. The information in this sector is different from the hard disk master boot sector in that it does not contain the MBR, and the 16-byte partition information represents the starting and ending addresses of the logical drive, etc.


Therefore, in the case where the disk only contains one primary partition and one extended partition (including multiple logical drives), even if the data of the hard disk master boot sector (including DPT) is lost due to a virus or other reasons, the entire hard disk can be restored through the data of the logical drive.

For example: The following is a partition situation of a hard disk.

Cylinder Side Sector Cylinder Side Sector Starting sector (logical) Ending sector Total sectors
MBR 0 0 1 - - - - - -
C 0 1 1 276 239 63 63 4,188,239 4,188,177
Extended 277 0 1 554 239 63 4,188,240 8,391,599 4,203,360
D 277 1 1 554 239 63 4,188,303 8,391,599 4,203,297


If the primary partition table is damaged, the data of the logical drive contained in the extended partition table can be manually found. In this example, it is the data corresponding to drive D. Then subtract 63 from its starting sector (logical) to get the starting sector (logical) of the corresponding extended partition, and change its starting address (side) to 0 to get the starting address of the extended partition. Then, through the extended partition, the information of the primary partition C can be obtained, and then the entire hard disk can be restored by using the DISK/MBR command and manually filling in the partition table.

It is relatively troublesome to actually use this method. If the size of each partition is known, the disk can be repartitioned to the original size by using PQ MAGIC 5 (note: never apply it, we just get data through it), and view INFO to obtain the above data, record it, then cancel the partition operation, and then manually modify the DPT table by using NORTON DISK 2000 to restore the entire hard disk.

The partition table data corresponding to this example:
80 01
01 00 06 EF 7F 14 3F 00 00 00 11 E8 3F 00 00 00
41 15 05 EF BF 2A 50 E8 3F 00 60 23 40 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

Extended partition table data:
00 01
41 15 07 EF BF 2A 8F E8 3F 00 21 23 40 00

Note: The logical starting sector and the total number of partitions are low-byte first. For example, when converting the starting address of the extended partition 50 E8 3F 00 to decimal, it should be changed to 00 3F E8 50 first. The total number of occupied partitions 60 23 40 00 should be changed to 00 40 23 60 first. Similarly, when manually filling in this value, the high-low byte conversion should also be performed.