Windows boot sector recovery. How to restore the boot sector and boot record

How to repair hdd boot sector

Almost every user working with a computer is faced with the problem of hdd sector corruption. There can be a number of reasons for this, ranging from improper shutdown to deep penetration of the virus. There are many possible ways to restore the hdd boot sector and data on it (in some cases, information may be lost forever). Some options will be too complicated for ordinary PC users, and the worst thing is that the wrong actions can lead to this very process of irretrievable data loss or global damage to the overall system. Therefore, the first rule before starting the recovery work is to try to reduce the number of impacts and especially incomprehensible and unverified manipulations. It is not recommended to delete, cut or copy anything. Each problem is individual, so you will need to check the sector on different software. There are many different programs, the most popular are:

HDDScan;
Active File Recovery;
R-Studio;
Norton Partitionmagic;
Raxco;
EASEUS Partition Master.

And this, of course, is not all, but these programs most often cope with the task, and enjoy good reviews among users. Alas, this is not always able to restore the hdd boot sector as soon as possible, problems may arise with determining the type of file system, or the presence of this sector will not be visible.

Media Formatting

This method is suitable for those who do not care about the information on the media and it is important to restore the hdd boot sector as soon as possible. After this procedure, in 80% of cases, work is completely restored. But this method is more often resorted to already in the most extreme cases, because. the data on the disk still plays an important role for almost everyone, especially if it is a working computer.

testdisk
If the user encounters a problem for the first time and absolutely does not know how to restore the hdd2 boot sector, this utility can very quickly cope with the task. However, not without the participation of the user himself, it will be necessary to understand some points. The special complexity of the program is the English interface. With the knowledge of technical words, the system will be understandable.

Consider this method point by point:
1) Find Create a new log file, if necessary, enter the log.
2) Next, you need to find the damaged media according to the description of its characteristics, for example: Disk / dev / sds - 160 GB, select it.
3) Next step, select partition type among Intel, Sun, Mac, etc.
4) After that, possible operations are opened that can be done with the disk. Choose Analyze.
5) Next comes the analysis of possible losses and the overall structure.
6) Selection of geometry on the disk
7) The final steps in the "Master Boot Record" section are responsible for rebooting the sector. You need to select a damaged disk, then check the sectors, overwrite the MBD.

With the correct course of action, after a reboot, the disk should function again and at the same time have all its data in its original form.

The second way is application on Windows
For various reasons, the first option may not work, and the question of how to restore your hdd3 boot sector remains open. To understand the recovery process itself, let's take a closer look at what an MBR is.

MBR is the very first sector that is found on the disk, it has a special partition table and a boot program, it reads the data and their path, starting from the hard disk and ending with the partition of the installed operating system.

Course of action:
1) First you need to turn on the computer and select boot from the installation disk or USB drive, press any key and select "System Restore" in the Windows installation window, if a problem is found, click fix and reboot.
2) If this did not help the boot sector, re-open the "system restore" and select the "next" item, write bootrec / fixmbr on the command line. This command will check the compatibility of the master boot record and solve the problem of its corruption. But nothing will change in the partition table.
3) We issue the following bootrec / fixboot command, this action writes a new boot sector that will be compatible with Windows. Click "exit" and restart your computer.

All in all, this should work! But as practice shows, restoring the hdd boot sector is not so easy, and in this case there are more ways and commands:
1) The bootrec / ScanOs command does a full scan and search for operating systems, if found, it will be visible on the screen.
2) bootrec / RebuildBcd is used to add the found Windows to the general boot menu, the combination of Y and enter will complete the addition process.

If that doesn't work either, a command like bootsect/NT60 SYS on a case-by-case basis can restore the hdd boot sector by updating the master boot code. Then you need to click "sign out" and restart your computer.
Of course, these are far from all the existing methods and programs, so if these options did not help, it is wise to contact the computer forum, because many users are faced with this problem and tell each other how to proceed in order to reasonably restore the hdd boot sector and not damage it yet more harm. Boot sectors are a fairly popular topic, if you google it becomes clear that situations with a bootloader failure are very different, but almost always there is a counteraction to any action. Here are some more good and effective hard drive recovery programs:
MBRFix
Paragon Hard Disk
Hirlen's Boot

Each Windows operating system of a personal computer has special tools that are responsible for an action or operation. But there is such a tool with which you can change errors and problems, as well as restore windows from the command line.
If the OS does not boot, you need to use the help of the Bootrec.exe utility

With its help, problems are fixed in the computer, data is corrected, including windows downloads or configuration files of downloads.

Bootrec.exe - Help fixing Windows bootups

If you have problems starting your computer and find problems with it, you should use the method to fix Windows boot errors. It doesn’t matter which Windows is installed, the problem must be resolved so that you can continue to perform the tasks assigned to you.

When working with a tool like Bootrek.exe, they use commands for , but if the problem situation arose in the OS itself, the tool should be run inside it.

If this happened in Windows 7 version, you will need installation media or a disk that is capable of restoring the boot sector of the hard drive. You can boot from USB or DVD discs, it depends on the OS version.

fig.1. When you see such a picture on the monitor, click on the highlighted function

Then you need to decide on the choice of the operating system that needs to be updated. This is a serious undertaking, as among many systems, only one requires fixing. Click the "Next" button to continue.

fig.2. A new window will open with recovery properties, but only the boot command line is needed here

If there is no disk for installing on Windows 7 or a disk responsible for restoring the boot sector, you will need access to the tools. They are using recovery hidden partitions. Windows 7 will be able to set them automatically when the OS is installed.

Follow a certain sequence: need access to Recovery systems, Diagnostics, Advanced options and Command line

Writing new boot sectors

The bootrec function with the /FixBoot option will make it possible to write to the boot sector inside the system partition on hard drives. When performing this procedure, you need to use boot partitions, but only those that are compatible with Windows 7 and 8 versions.

These options can be used:

If there are damages on the boot sectors, and their structure and size do not meet the requirements of the hard disk.
When writing incompatible boot sectors with the Windows system.
When the old Windows OS was installed in place of the new version.

In order to write a new boot sector, you need to run bootrec.exe as in the picture

The new Windows 10 operating system from Microsoft has already gained popularity among millions of PC users around the world. But like all new products, Windows 10 is not without flaws. Many users of this OS experience bootloader problems. Most often, this problem occurs due to a new operating system update policy.

Now in Windows 10 you cannot turn off updates, as it was in Windows 7 and XP.

The very same problem with the bootloader manifests itself when the user does not wait for the system update to finish and turns it off the POWER button.

After the user turns on the computer again, he meets such a message on the screen of his monitor.

This message indicates that your bootloader is corrupted and needs to be repaired. It is also worth noting that turning off the computer during the update is not the only reason for the breakdown. The bootloader can still be damaged viruses and various malware. Another fairly common cause of failure is faulty HDD, which are bad sectors, that is, the boot record will be located on these sectors. Also, the cause of the bootloader crash can be installing a junior OS on top of Windows 10. To help our readers restore the bootloader, below we have prepared examples in which we will describe in detail how to restore it.

The easiest way to recover

When a PC user sees a message about a bootloader malfunction, the first question that arises for a PC user is how to restore the Windows 10 bootloader. In this example, we will describe the easiest way to restore it. For this example, we need .

If you do not have this disk and Internet access, you can make it on another computer with the same OS.

You can also use the original Windows 10 installation disc for this task. Well, let's get started. Insert the recovery disk into the drive and boot from it when the computer starts.

In the first window of the Recovery Disk Wizard, you must specify keyboard layout, which will open the wizard menu.

In this window, we will select the second tab " Troubleshooting” and immediately go to the next “”.

In the additional parameters, we are interested in the "" tab. After clicking on this link, the wizard will ask you to select an OS to restore its launch.

The computer under test has one Windows 10 operating system installed, so there is only one choice in the wizard. Once the OS is selected, the system will begin troubleshooting the computer and should repair the corrupted bootloader.

If using this method you fail to return Windows 10 to working order, then in the following examples we will describe the detailed process of restoring the boot sector using system utilities diskpart And BCDboot.

Restoring the Windows 10 bootloader using the command line

For this method, we also need Windows 10 recovery disk. Let's boot from the disk, as in the previous example up to the item "". In this menu, we are interested in the "" tab, which we will go to.

First of all, we will run the console utility on the command line diskpart. To do this, in the console, enter the command diskpart

We need this tool for display information about all local drives in the system. Now we need to find the bootloader partition number. This is usually a hidden partition that takes up 500 MB. This partition is created automatically by the Windows 10 installer. Next, to search for it in DiskPart, we will enter the list volume command

From the image you can see that the partition with the boot record is in the first volume on drive C. Also in the image you can see that Windows 10 itself is installed on drive D. Now we must exit the disk program. You can do this with the exit command.

After exiting DiskPart, enter the command bcdboot.exe D:\Windows Also note that the command uses drive D, since it is on it that ten is installed.

This command completely restored dozens of boot files. The principle of this command is to use the utility BCDboot. The developers specifically created this utility to work with Windows boot files. It is also worth noting that thanks to the same utility, the Windows installer creates a hidden partition and copies boot files to it.

Restoring the Windows 10 bootloader using the command line (Method two)

In the second method, we will also use the utilities diskpart And BCDboot and try to overwrite the bootloader. To do this, run DiskPart and find out on which disk our hidden partition and the partition on which Windows 10 is installed are located. The launch of this utility is described above.

Now we need to format the hidden partition, which is located in the first volume. To do this, we will type the select volume 1 command, which will select our hidden encrypted partition with a size of 500 MB.

The next step is to format the selected partition. This is done in order to erase all files from it. For this operation, enter the command in the console format fs=FAT32

After formatting our partition, we will exit the disk utility and enter the new bcdboot.exe D:\Windows command that was entered in the previous example.

This command will not fix the bootloader files as in the previous example, but create new. As you already understood, this method is used if the first one did not work.

Another Way to Repair Windows 10 Boot Using Command Prompt

This method requires a utility bootrec. Unlike the previous utility, this utility does not restore bootloader files, but restore boot record. That is, she restores the MBR- the first sector on the HDD. It is very important for the operating system that the MBR is safe and sound. When the computer starts, its BIOS first of all looks for the MBR to start the operating system from it. For this example, let's start, as in the previous examples, the command line. The utility in question has two main commands /FixMbr and /FixBoot The first command is required to fix MBR, and the second creates a new. First of all, consider the situation when our MBR is damaged. To do this, enter the first command in the console.

In the image above, you can see that the operation was successful, which means that the MBR has been restored.

Now consider a situation where the first method does not work, that is, we will create a new MBR sector. To do this, we use the second command.

From the image above, you can see that the new MBR sector was created successfully.

The examples show how easy it is to restore the MBR sector using the Bootrec console utility. If you have problem with start m Windows 10, we recommend using this example first.

We clean the system from malware before restoring the bootloader

If malware is the cause of the bootloader crash, then this malicious code must be removed before recovery. It will help you in this situation. This is a rescue disk has a lot of tools for restoring a computer, as well as treating it from viruses. You can download Dr.Web LiveDisk on its official website www.drweb.ru. This Live CD is based on linux and is free. This disc is distributed as an ISO image that can be burned to either an optical disc or a USB flash drive. After burning the image to disk, launch Dr.Web LiveDisk.

Select the first item in the start menu and continue downloading Dr.Web LiveDisk. After a few seconds, the OS based on Linux, which is actually Dr.Web LiveDisk, should start up.

In this operating system, you can completely clean your computer of viruses and even make a backup of all information.

Also useful is the fact that this OS has full Internet support and a built-in browser Firefox.

Summing up

In conclusion, I would like to say that if you know all the intricacies of bootloader recovery, then you can quickly fix your computer. It is also worth paying attention to the situation when it is impossible to restore the boot sector and the bootloader itself. In this case, you need to play it safe and use the tools of a full system restore. These means are full system image, created by means of the Windows 10 OS itself, as well as a program such as Acronis True Image. We hope that our material will help you restore the bootloader from the MBR, and the computer will function as before.

The easiest way to restore the bootloader

If pressing F8 does not open additional startup methods and the troubleshooter, then you will need to use a Windows 7 recovery disc or flash drive. From this drive, you will need to boot the computer into the recovery environment by clicking on the system restore link at the bottom of the OS installation window.

The computer will automatically try to find a solution to the problem, which will notify you in the window that opens.
If the recovery utility is up to the task, all that remains is to reboot.

If it was not possible to restore the Windows 7 bootloader after XP, use the startup repair tool, which, along with others, is part of the installation disk or flash drive. Usually, these simple methods can deal with simple MBR startup problems.

Edit boot.ini

Boot.ini is responsible for starting the system by default. If one of the OSes is installed or removed incorrectly, its non-working record will be stored in the same boot.ini. It is located at the root of the system partition, so to edit it, the computer must be configured to show hidden files.

Sometimes boot.ini can be corrupted by a virus or some program could contribute to it, after which the OS does not start on its own.

The fix is simple - boot from the LiveCD and edit boot.ini with regular notepad. There are only two sections here - boot loader, which controls the boot and operating systems. You should remember the value of several parameters:

timeout=10 - time in seconds during which the user can select an OS to run;
multi(0) and disk(0) are parameters that must have zero values;
rdisk(0) - disk number with the system partition (counted from zero).

In general, boot.ini from one OS should look like the one in the picture.

Using the command line to restore the MBR sector

You can get into command line mode from the same boot disk or flash drive by opening the system restore tool and selecting the very last item "Command line".

Type the Bootrec command and then press Enter, a complete list of features will appear
Write down the MBR sector, for which there is the Bootrec.exe /FixMbr command;
On the successful completion of the operation after pressing Enter, the computer will notify the user in the next line;
Next, carry out the procedure for writing a new boot sector, for which enter Bootrec.exe /FixBoot;
It remains only to enter Exit and try to restart the computer.

Enter the command line from the installation disk or flash drive;
Enter Bootrec /ScanOs, after which the utility will scan the computer for an operating system;
Write the Bootrec.exe /RebuildBcd command in the next line, the program will prompt you to add all found versions of Windows to the start menu, including XP, etc .;
It remains to agree with this by pressing Y and Enter in sequence, after which, when the system boots, you will have a choice of which OS to boot - XP or the seven.

You can fix the problem with the MBR with one more command. To do this, at the command line, enter bootsect /NT60 SYS, then Enter. Enter Exit to exit. As a result, the master boot code will be updated and your systems will appear in the list during boot.

In case of serious problems, it may not be possible to restore the MBR using the described methods, so you should try overwriting the files in the boot storage.

BOOTMGR is missing

Such a message on a black screen is usually displayed by the computer when the MBR sector is damaged or deleted. The reason may not be related to the MBR, for example, if the BIOS has lost the Boot tab settings and the system is trying to boot from the wrong disk. But more often it is the bootloader that is to blame, so we will describe how to restore Windows 7 boot.

On a disk with Windows 7 there is always a small 100-megabyte reserved hidden partition for writing OS boot files, including a damaged BOOTMGR. You can simply copy BOOTMGR from the installation media and write to this partition. For this:

Go to the command line from the recovery disk.
Enter the diskpart and list volume commands in sequence, after which a list of your disks and the letters that the system assigned to each of them will appear on the screen. We are interested in a 100 MB reserved partition and an optical drive - drives C and F, respectively, as in the picture.
To exit, type Exit and press Enter.

Type the letter of the installation drive followed by a colon and the command to copy bootmrg to the reserved partition. It will look like this:

F: and then Enter;
copy bootmgr C:\ and press Enter;
Exit, the utility will exit.

If copying to the hidden partition fails, the download store can be completely overwritten. Restoring the Windows 7 bootloader is done with the bcdboot.exe N:\Windows command, where N is the drive letter with the OS. After you are informed that the files were created successfully, you can exit the tool with the Exit command and restart your computer.

write the diskpart line on the command line, which calls the utility;
to list all available physical disks write list disk;
the required disk is selected with the sel disk 0 command, where 0 is the number of the only installed HDD;
to display all partitions of the hard drive, enter list partition;
to select a reserved partition, write the sel part 1 command, where 1 is the partition number;
make it active by typing active;
Exit the application by writing exit.

In extreme cases, you can completely manually delete and format the system partition by starting from some LiveCD, and then using the bcdboot.exe command to create the sector again.

Using Bootice

If Windows XP was installed after the Seven, due to the overwritten MBR sector, only XP starts up and you do not have the option to select a system after you turn on the computer. However, both systems are fully operational, and you can return the start menu very easily, for which the Bootice utility is used:

In the new Bootice window on the left you will see the OS boot list, in which you will need to add the missing "Seven" to Windows XP:

click "Add";
in the list that opens, select the line of the new Windows 7 entry;
on the right side in the upper input field, select the hard drive;
in the field below, indicate the section with the "Seven";
click on save basic settings.

The program will notify you about the successful change of this element in Boot and you can exit Bootice. The next time you turn on your computer, you can already choose which OS to boot from your hard drive - Windows 7 or XP.

Complain about content

send

No matter how advanced an operating system is, it cannot be booted without having two sectors on the hard drive that contain the code needed to run any operating system. The first sector is called the Master Boot Record (MBR); it is always located at: sector 1/cylinder 0/head1 and is the very first sector of the hard drive. The second most important sector is the Boot Sector (boot sector), located in the first sector of each volume.

Master Boot Record

The Master Boot Record is the most important disk structure; this sector is created when the disk is partitioned. The MBR sector contains a small code called the Master Boot Code, as well as a disk signature and a partition table. At the end of the MBR sector is a two-byte structure indicating the end of the sector. It has a value of 0x55AA. The disk signature is a unique number located at offset 0x01B8 that allows the operating system to uniquely identify the disk.

The code located in the MBR sector performs the following actions:

looks for an active partition in the partition table;
looks for the starting sector of the active partition;
loads a copy of the boot sector from the active partition into memory;
transfers control to the executable code from the boot sector.

If these functions fail to complete for some reason, one of the following system error messages is issued:

invalid partition table;
Missing operating system.

Note that for floppy disks there is no concept of MBR. The boot sector is the first sector on the disk. Also keep in mind that every hard drive contains an MBR sector, but the boot code is only used on drives that have an active primary partition.

Partition table

The partition table is a 64-byte structure used to determine the type and location of partitions on a hard drive. The content of this structure is unified and does not depend on the operating system. The information about each partition is 16 bytes, so there can be no more than four partitions on a disk.

Each partition information starts at a specific offset from the start of the sector, as shown in tab. one.

Offset

| |

Meaning

Description

0x01BE| 1 byte| 0x80| Boot Indicator - Indicates if the volume is the active partition. May have the following values: 00 - not used for loading; 80 - active partition
0x01BF| 1 byte| 0x01| Starting Head
0x01C0| 6 bit| 0x01| Starting Sector - bits 0-5 are used. Bits 6 and 7 are used by the next field
0x01C1| 10 bit| 0x00| Starting Cylinder - 10-bit number with a maximum value of 1023
0x01C2| 1 byte| 0x07| System ID - defines the volume type
0x01C3| 1 byte| 0xFE| Ending Head
0x01C4| 6 bit| 0xBF| Ending Sector - bits 0-5 are used. Bits 6 and 7 are used by the next field
0x01C5| 10 bit| 0x09| Ending Cylinder - 10-bit number with a maximum value of 1023
0x01C6| Double word| 0x3F000000| Relative Sectors - offset from the beginning of the disk to the beginning of the volume, expressed in the number of sectors
0x01CA| Double word| 0x4BF57F00| Total Sectors - number of sectors in the volume

Now that we are familiar with the structure of the partition record, let's take a closer look at some of the fields in this record.

Boot indicator field

The first entry in the partition table, the Boot Indicator field, indicates whether the volume is an active partition. We remind you that only the primary partition of a disk can be active. It is possible to install different operating systems and different file systems on different volumes. Using utilities such as FDISK (MS-DOS), Disk Management (Windows 2000), or third-party utilities, you can activate the primary partition and set the appropriate value for this field.

System ID field

This field contains the system identifier and indicates which file system - FAT16, FAT32 or NTFS - was used to format the volume, and also allows you to find out some characteristics of the file system. In addition, this field indicates whether an extended partition exists on the disk. Possible values for the System ID field are shown in tab. 3.

Partition type

Explanations

0x01| Primary partition or logical drive FAT12. Volume has less than 32,680 sectors
0x04| Partition or logical drive FAT16. The volume has 32,680 to 65,535 sectors, or a size of 16 to 33 MB
0x05| Extended section
0x06| BIGDOS FAT16 partition or logical drive. Size from 33 MB to 4 GB
0x07| An NTFS partition or logical drive. Installable File System
0x0B| FAT32 partition or logical drive
0x0C| FAT32 partition or logical drive using BIOS INT 13h extensions
0x0E | BIGDOS FAT16 partition or logical drive using BIOS extensions INT 13h
0x0F| Extended partition using BIOS INT 13h extensions
0x12| EISA section
0x42 |Dynamic Disk Volume (Windows 2000)

Note that only volumes with a System ID field of 0x01, 0x04, 0x05, or 0x06 are available under MS-DOS. However, volumes with a different System ID in this field can be deleted using the FDISK utility.

Cylinder, Head and Sector fields

The fields Starting Cylinder, Ending Cylinder, Starting Head, Ending Head, Starting Sector, and Ending Sector (commonly called CHS) are optional entries in the partition table. The boot code uses the values of these fields to find the boot sector and activate it. The Starting CHS fields of inactive partitions indicate the boot sectors of the primary partitions and the extended boot sector of the first logical drive in the extended partition.

On the rice. 2 showing the Master Boot Record (containing the code, partition table, and signature) and boot sectors for a four-partition drive.

rice. 2
The Ending Cylinder field in the partition table has a size of 10 bits and allows you to describe cylinders with numbers from 0 to 1023. The Starting Head and Ending Head fields have a size of 1 bit and can contain head numbers from 0 to 255. Since the Starting Sector and Ending Sector fields occupy 6 bits each, they can contain values from 0 to 63. Since the sector numbering starts from 1 (and not from 0, as for other fields), the maximum number of sectors per track is 63.

With low-level formatting, all disks are set to a standard sector size of 512 bytes, so the maximum disk size described in the partition table can be calculated as follows:

The code:

Maximum Size = Sector Size x Number of Cylinders x Number of Heads x x Number of Sectors per Track.

Using the maximum allowable values of these quantities, we get:

The code:

512 x 1024 x 256 x 63 (or 512 x 224) = = 8,455,716,864 bytes, or 7.8 GB.

Thus, without the use of the INT 13h extensions, known as Logical Block Addressing (LBA), the size of an active primary partition cannot exceed 7.8 GB, regardless of the file system used.

The maximum volume size under FAT16 depends on the geometry of the disk and the maximum values in the partition table. Possible values with and without LBA are shown in tab. 4. The number of cylinders in both cases is 1024 (0-1023). In the event that the primary partition or logical device occupies an area beyond the 1023rd cylinder, all fields in the partition table will have the maximum allowable values.

LBA mode

Number of heads

Sectors/Track

Max. partition size

Forbidden| 64| 32| 1 GB
Allowed| 255| 63| 4 GB

To get around the 7.8 GB limit described above, Windows 2000 ignores the values in the Starting Sector and Ending Sector fields and instead uses the values in the Relative Sectors and Total Sectors fields.

Relative Sectors and Total Sectors fields

The Relative Sectors field contains the offset from the beginning of the disk to the beginning of the volume, expressed as a number of sectors. The Total Sectors field indicates the total number of sectors in the volume.

Using the values of these two fields (which together is a 32-bit number), we get an additional 8 bits to store the total number of sectors compared to the CHS scheme described above. In this case, the number of sectors can be represented as 232. When using the standard sector size (512 bytes) and the 32-bit representation of the number of sectors, the maximum partition size is limited to 2 TB (or 2,199,023,255,552 bytes). This scheme is used only in Windows 2000 with NTFS and FAT32 file systems.

Note that when creating partitions under Windows 2000, the correct data is also entered in the Starting Cylinder, Ending Cylinder, Starting Head, Ending Head, Starting Sector, and Ending Sector fields. This allows for compatibility with MS-DOS, Windows 95, and Windows 98, as well as the INT 13h functions used by the BIOS when the computer boots.

Enhanced Boot Record

The Extended Boot Record (EBR) consists of an extended partition table and a signature, a two-byte structure with a value of 0x55AA. An extended boot record exists for each logical device in the extended partition. It contains information about the first side of the first cylinder for each logical device. The boot sector of a logical disk is usually located in relative sectors numbered 32 or 63. If there is no extended partition on the disk, then there is no extended boot record and no logical devices.

The first element of the extended partition table for the first logical device points to its boot sector, the second element points to the EBR of the next logical device. If the next logical device does not exist, then the second element is not used - it contains a set of zeros. The third and fourth elements of the extended partition table are not used.

On the rice. 3 shows how the extended boot record works. Three LUNs are shown in the extended section.

rice. 3
Except for the last logical device in the extended partition (see rice. 3), the extended partition table format described in tab. five, repeated for each logical device: the first element describes the boot sector of the logical device, the second element points to the next extended boot record. For the last logical device, elements two through four are not used.

Extended partition table element

Content

First element| Information about the current LUN in the extended section, including the start address for the data
Second element| Information about the next LUN in the extended section, including the address of the sector containing the EBR for the next LUN. This field is not used if there are no following logical devices
Third element| Not used
Fourth element| Not used

The fields of each entry in the extended partition table are similar to those of the regular partition table described above.

The Relative Sectors field in the extended partition table specifies, in bytes, the offset from the beginning of the extended partition to the first sector of the logical device. The number in the Total Sectors field allows you to find out the number of sectors allocated for the logical device. The value of the Total Sectors field is equal to the number of sectors from the beginning of the boot sector to the end of the logical partition.

Due to the critical importance of the information stored in the MBR and EBR sectors, it is recommended to periodically check the disk using the appropriate utilities and create data backups.

boot sector

The boot sector, located in sector 1 of each volume, is the structure that enables the computer to start. This sector contains the executable code and the data that the code requires, including information about the file system used on the volume. The boot sector is created when the volume is formatted. At the end of the boot sector is a two-byte structure called the end-of-sector marker. This structure always contains the value 0x55AA.

On computers running Windows 2000, the boot sector of the active partition is loaded into memory and calls the operating system loader - NTLDR , which performs all the necessary steps to boot Windows 2000.

In Windows 2000, the boot sector contains the following items:

assembler instruction JMP;
manufacturer identifier (OEM ID);
a data structure called the BIOS Parameter Block (BPB);
extended BPB structure;
executable code that starts the operating system.

Note that boot sectors for NTFS, FAT16 and FAT32 are formatted differently.

The BPB structure contains the physical parameters of the volume, the extended BPB structure starts immediately after the standard BPB. The length of the BPB structure and the information it contains depends on the type of boot sector - NTFS, FAT16 or FAT32.

The information stored in the BPB and the extended BPB structure is used by device drivers to read and configure volumes.

The BPB extended structure is immediately followed by the boot code.

Download process

The computer boot process consists of the following basic steps:

On power-up, a BIOS and Processor Verification Test (POST) is performed.
The BIOS looks for a boot device (usually a disk).
The BIOS loads the first physical sector from the boot disk into memory and transfers control to the address where this sector is loaded.

If the boot device is a hard drive, then the BIOS loads the MBR. The code located in the MBR loads the boot sector of the active partition and transfers control to the address where this sector is loaded. On Windows 2000 computers, the executable code in the boot sector finds the NTLDR file, loads it into memory, and transfers control to it.

If there is a disk in drive A, the BIOS loads the first sector (boot sector) of that disk into memory. If the disk is bootable (contains the base files of the operating system), the boot sector is loaded into memory and uses code to transfer control to the IO.SYS file, the base file of the MS-DOS operating system. If the disk is not bootable, the executable code in the boot sector issues the following message:

Non-System disk or disk error
Replace and press any key when ready

The initial boot process is independent of the disk format and operating system. The unique characteristics of the operating and file systems are already used after the execution of code from the boot sector begins.

Types of boot sectors

As we already know, MBR transfers control to the boot sector. Therefore, the first three bytes of this sector must contain a valid instruction for the CPU. This instruction is a jump instruction that redirects code execution. The JMP instruction is followed by an 8-byte manufacturer identifier (OEM ID), a string describing the name and version number of the operating system used to format the volume.

To maintain compatibility with MS-DOS, Windows 2000 writes the identifier "MSDOS5.0" for the FAT16 and FAT32 file systems. For the NTFS file system, the identifier contains the characters "NTFS".

Windows 95 uses the "MSWIN4.0" identifier, while Windows 95 OSR2 and Windows 98 use the "MSWIN4.1" identifier.

Immediately following the manufacturer ID is a data structure called the BIOS Parameter Block (BPB). It contains the information needed to locate the NTLDR file. Since the BPBs are usually located at the same offset, the standard parameters are easily found. Since the JMP instruction bypasses the BPB structure, its size can be increased in the future if any additional information needs to be stored here.
Now let's look at what boot sectors look like for the three main file systems - FAT16, FAT32 and NTFS.

FAT16 boot sector

IN tab. 6 the description of the boot sector for the FAT16 file system is given.

Offset

| |

A specific example shows the contents of the FAT16 boot sector. There are three sections here:

bytes 0x00-0x0A contain the JMP instruction and OEM ID (in bold);
bytes 0x0B-0x3D contain BPB and extended BPB;
the rest of the bytes contain the boot code and end-of-sector marker (shown in bold).

The following two tables show the contents of the BPB ( tab. 7) and extended BPB ( tab. 8) for FAT16. The given values correspond to the boot sector shown in fig. 4.

Offset

| |

Meaning

Description

0x0D| 1 byte| 0x40| The number of sectors in the cluster. Because FAT16 supports a limited number of clusters (up to 65,536), larger volumes require more sectors per cluster. The default value of this field depends on the size of the volume. Valid values are: 1, 2, 4, 8, 16, 32, 64, and 128. Values that increase the cluster size beyond 32 KB (the number of bytes per sector times the number of sectors in the cluster) can cause errors
0x0E| 2 bytes| 0x0100| Reserved sectors - the number of sectors before the first FAT table, including the boot sector. The value of this field is always 1

0x11| 2 bytes| 0x0002| The total number of 32-byte file and directory names that can be stored in the root directory of the volume. Typically, the value of this field is 512. One element is always used to store the volume label, so the maximum number of files and directories does not exceed 511
0x13| 2 bytes| 0x0000| The number of sectors in the volume, expressed as a 16-bit value. For volumes with more than 65,536 sectors, this field is not used and its value is 0

0x16| 2 bytes| 0xFC00| The number of sectors in each FAT copy. The value of this field, the number of FAT copies, and the number of reserved sectors are used to calculate the location of the root directory. By knowing the maximum number of entries in the root directory, you can also find out where the user data starts.

0x1A| 2 bytes| 0x4000| Number of heads. Used for low-level formatting of disks
0x1c| 4 bytes| 0x3F000000| The number of "hidden" sectors - the number of sectors before the boot sector. Used at boot time to calculate the absolute offset of the root directory and data
0x20| 4 bytes| 0x01F03E00| The number of sectors in the volume, expressed as a 32-bit value. Used for volumes with more than 65,536 sectors

Offset

| |

Meaning

Description

rice. 4
FAT32 boot sector

The FAT32 boot sector has much in common with the FAT16 boot sector, but BPB contains additional fields, and those fields used in FAT16 are located at different addresses. Thus, disks formatted under FAT32 cannot be read by operating systems that are not compatible with FAT32.

IN tab. nine shows the contents of the boot sector for the FAT32 file system.

Offset

| |

Meaning

Description

0x0B| 2 bytes| 0x0002| The number of bytes in the sector is the size of the sector. Valid values are 512, 1024, 2048, and 4096. For most drives, the value of this field is 512
0x0D| 1 byte| 0x40| The number of sectors in the cluster. Because FAT32 supports a limited number of clusters (up to 4,294,967,296), very large volumes require more sectors per cluster. The default value of this field depends on the size of the volume. Valid values are 1, 2, 4, 8, 16, 32, 64, and 128. In Windows 2000, volumes up to 32 GB are supported for FAT32. Larger volumes created with Windows 95 OSR2 and Windows 98 are available from Windows 2000
0x0E| 2 bytes| 0x0200| Reserved sectors - the number of sectors before the first FAT table, including the boot sector. The value of this field for FAT32 is usually 32
0x10| 1 byte| 0x02| The number of FAT table copies for this volume. The value of this field is always 2
0x11| 2 bytes| 0x0000| The total number of 32-byte file and directory names that can be stored in the root directory of the volume (FAT12/FAT16 only). For FAT32 volumes, this field must be 0
0x13| 2 bytes| 0x0000| The number of sectors in the volume, expressed as a 16-bit value (FAT12/FAT16 only). For FAT32 volumes, this field must be 0
0x15| 1 byte| 0xF8| Media type. The value 0xF8 indicates a hard disk, 0xF0 indicates a high density floppy disk. This field is not used in Windows 2000
0x16| 2 bytes| 0x0000| Number of sectors in each FAT copy (FAT12/FAT16 only). For FAT32 volumes, this field must be 0
0x18| 2 bytes| 0x3F00| The number of sectors in a track. Used for low-level formatting of disks
0x1A| 2 bytes| 0xFF00| Number of heads. Used for low-level formatting of disks
0x1c| 4 bytes| 0xEE39D700| The number of "hidden" sectors - the number of sectors before the boot sector. Used at boot time to calculate the absolute offset of the root directory and data
0x20| 4 bytes| 0x7F324E00| The number of sectors in the volume, expressed as a 32-bit value. Used for volumes with more than 65,536 sectors
0x24| 4 bytes| 0x83130000| Number of sectors in FAT (FAT32 only)
0x28| 2 bytes| 0x0000| Extended flags (only for FAT32). Separate bits of this word have the following purpose: bits 0-3 - number of active FATs; bits 4-6 are reserved; bit 7 is 0 if FAT "mirroring" is in progress; equals 1 if only one FAT is active; bits 8-15 - reserved
0x2A| 2 bytes| 0x0000| File system version (FAT32 only)
0x2c| 4 bytes| 0x02000000| Cluster number for the first root directory cluster (FAT32 only). Usually the value of this field is 2
0x34| 2 bytes| 0x0600| Sector number with boot sector backup (only for FAT32). Typically, the value of this field is 6
0x36| 12 bytes| 0x000000000000000000000000| Reserved (FAT32 only)