This page has been robot translated, sorry for typos if any. Original content here.

Home Boot Record - Master Boot Record (MBR)

First, let's define the terminology. The words in the title of the article are often understood as two different things, which in some cases may be equivalent, and in some cases not. The first concept is Master Boot Record itself. This is a record (program code and data) that is loaded into memory from the hard drive and provides identification of logical partitions on it, determines the active partition and downloads the boot record (Boot Record - BR) from it, which will continue to launch the operating system (OS). And the second concept is the Boot Sector, the Master Boot Sector (MBS) is a sector located on cylinder 0, plane (head) 0 and having number 1. In most cases, MBS contains all the necessary code and all data, therefore its content is MBR However, there are cases (which we will consider at the end of the article) when the code and data do not fit in one sector (there is simply not enough space or for security reasons), and then the code of this sector ensures that the other sectors are loaded into memory. In this case, the MBR is the collection of all sectors that need to be loaded, and MBS is just the first sector.
However, we begin with the case when MBR and MBS are one and the same, and we will call them the more familiar and widespread term MBR. Slightly departing from the topic, I note that such an MBR (providing the download of any OS and occupying only MBS) is usually called the term Generic MBR.
In general, the MBR appeared on hard disks starting with MS DOS version 3.0, in earlier versions the hard disk was formatted as a floppy disk, and the BR was located in the first sector. Accordingly, the disk was a single partition and could not be divided into logical parts - however, with those sizes of disks that were then released, this was irrelevant.
The sector size on the hard disk is 512 bytes. This space is enough to accommodate all the necessary there - and the code and data. However, only one structure must be present there necessarily - this is the signature. This word is a special, strictly established, sequence of 2 bytes with hexadecimal values ​​55h AAh, which is written in the last 2 bytes of the sector and, accordingly, has an offset from the beginning of the sector 1FEh. If at least one of the last two bytes differs in value, it is considered that the first sector is not an MBR and does not contain meaningful information. If the computer at startup, after reading the first sector, does not find the correct signature, it will not transfer control to the code located there, even if it is correct, and will display a message stating that the main boot record was not found. Or will try to find it on other devices - for example, on a diskette. Slightly deviating from the topic, I note that BR also contains the signature 55h AAh in the last two bytes.
Well, if we started from the tail, then go from it to the beginning of the sector. Before the signature, close to it, there are 4 data blocks of 16 bytes each (respectively, with an offset from the beginning of the sector 1BEh, 1CEh, 1DEh, 1EEh). The combination of these blocks is called the Partition Table, Partition Table (PT), and each individual record is called an element of the partition table (Partition Table Entry) or simply a partition (Partition). These 16 bytes are quite enough to indicate all the necessary characteristics of the section, namely: type of section, indication of section activity, initial and final sector sections in the format Cylinder (track) - Head (side) - Sector (Cylinder - Head - Sector, CHS) , the relative number of the first sector (relative to the MBR) and the number of sectors in the section.
The rest of the sector space is occupied by the program code, which provides for parsing PT, searching for the active partition, loading the BR of this partition into memory and transferring control to it. As it is easy to calculate, the code is 512 - 4 * 16 - 2 = 446 bytes. This space is abundant enough to perform these actions.
So, the general MBR structure can be represented by the following table:
  Offset Length Description
 000h 446 loader code
 1BEh 64 Partition Table
  16 Section 1
 1CEh 16 Section 2
 1DEh 16 Section 3
 1EEh 16 Section 4
 1FEh 2 Signature (55h AAh)
Each 16-byte block describing one section has the following structure:
  Offset Length Description
 00h 1 Sign of section activity
 01h 1 Start of section - head
 02h 1 Start of section - sector (bits 0-5), track (bits 6,7)
 03h 1 Start of section - track (high bits 8.9 are stored in the sector number byte)
 04h 1 Partition type code
 05h 1 End of section - head
 06h 1 End of section - sector (bits 0-5), track (bits 6,7)
 07h 1 End of section - track (high bits 8.9 are stored in the sector number byte)
 08h 4 Offset of the first sector
 0Ch 4 Number of partition sectors
The partition type code is a single-byte identifier. If its value is 00h, then it is considered that this PT element does not contain partition data, and its contents are ignored. Any non-zero value means that there is a partition of a certain type in the specified space. Some values ​​unambiguously indicate the type of partition, some correspond to several possible types, and the definition of a specific type is assigned to the operating system, the rest are reserved for future use. A relatively comprehensive and up-to-date reference book on partition type codes can be found in Ralf Brown Interrupt List in the file INTERRUPT.D, table 00652, which is contained in the archive (at the time of writing) inter61a.zip at http://www.pobox.com/ ~ ralf / files.html . Here I will give a table of the types of partitions created by the Windows 9x and Windows NT / 2000 / XP operating systems:
  Code Section Type
 01h 12-bit FAT
 04h 16-bit FAT up to 32 MB
 05h Advanced Section
 06h 16-bit FAT over 32 MB
 07h Windows NT NTFS (and some others - the type is determined by the contents of the BR)
 0Bh 32-bit FAT
 0Ch 32-bit FAT using the INT13 Extended Control
 0Eh LBA VFAT (same as 06h, using INT13 extended control)
 0Fh LBA VFAT (same as 05h, using the INT13 extended control)
 17h Hidden NTFS partition
 1Bh Hidden section of 32-bit FAT (same as 0Bh)
 1Ch Hidden section of 32-bit FAT using INT13 advanced control (same as 0Ch)
 1Eh Hidden LBA VFAT section (same as 06h, using INT13 extended control)
 86h FAT-16 section of the Windows NT stripe array
 87h NTFS partition of the Windows NT stripe array
 B6h Mirrored master partition of FAT-16 Windows NT
 B7h Mirrored master NTFS partition Windows NT
 C6h FAT-16 Windows NT Mirror Slave partition
 C7h NTFS Windows NT Mirror Slave
A sign of section activity - i.e. A sign that the operating system should be loaded from this section - it can have values ​​of 80h (partition is active) and 00h (partition is not active). In general, the number of active partitions should be no more than 1 (otherwise how to make a choice?). If there are no active partitions, then the OS cannot be loaded from this hard disk. Other values ​​are considered erroneous and ignored. However, the transfer control decision is taken by the loader code, therefore the byte value of the load indication is an axiom only for standard loaders.
The three-byte block of the address of the beginning and the address of the end of the section have the same format. Here, in fact, the packaging of values ​​is used so that they have a minimum volume. The packaging format is fully consistent with how this data is transferred to the hard disk drive (Int 13h) procedures stored in the computer's BIOS, which is why the computational overhead costs are minimal. In this case, the cylinders and tracks are numbered, starting from zero, and the sectors, for some reason, from the first. I don’t know why - it happened historically.
The sector to which the address of the beginning of the section points contains a special record called the boot record (BR). We will consider its purpose and composition in a separate article.
The offset of the first sector of the partition is actually the number of this sector if all sectors of the hard disk are renumbered starting from 0 (according to the numbering used by Int 25h / 26h) in ascending order, first by sector of one track, then in order of increasing the head numbers and, finally, cylinders. And what is the number of sectors in the section - it is clear without explanation.
Naturally, all these values ​​are connected by simple dependencies, because the information contained in them is redundant. Therefore, I will give the formulas of dependence between them.
So, if we denote:
C M - the cylinder on which the MBR is located;
H M - the path on which the MBR is located;
S M - the sector in which the MBR is located;
C S , H S , S S , C E , H E , S E - the same for the sectors of the beginning (S) and end (E) of the section;
H H - the number of tracks in the hard disk;
S H - the number of sectors on one track of a hard disk
then:
The absolute sector number in which the PT is located:
Num PT = C M * H H * S H + H M * S H + S M -1
Absolute sector number of the beginning of the section:
Num S = C S * H H * S H + H S * S H + S S -1
Absolute sector number at the end of the section:
Num E = C E * H H * E H + H E * E H + E E -1
Offset of the first sector of the section:
Offset S = Num S - Num PT
Number of partition sectors:
Amount = Num E - Num S +1
From the above formulas, moreover, it is clear that how many tracks have one cylinder of a hard disk and how many sectors there are on each track. These values ​​depend on both the hard disk geometry and the translation mode selected in the BIOS settings. Therefore, a disk divided into sections in one broadcast mode may turn out to be unreadable when the broadcast mode changes.
There are several translation modes for IDE drives:
CHS (Cylinder-Head-Sector) - while the geometry of the disk is considered to be what it tells the computer. Make no mistake - most drives do not have real geometry at all. However, the controller, which is part of the hard disk, performs the necessary transformations on its own, and the way it does it is not essential for us. The maximum number of cylinders is 1024 (from 0 to 1023), the tracks are 16 (from 0 to 15), the sectors are 63 (from 1 to 63), and the maximum disk capacity available in this broadcast without the use of special programs is 504 MB . During disk operations, the sector address is transmitted by the computer's BIOS to the hard disk controller without change.
LBA (Logical Block Addressing) - this translation mode uses the wrong disk geometry, which it tells the computer's BIOS. The format is reduced when the number of cylinders does not exceed 1024, and the number of sectors per track is 63. The given number of tracks depends on the computer's BIOS and hard disk capacity and can be 16, 64, 128 or 255, the latest BIOS versions are usually use a cast to 255 (0-254) tracks regardless of the size of the drive. When a disk is accessed, the cylinder, head, and sector numbers transferred to the LBA broadcasts are recalculated into the absolute sector number, and it is this information that is transmitted to the computer BIOS by the hard disk controller to perform the operation. With a drive larger than 8 GB, the number of cylinders is over 1024; therefore, on computers that do not support the work of the advanced mode Int 13h, without installing special software, the space beyond the limits of 8 GB is not available (regardless of the broadcast mode). Sometimes, however, computer BIOS update helps.
LARGE, or ECHS (Extended CHS) - in this broadcast mode, the number of cylinders is reduced to a value less than 1024 due to a multiple increase in the number of tracks. The given number of tracks is strictly a multiple of the real number of sectors per track does not change. However, for most modern drives, the number of sectors per track (according to drive controller assurances) is 63. The maximum available capacity on computers that do not support the work of the advanced Int 13h mode depends on the actual number of tracks, but not more than 8 GB (for example, if the disk has 16 tracks, then in LARGE, their broadcast may be 16, 32, 48 ... 240, but not 255, because 255 is not a multiple of 16, but the maximum available volume is 1024 * 240 * 63 * 512 / (1024 3 ) = 7.38 GB).
When using LBA or LARGE translation due to rounding to integer values, several sectors at the end of the drive may “fall out” of the described space and become unavailable. However, the losses are usually small.
As for the SCSI-drives, they always work in LBA-broadcast mode. Rather, the SCSI controller represents the drive's geometry in accordance with the requirements of the LBA broadcast, and when accessing the disk itself, it passes the absolute sector address to it. Naturally, it is the BIOS of the SCSI controller that is responsible for performing the necessary recalculations.
Let's go back to the MBR. As already mentioned, it contains 4 blocks of data about the elements of the partition table. This means that the maximum number of partitions that can be described in the MBR is four. However, this does not mean that the maximum number of partitions into which the drive can be divided is four. To overcome this barrier, a special type of partition with the code 05h was introduced - Extended Partition.
The extended partition is very different from all other partition types. First, it describes not the partition, but the region of the storage space in which other sections are located. At the same time, the number of sections in it is theoretically unlimited. True, those sections that are located in this area are somewhat “limited in rights”, the most significant limitation is that they cannot be active (or rather, it can be done so that the OS will be loaded from such a partition, but the staff resources of most existing The OS does not allow this, you have to use special tools). Secondly, the MBR should contain only one entry on the extended partition. Rather, they can be done more (at least all four), but how will the OS behave, having met this, it is difficult to predict. For example, MS-DOS 6.20 simply ignores all extended partitions, except the first one in the list, as if there were none at all. Thirdly, unlike other types of sections in the sector that is registered in the structure as the sector of the beginning of the section, it is not BR. There is actually another MBR that has a signature and a partition table, but usually does not contain any program code (usually the sector containing the partition table, but not containing the boot code, is called the Abstract MBR). However, since there are no active partitions, then the code is useless. In the partition table of such a sector there is usually one or two entries. The first describes the usual partition (Partition), and this section must be completely inside the space of Extended Partition. If a regular partition does not occupy the entire space, a second element appears in the partition table, which describes the remaining space as an Extended Partition. In the next sector, one section is also described in the same way, and, if space remains, an Extended Partition entry is also recorded. And so it goes on until the space ends. In fact, all of the extended partition entries are an Extended Partition Chain, in which pieces of ordinary partitions are pinned from the disk space until the space runs out. An error in any element of this chain will lead to its disintegration, as a result all the records after the break will not be found by the OS, and the space occupied by the OS will be considered empty.
When filling the chain, the OS usually follows several rules. First, the usual section described in the next “link” of the chain should not be located in the middle, because then to describe the resulting two pieces of unallocated space, you need to enter two entries in the PT of this element about two different extended partitions, and, as I said earlier, the OS ignore all such records except the first, and as a result, part of the disk space will fall out of the split. Secondly, as a rule, a record of a regular partition is made so that it occupies the initial area of ​​the extended partition, and the next element of the partition chain is the remainder.
What problems may arise with the contents of the MBR? Firstly, physical or logical destruction, i.e. damage to the surface or other mechanical problem or destruction of the servo tag, which makes it impossible to read this sector from the disk. However, such cases are beyond the scope of our consideration. And the second most frequently encountered problem is the destruction of all or part of the information contained in the sector, as a result of which partitions either cannot be found by the operating system, or their parameters are not correctly determined.
The easiest case is signature destruction. At the same time, the OS believes that the sector contains some random information, “garbage”, and the drive itself is not divided into sections at all and there is no information on it. To restore it is enough just to restore the signature by any means of direct access to disk sectors (the most popular is DISKEDIT from the NORTON UTILITIES package). Most of the operating systems, however, need to be rebooted, since the operating system usually reads the partitioning information on the disk at the start and does not take its changes into account later in the process.
A more complicated case is the destruction of the code. At the same time, the ability to boot the operating system from the drive is lost, and the download attempt usually ends with the computer hanging. At the same time, if you boot from another drive (another hard disk, floppy disk, bootable CD-ROM, etc.), all information on the drive is available for use. In this case, it is recommended to use the regular boot code recovery tools that are available in each OS. For example, in Windows 9x, the FDISK.EXE program is used for this purpose, launched with the / MBR key.
Code destruction is not as rare a case as it may seem. As a rule, such a nuisance occurs when different OSs are sequentially installed on the same drive in one or different partitions. When installing, any OS wants to have its own code in the MBR, but not everyone cares about maintaining the code that was previously in the sector. For example, Windows 9x rewrites the loader code without notifying the user and permanently destroying old content. However, such a case is just not very scary, since all the OS loaders are very similar. The problem arises if third-party software was used to partition the drive into sections, such as EZ-drive, ODM or, for example, SpeedStore, for which the concepts of MBR and MBS are not equivalent. Due to a different boot ideology (which we will discuss later), the code located in MBS performs a different function, namely, searching and loading a part of the MBR code located in other sectors of the disk. Replacing the code leads to the fact that this function is lost, and, accordingly, various problems arise. The user should be very careful if using such software tools - the restoration of the code in such cases can be very difficult.
And the most difficult and unpleasant case is the destruction of the partition table itself. However, as you know, trouble never comes alone, and most often all three components of the MBR are destroyed, but it is precisely the destruction of PT that leads to the most serious consequences, since this makes it impossible to access information stored on the drive. PT can be destroyed completely, and maybe partially - i.e. part of the elements is destroyed, and the rest are intact. There are cases when the PT located in the MBR is intact and the record of partitions in one of the links of the Extended Partition chain is destroyed. However, since the MBR structure and the structure are absolutely identical (except for the fact that there is no code in the Extended Partition elements), the recovery technique is the same in both cases.
There are a sufficient number of programs that can recover destroyed PT. The quality of their work is different and depends mainly on how difficult it was to partition the disk, whether all types of partitions that were on the disk are known to the program and if there is no other damage to PT in other sectors, especially in BR partitions. However, we are not looking for easy ways, and if your boss doesn’t hang over your head shouting, “rather, faster, jumps, print me a form, I’m late on vacation!”, You will get much more pleasure if you’re on your own, without any automatic programs, using only your knowledge, you can recover all the information. You can even just do all the necessary research, get all the numbers that need to be written to PT, and then start the recovery program and after it work make sure that everything is calculated correctly. Or maybe even correct the results of her work, if she did not work at 100%.
So, for work we need: a boot diskette with any DOS, to which the file DISKEDIT.EXE is copied, a pencil, paper, a calculator (however, the calculator is in DISKEDIT) and some brains. It is desirable, of course, that both DOS and DISKEDIT are fresher. I use DOS 7.10 from Windows 98 SE and DISKEDIT from the NORTON UTILITIES 2002 package. We do not need any drivers at this stage, well, except when the drive is connected to the old SCSI controller and without loading the driver is simply not visible. You can load the mouse driver - it will be a little more convenient. Now the main trifle - in addition to the specified files on the diskette there should be nothing! This is important - if there is no configuration file on the diskette, DISKEDIT.EXE will start in Read-Only mode and no data on the disk will be changed until we explicitly ask for it. A floppy disk in general would be writeable.
Boot from floppy. Run DISKEDIT.EXE. After loading, press the Alt-D keys (or via the Object - Drive menu). A window with available disk devices is displayed. First, we point out that we need physical devices (Physical disks), and then we select the desired disk (for example, Hard Disk 1) and click OK. In this case, all disk sectors from the first to the last will be selected as the viewing range. This is what we need.
First, we will ask the program to scan the disk and find all sectors that may be elements of the Extended Partition or BR chain. And although at the same time DISKEDIT will simply look for sectors that have a signature, and not analyze the content (which we undertake), the results can greatly facilitate the work. The truth will have to be patient - the process is not fast, and besides, every sector found will need to be taken on a pencil, but the game is worth the candle.
So, Tools - Find Object - Partition / Boot. Go. Every time a sector with a signature is encountered, the search is stopped, a sector dump is displayed on the screen, and in the lower right corner is the sector number. It is these addresses and need to take a pencil. However, if the partitioning of a disk into sections did not use particularly sophisticated methods, all sectors of interest to us will be located on the zero or first side in the first sector, i.e. Side 0 or 1, Sector 1. The remaining sectors, for example, some Cyl 12, Side 4, Sector 52, can be safely ignored - this is an accident. True, we get the absolute number of the sector, but this is not terrible, for the "correct" sectors, the number will be completely divided by the number of sectors per track, usually 63 (other values ​​are now much less common - 17, 26, 40, 56, therefore hereinafter wherever I will talk about the number of sectors 63, keep in mind that you may have to use a different number on your particular drive). And we can look at this figure through the menu (Info - Drive Info). Unfortunately, the number of sides and cylinders there may turn out to be wrong (not corresponding to the broadcast used), but this is not a big deal either. Writing the number of the next sector, we continue the search (you can use the Tools - Find Again menu, you can just Ctrl-G). And so until we get the message that the object was not found. At this moment we have (or rather, on paper) all the numbers of sectors in which there is a signature.
Теперь обрабатываем список, отсеивая явно случайные номера (это которые не делятся на 63), и особо выделяя пары номеров, которые различаются на 63. Эти пары - не что иное как пара из элемента Extended Partition и BR описанного в нём раздела.
Теперь отложим на минутку листок с цифрами и попытаемся вспомнить, какого размера разделы были на диске. Так, крупными мазками, 600 мегабайт, 12 гигабайт… запишем всё что помним. Если сумма не равна объёму накопителя - либо что-то забылось, либо неверно вспомнилось, либо было пространство, не принадлежавшее ни одному разделу (а что, бывает… знаю не один случай, когда десятигигабайтный жёсткий диск разбивался на компьютере, материнская плата которого не понимала более восьми гигабайт, а при апгрейде это как-то не вспомнилось… вот так 2 гигабайта и зависли). На этом этапе желательно вспомнить ещё и типы файловых систем в каждом из разделов.
Теперь возьмём оба листка и попытаемся совместить полученные данные. Мегабайт - две тысячи секторов, гигабайт - два миллиона… приблизительно. Но обычно удаётся совершенно однозначно наложить одно на другое. Полезно бывает нарисовать длинный прямоугольник, расставить на нём границы, соответствующие найденным секторам, и поделить на кусочки, соответствующие размерам разделов. Даже если однозначности нет - не беда. Разберёмся. При совмещении данных рекомендую помнить, что некоторые BR и элементы цепи Extended Partition могут быть разрушены (и соответственно не будут найдены), причём наиболее часто разрушаются BR первого (по положению на накопителе) раздела и BR активного раздела.
Впрочем, на данном этапе, пожалуй, всё… и не потому, что дальше некуда, а по другой причине - для дальнейшей работы по восстановлению требуется анализ других структур, которые располагаются уже в "найденных" разделах - это BR, FAT/MFT, каталоги и пр… мы их пока не рассматривали. Впрочем, иногда и найденной и вспомненной информации достаточно. В конце статьи приведен пример такого восстановления (пока не написан).
Иногда знание структуры разделов применяют совершенно для других целей - например, для создания своего собственного разбиения диска на разделы. Пример такого применения также есть в конце статьи.
При создании нестандартного разбиения диска на разделы, кроме требований, описанных ранее (один расширенный раздел и пр.), рекомендую также учитывать то, в каком порядке ОС MS-DOS и Windows назначают разделам буквы логических дисков ( Q51978 - Order in Which MS-DOS and Windows Assign Drive Letters ). Буквы присваиваются, начиная с C: (A: и B: зарезервированы для дисководов гибких дисков, возможно виртуальных). Порядок подключения таков:
  1. Раздел, с которого загружается ОС (при загрузке с жёсткого диска).
  2. Первые первичные разделы остальных жёстких дисков в порядке их нумерования (инициализации) BIOS компьютера.
  3. Разделы в Extended Partition жёстких дисков в порядке их нумерования (инициализации) BIOS компьютера, в порядке их записи в Partition Table дисков.
  4. Остальные первичные разделы дисков, в порядке их записи в Partition Table по порядку их нумерования (инициализации) BIOS компьютера.
  5. Устройства, формируемые драйверами, запускаемыми в файлах config.sys и autoexec.bat, в порядке их формирования и инициализации, если формируемому устройству не назначается в явной форме определённая буква или диапазон букв.
  6. Для ОС, которые могут опознавать и подключать накопители, не инициализируемые BIOS компьютера (не описанные в установках CMOS накопители) - разделы этих накопителей в соответствии с правилами 3 и 4 в порядке инициализации накопителей операционной системой.
Разделы не известных ОС типов не инициализируются и буквы им не присваиваются.
Следует помнить, что ОС семейства Windows NT имеют штатные средства переопределения букв логических дисков.

Пример 1. Ручное разбиение на разделы.

  • Параметры накопителя в LBA-трансляции (взяты из BIOS - Autodetect Hard Disk) - Cylinders 1216, Heads 255, Sectors 63, Capacity 10 Gb.
  • Желаемое разбиение: система 2 Гбайт, данные - 2 Гбайт, игры и дистрибутивы - остальное. Желательно разместить системный раздел в конце диска (по тестам там самая быстрая область), игры - в начале диска (по заверениям специалистов, наиболее часто данные повреждаются именно там).
  • Операционная система - Windows 98 SE rus, все разделы - FAT-32.
Исходя из желаемого разбиения, видится следующая схема: сначала расширенный раздел с двумя логическими дисками в нём - 6 и 2 Гбайт, потом первичный активный раздел 2 Гбайт, либо 3 первичных раздела в указанном порядке и с указанными размерами. Последний вариант нам не подходит (неважно по каким соображениям). Особенности работы программы FDISK выбранной ОС не позволяют выполнить разбиение штатно: если сначала мы создадим первичный раздел, он будет находиться в начале накопителя, если же мы сначала создадим расширенный раздел, то программа отказывается создавать первичный.
Принимаем решение провести разбиение с помощью FDISK насколько возможно, а затем доделать вручную. Первый этап: создать расширенный раздел с двумя дисками; второй: вручную добавить запись о первичном разделе.
Первый этап проблем не вызывает: загружаемся с дискеты, создаём extended partition размером 8 Гбайт, и в ней два логических диска - 6 Гбайт и 2 Гбайт. Перезагружаемся с дискеты, убеждаемся, что на диске появились (но недоступны - ведь мы не форматировали разделы!) диски C: и D:. Форматируем их при помощи стандартного FORMAT и в процессе форматирования убеждаемся, что диск C: имеет размер 6 Гбайт, диск D: - 2 Гбайт. Запускаем DISKEDIT и смотрим содержимое MBR. В нём имеется следующая запись:
 Starting location Ending location Relative Number of
System Boot Side Cylinder Sector Side Cylinder Sector Sectors Sectors
EXTEND No 1 0 1 254 972 63 63 15631182
unused No 0 0 0 0 0 0 0 0
unused No 0 0 0 0 0 0 0 0
unused No 0 0 0 0 0 0 0 0
Нам нужно добавить запись о первичном разделе. Тип (System) будет 0Ch (FAT32x), признак загрузки установлен, начало раздела по адресу 973/0/1, конец раздела по адресу 1215/254/63, относительный сектор начала раздела 15631245 (973*255*63+0*63+1-1), относительный сектор конца раздела 19535039 (1215*255*63+254*63+63-1), количество секторов 3903795 (19535039-15631245+1). Весьма существенная тонкость - если номер цилиндра более 1023, в соответствующее поле вносится значение 1023 - увы, это максимальное значение, которое можно туда записать - а правильное значение ОС рассчитает исходя из заданного количества секторов.
Переводим DISKEDIT в режим Read-Write (Tools-Configuration) и во второй строке вписываем рассчитанные данные. После ввода и проверки всех значений выходим из DISKEDIT клавишей Esc, а на вопрос, что делать с изменениями, отвечаем - записать (write). Перезагружаем компьютер. Убеждаемся, что на диске теперь три раздела - C: - недоступен, D: - 6 Гбайт, E: - 2 Гбайт. Форматируем диск C: с переносом на него системных файлов, в процессе форматирования убеждаемся, что диск C: имеет размер 2 Гбайт. Обновляем код MBR командой FDISK /MBR, вынимаем дискету, перезагружаем компьютер, убеждаемся, что ОС загрузилась, диски C:, D: и E: доступны и имеют размеры 2, 6 и 2 Гбайт. Запускаем NDD и убеждаемся, что ошибок ни в таблице разделов, ни на дисках нет. Разбиение закончено.
Теперь таблица разделов при просмотре через DISKEDIT выглядит так:
 Starting location Ending location Relative Number of
System Boot Side Cylinder Sector Side Cylinder Sector Sectors Sectors
EXTEND No 1 0 1 254 972 63 63 15631182 ; Расширенный раздел
FAT32x Yes 0 973 1 254 1023 63 15631245 3903795 ; Первичный раздел (C :)
unused No 0 0 0 0 0 0 0 0
unused No 0 0 0 0 0 0 0 0
Если поставить курсор на строку с записью о расширенном разделе и нажать Enter, то DISKEDIT автоматически перенесёт просмотр в сектор, на который указывает адрес начала раздела (для первичного раздела это будет BR, для расширенного - элемент цепи разделов). В нашем случае мы увидим такое содержимое элемента цепи разделов:
 Starting location Ending location Relative Number of
System Boot Side Cylinder Sector Side Cylinder Sector Sectors Sectors
FAT32x No 2 0 1 254 728 63 63 11711259 ; Логический раздел (D :)
EXTEND No 0 729 1 254 972 63 11711322 3919923 ; Расширенный раздел
unused No 0 0 0 0 0 0 0 0
unused No 0 0 0 0 0 0 0 0
Продолжим движение по цепи разделов в следующий элемент:
 Starting location Ending location Relative Number of
System Boot Side Cylinder Sector Side Cylinder Sector Sectors Sectors
FAT32x No 1 729 1 254 972 63 63 3919860 ; Логический раздел (E :)
unused No 0 0 0 0 0 0 0 0
unused No 0 0 0 0 0 0 0 0
unused No 0 0 0 0 0 0 0 0
Очередной элемент цепи не содержит записи о расширенном разделе. Цепь закончилась.