A master boot record is a traditional way of storing information on a hard drive along with some boot code. That is, the table is contained inside the MBR, which is stored in sector No. 1: cylinder 0 / head 0 / sector 1 or, alternatively, LBA 0.
Personal computers still use this bootable disk standard with partition information on it. Traditional MBR partition tables in the modern world are technically outdated, because the 32-bit LBA field structure starts to “overflow” when working with 2 TB disks. One of its possible replacements is the GPT.
Description of sections and sectors
MBR is the first 512-byte partition of the physical sector of the hard disk. Its abbreviation for Master Boot Record is a standard that began to function in 1983 until today. Nevertheless, it no longer meets the new technological requirements. One of the main limitations is the maximum size with which it can work - 2 TB. Another limitation is that the MBR can interact with only 4 primary partitions.
Access Methods:
- In CHS (cylinders / heads, old access mode), this is sector # 1, head # 0 and cylinder # 0.
- in LBA (linear access, starting from scratch) - this is the first physical sector No. 0.
In LBA they have an absolute number, with the first being a zero number. For example, the MBR partition table on a 80 GB MAXTOR disk has 160,071,660 sectors: in LBA mode, they are numbered from 0 to 160,071,659.
MBR contains 2 elements that are important for starting a PC:
- a boot program that the BIOS will launch after a hardware test;
- main table.
It contains 4 descriptors describing the physical position of the hard drive. Physical position is indicated in the table:
- absolute sector number number 1 in the LBA;
- number of sectors and type of section.
Main table structure
Since the MBR partition table contains only 4 descriptors, this explains why the hard disk consists of four partitions. If the user needs more, he will have to create an advanced version.
Conditions for creating an extended section:
- Only one partition is allowed on the hard drive.
- It can be divided into as many logical parts as needed.
- The first sector of the extended section contains a table of logical elements.
- In the middle of the hard drive is an MBR partition table.
Two configurations are possible using 4 descriptors:
- 4 main sections without advanced.
- 3 main and 1 advanced, divided into several logical parts.
Definition of the structure of ICBMs:
- First find the BOOT program.
- In the middle, find the MBR partition table.
- Confirm that this is the BOOT sector.
- The two bytes found are the hexadecimal values 0x55 and 0xAA.
Grub boot program
The MBR contains a table that differs from one disk to another, because partitions do not have the same size as the sector. In order to duplicate the boot program, for example, for Grub, the MBR partition tables from disk 1 to 2, you cannot copy it directly to the second one, since everything will be lost during rewriting.
General restrictions:
- Contains a table of 4 disk partitions.
- It has no logical distinctions.
- Of the 4 core, only one can be extended.
- If an extended logical partition is created on the disk, then it is saved in the first sector.
There are two tables on the hard drive:
- MAIN stored in the first sector, which is located on the selected disk of the MBR partition table.
- The logical partition table stored in the first sector in the middle of the disk.
Saving and changing key elements
Given the fragility of the structure with respect to virus programs, it is important to back up the tables in order to restore them in case of problems, for example, regarding the MAIN. When an MBR partition table is located on the selected partition, it is taken into account that the hard disk contains 4 main ones and does not have an extended one; primary loss or destruction occurs in one of two cases:
- a virus whose purpose is to destroy a table;
- user abuse with MBR.
There are two solutions for backup: create a backup copy of the floppy disk (512 bytes), where the MBR partition table is located on the selected partition and copy the vital information for storage in a safe place.
Backing up to a file can be done using the dd utility for Linux, as follows:
dd if = / dev / hda of = secteur_mbr_disque_hda bs = 512 count = 1.
Then create a file: sector_mbr_disque_hda, which contains 512 MBR bytes.
To view it in hexadecimal format, use mc for Linux: mc -v sector_mbr_disque_hda.
The algorithm for the following actions when the disk contains the MBR partition table:
- Press F4 to see the file in hexadecimal format.
- Press F10 to exit mc.
- Find the backup sector_mbr_disque_hda file on the backup drive.
Backup
To avoid additional problems with reading the backup copy, you must save the table. Of all the information contained in descriptors of 16 bytes in the MBR, only the following 3 are of interest and will allow you to save or restore the main sections:
- absolute number in the LBA of the first;
- sectorization size;
- section type (hexadecimal number from 0x00 to 0xFF).
To get it, use the fdisk program for Linux. For example, to scan a disk, run: fdisk / dev / hdb. Enter the expert menu: the “x” command. Browse tables: p command. Then Fdisk displays the contents of 4 MBR descriptors, start and end in CHS mode, start and size in absolute sectors (LBA mode), last column (ID).
To save the main one, you must specify the type, beginning and size of each of the 4 sections. For example, for a MAXTOR of 80 GB, the following scheme is used.
Hdb1 starts at 63, not the first. This means that sectors 1 to 62 are not used on the disk, which is confirmed by the fdisk v command.
Table under Linux fdisk
In expert mode, the structure noted above has an absolute sector for LBA access for a unit. But some programs provide fdisk as usual and offer a cylinder as a unit (1 cylinder = 16,065, sectors = approximately 8 Mo). Therefore, they make a choice: either raise the partition table and use the sector as a unit, or raise the cylinders and apply a cylindrical unit. The goal is to avoid conversion, for example, to switch from CHS mode to LBA mode, which in case of incorrect calculation can be a disaster for saved data.
Although the cylinder seems more suitable for describing partitions on the selected drive, where the MBR table for large hard drives is located, only the sector is used for two reasons:
- It is the smallest unit and allows you to define sections, even if they do not end at the cylinder limit, that is, if it does not contain the number of ENTIER cylinders.
- The GRUB program (start) allows you to manually restore the table provided that you enter information in the absolute sectors of the LBA, and not in the cylinders.
Mastering the contents of the hard drive
To restore the main partition table, use GRUB either from the command line when starting the PC, or booting from a diskette containing Grub, running it in the Linux shell. When it presents the boot systems menu (Linux, Windows), press "C" to go to the command line.
The TAB key shows on the screen all the commands that can be used in Grub. Among them is the partnew function, which creates a new section. In fact, it does nothing but write (rewrite) one of the 4 descriptors in the MBR.
Syntax partnew: partnew partition type début taille,
Where:
- Partition is a partition for recovery in the form of (hd0,0) or (hd0,1) or (hd1,0). Grub starts disk numbering from scratch. For example, (hd0,0) represents hda1 for Linux. Similarly, Linux hdb3 will be introduced as (hd1,2).
- Type - type of section in the form of a hexadecimal number (with the prefix 0x) per 1 byte.
- Début is the absolute LBA number of the first sector.
- Taille - represents the size of the sector.
For example, to restore 4 80 GB maxtor partitions, the disk contains the MBR partition table, so the following 4 commands are typed:
- grub> partnew (hd1,0) 0x83 63 7180992;
- grub> partnew (hd1,1) 0x82 7181055 1076355;
- grub> partnew (hd1,2) 0xc 8257473 73674027;
- grub> partnew (hd1,3) 0x83 81931563 78140097.
To reproduce the table stored in the MBR, use the command: grub> geometry (hd1).
Then Grub returns the type of each primary partition, as well as the total number of sectors on the disk in LBA, but does not give the characteristics (beginning and size) of each partition, therefore it allows you to enter the table.
Optionally, Grub allows you to enter information from the place where the MBR table is in descriptors on this section. It also "devastates" one or more of the 4 descriptors of Linux, DOS, and Windows.
Setting registry size
MFT is the central structure of NTFS and FAT. The section has a backup copy (MFT Mirror) to protect against possible information loss. In this design, it occupies several thousand clusters. By default, NTFS reserves 12.5% of the available space on a partition; data cannot be written to this reserved area, which avoids fragmentation.
The registry determines the size of the MFT depending on the type of file that was used for registration. If the user writes a lot of small files, it is best to have a large MFT. You can increase it and this will improve performance if there is enough free space on the partition. Disadvantages of the method: if there is a little free space on the partition, increasing the MFT may contribute to its fragmentation and the appearance of the opposite effect.
There is certain software that allows you to defragment an MFT by executing it at startup. To configure the MFT size in the registry, first save it using Erunt, and then find the following key: HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Control \ FileSystem.
Right-click the NtfsMftZoneReservation value and assign a value from 1 to 4 in accordance with the required space for the MFT (12.5%, 25%, 37.5%, 50%). Then they exit the registry and restart the computer.
Preliminary defragmentation in safe mode is not required, but ideally it is better to set the MFT size in the just formatted section before entering data. It is recommended to know in advance what type of data will be posted: films, music and photos, documents, this allows you to adapt the size at best.
Camouflage for the operating system
This operation is performed in order to hide data on the hard drive. Disguise makes data inaccessible to the OS. Thus, even the system administrator (root Linux) will no longer be able to access this hidden data.
Camouflage does not boil down to simply hiding a file by activating its purpose or access rights using Ext2 file system restrictions on Linux or NTFS on Windows. Concealment is the non-use of legal functions that everyone knows, and the use of features (BIOS, MBR, and partition structures). The operating system will completely ignore this space.
The first solution, which is the least original of all, is to hide the entire section using Partition Magic. Thus, only FAT (FAT16 or FAT32) or NTFS formatted in file systems can be hidden. Here are the types to use for these sections.
Descriptor Reorganization
To change the type of a partition in one of the MBR descriptors without changing other characteristics, you can use the partty command from Grub. For example, to hide hdb3 with 0xc in FAT32, enter the following at the command line: grub> parttype (hd1,2) 0x1c.
Thus, the space occupied by the partition will not be empty space, and it will not be visible from Microsoft operating systems (MS-DOS, Win 9x, and Windows XP). For Linux, whether the type is 0xc or 0x1c, FAT32 will not cause problems in both cases.
In order to redisplay hdb3 on Windows, it will give it the parameter 0xc instead of 0x1c: grub> parttype (hd1,2) 0xc. This solution uses only the type of the regular partition and hides data only for DOS and Windows systems.
Recovery boot procedure
Under Windows XP, you can recreate the MBR boot procedure under DOS using the FIXMBR command. Master Boot Record rewrite that eliminates boot viruses, repairs damage when the PC no longer boots or the bootloader is removed. To save and restore MBR under Windows, you need to use a debugging program. On UNIX and Linux, the dd command is used. It is necessary to save and restore only the first sector, the first 512 bytes of the disk.
Restoring the MBR from one hard drive to another is very risky, since the partition table of the second will be replaced by the first. The only exception to this rule is possible when both machines have exactly the same hardware configuration, especially if the hard drives are the same and their partition is the same.
In Windows Vista, the bootrec / FixMbr command is used for recovery. This is available from the recovery console. It should be noted that if the original MBR pointed to the Linux boot loader (GRUB, LILO), it becomes unavailable after this failure. Then it should boot from the Linux CD (install / restore) and, thus, restore it.
Computer security system
Regardless of whether you are using a Windows, Macintosh, or Linux computer for everyday use, you need to take minimal steps to protect sensitive data on machines connected to the network.
Algorithm of actions:
- Perform chkdsk operation regularly to repair or isolate bad sectors, which is more important than defragmenting or cleaning disks.
- Run and save boot sectors of all MBR partitions. There are various software for this: EditHexa, PTedit, DiskMap. These programs allow you to back up and show created tables.
- Use data recovery software if users forgot to make backups.
Standards Comparison
Despite the fact that the MBR is still fully functional, a new GPT standard for GUID has been released to replace it, which is associated with new UEFI systems. It has no restrictions, other than those set by the OS itself, both in size and in quantity, for example, Windows has a limit of 128 partitions. GPT discs are much more reliable than MBRs. In the event of loss, damage, or overwriting, the GPT creates several redundant copies throughout the disk, so that in the event of a failure, problem, or error, the table is automatically extracted from any of these copies.
From the point of view of compatibility, when creating or editing partitions, the tool must be correlated with the new format, otherwise editing the MBR partition table is impossible, since protection will be activated so that the incompatible tool does not confuse the GPT with MBR standards.
As for the Windows OS, you can only boot from the GPT in 64 versions, starting with Vista. Modern versions of Linux are also compatible with this type of disk, and even Apple has started using GPT as the default table instead of APT (Apple Partition Table).
There are several ways to find out if a disk is using a particular MBR partition table. To do this, you can open the Windows Disk Manager, any partitioning tool included in MS-DOS.
Open the CMD window with administrator rights and enter diskpart into it. As soon as the tool is loaded, it does its job, and the user is left to familiarize himself with the result.