This page has been robot translated, sorry for typos if any. Original content here.

Home Boot Record - Master Boot Record (MBR)

First, let's define the terminology. Under the words in the title of the article, two different things are often understood, which in some cases may be equivalent, and in some cases not. The first concept is actually Master Boot Record. This entry (program code and data), which is loaded into memory from the hard drive and provides identification of logical partitions on it, detects the active partition and downloads a boot record (Boot Record - BR) from it, which will continue the launch of the operating system (OS). And the second concept is the Boot Sector, the Master Boot Sector (MBS) is the sector located on the 0 cylinder, the plane (head) 0 and having the number 1. In most cases, the MBS contains all the necessary code and all the data, so its contents are the MBR , but there are cases (which we will consider at the end of the article) when the code and data do not fit in one sector (simply not enough space or for security reasons), and then the code of this sector ensures that other sectors are loaded into memory. In this case, the MBR is a collection of all sectors that must be loaded, and MBS is just the first sector.
However, we will begin with the case where MBR and MBS are the same, and we will call them more familiar and widely used term MBR. Slightly digressing from the topic, I note that such an MBR (providing the boot of any OS and occupying only MBS) is usually called the term Generic MBR.
In general MBR appeared on hard disks starting with MS DOS version 3.0, in earlier versions the hard disk was formatted as a floppy disk, and in the first sector was located BR. Accordingly, the disk was a single partition and could not be broken into logical parts - it's true, at those sizes of disks that were then released, it was irrelevant.
The sector size on the hard disk is 512 bytes. This space is quite enough to accommodate everything you need - both code and data. However, only one structure should be present there - it is a signature. This word is a special, strictly established, sequence of 2 bytes with hexadecimal values ​​of 55h AAh, which is written to the last 2 bytes of the sector and accordingly has an offset from the beginning of the sector 1FEh. If at least one of the last two bytes differs in value, it is considered that the first sector is not an MBR and does not contain meaningful information. If the computer at the start, after reading the first sector, does not find the correct signature, it will not transfer the control of the code located there, even if it is correct, but will report that the master boot record was not found. Or will try to find it on other devices - for example, on a floppy disk. Slightly deviating from the topic, I note that the BR also contains a signature 55h AAh in the last two bytes.
Well, if we started with the tail, then we'll go from it to the beginning of the sector. Before the signature, close to it, there are 4 data blocks of 16 bytes each (respectively with a shift from the beginning of the sector 1BEh, 1CEh, 1DEh, 1EEh). The totality of these blocks is called the Partition Table (PT), and each individual entry is called a Partition Table Entry (Partition Table Entry) or simply a Partition. These 16 bytes are enough to indicate all the necessary characteristics of the partition, namely: partition type, partition activity flag, start and end partition sectors in the format Cylinder (path) - Cylinder (Head - Sector, CHS) , the relative number of the first sector (relative to MBR) and the number of sectors in the section.
The rest of the sector space is occupied by the program code, which provides PT parsing, searching for the active partition, loading BR in this section and transferring it to the control. As it is easy to calculate, the code remains 512 - 4 * 16 - 2 = 446 bytes. This space is abundant enough to carry out these actions.
So, the general structure of the MBR can be represented by the following table:
  Offset Length Description
 000h 446 Loader Code
 1BEh 64 Partition table
  16 Section 1
 1CEh 16 Section 2
 1DEh 16 Section 3
 1EEh 16 Section 4
 1FEh 2 Signature (55h AAh)
Each 16-byte block describing one partition has the following structure:
  Offset Length Description
 00h 1 Symptom of partition activity
 01h 1 Start of section - head
 02h 1 The beginning of the section is sector (bits 0-5), the track (bits 6,7)
 03h 1 Beginning of the section is the track (the highest bits of 8.9 are stored in the byte of the sector number)
 04h 1 Partition type code
 05h 1 End of section - head
 06h 1 End of section - sector (bits 0-5), track (bits 6,7)
 07h 1 End of the section - the track (the high-order bits 8.9 are stored in the byte of the sector number)
 08h 4 Displacement of the first sector
 0Ch 4 Number of sectors of the partition
The partition type code is a single-byte identifier. If its value is 00h, it is considered that this PT element does not contain partition information, and its contents are ignored. Any non-zero value means that there is a section of a certain type in the specified space. Some values ​​uniquely indicate the type of partition, some correspond to several possible types, and the definition of a specific type is assigned to the operating system, the others are reserved for future use. A relatively complete and up-to-date guide to partition type codes can be found in the Ralf Brown Interrupt List in the INTERRUPT.D file, table 00652, which is contained in the archive (at the time of this writing) inter61a.zip at http://www.pobox.com/ ~ ralf / files.html . Here I will give a table of those types of partitions that are created by the operating systems Windows 9x and Windows NT / 2000 / XP:
  Code Partition Type
 01h 12-bit FAT
 04h 16-bit FAT up to 32 MB
 05h Advanced section
 06h 16-bit FAT over 32 MB
 07h Windows NT NTFS (and some others - the type is determined by BR content)
 0Bh 32-bit FAT
 0Ch 32-bit FAT with INT13 advanced management
 0Eh LBA VFAT (same as 06h, using advanced INT13 control)
 0Fh LBA VFAT (same as 05h, using advanced INT13 control)
 17h Hidden NTFS partition
 1Bh A hidden section of the 32-bit FAT (the same as 0Bh)
 1Ch A hidden section of the 32-bit FAT using the INT13 advanced control (the same as 0Ch)
 1Eh Hidden partition LBA VFAT (same as 06h, using advanced INT13 control)
 86h Section FAT-16 stripe-array Windows NT
 87h NTFS partition stripe-array Windows NT
 B6h Mirrored master partition FAT-16 Windows NT
 B7h Mirrored master partition NTFS Windows NT
 C6h Mirrored slave partition FAT-16 Windows NT
 C7h Mirrored slave partition NTFS Windows NT
A sign of the activity of the section - i.e. a sign that the operating system should be downloaded from this section - it can have the values ​​80h (partition active) and 00h (partition is not active). In general, the number of active partitions should be no more than 1 (otherwise how to make a choice?). If there are no active partitions, then the OS can not be loaded from this hard disk. Other values ​​are considered erroneous and ignored. However, the decision to transfer the control takes the loader code, so the value of the byte of the boot attribute is only an axiom for standard loaders.
The three-byte address block of the start address and the end-of-section address have the same format. Here, in fact, packing values ​​is used so that they have a minimum volume. The format of the package completely corresponds to how these data are transferred to the procedures for working with the hard disk (Int 13h), which is located in the computer's BIOS, and therefore the overhead computational costs are minimal. In this case, the cylinders and tracks are numbered starting from zero value, and sectors - for some reason from the first. I do not know why - it happened historically.
The sector pointed to by the address of the beginning of the section contains a special record called the boot record (BR). Its purpose and composition will be considered in a separate article.
The offset of the first sector of the partition is actually the number of this sector if all sectors of the hard disk are renumbered starting from 0 (according to the numbering used by Int 25h / 26h) in ascending order first in sectors of one track, then in order of increasing the number of heads and, cylinders. And what is the number of sectors in the section - it is understandable without explanation.
Naturally, all these values ​​are connected by simple dependencies, because the information contained in them is redundant. Therefore, I will give the formulas for the relationship between them.
So, if we denote:
C M is the cylinder on which the MBR is located;
H M is the track on which the MBR is located;
S M is the sector in which the MBR is located;
C S , H S , S S , C E , H E , S E are the same for the sectors of the beginning (S) and the end (E) of the section;
H H - number of tracks on the hard disk;
S H - the number of sectors on one track on the hard disk,
then:
The absolute number of the sector in which PT is located:
Num PT = C M * H H * S H + H M * S H + S M -1
Absolute sector number of the beginning of the section:
Num S = C S * H H * S H + H S * S H + S S -1
Absolute sector number of the end of the section:
Num E = C E * H H * E H + H E * E H + E E -1
Displacement of the first sector of the section:
Offset S = Num S - Num PT
Number of sectors:
Amount = Num E - Num S +1
From the above formulas, in addition, it is clear that the important thing is how many tracks have one cylinder of a hard disk and how many on each track of sectors. These values ​​depend on both the geometry of the hard disk and the selected translation mode in the BIOS settings. Therefore, a disk partitioned in a single translation mode can be unreadable when the translation mode changes.
For IDE-drives there are several modes of translation:
CHS (Cylinder-Head-Sector) - while the geometry of the disk is the same as it tells it to the computer. Do not flatter yourself - most drives do not have the real geometry. However, the controller that is part of the hard drive, produces the necessary transformations on its own, and the way it does it is not important for us. The maximum number of cylinders is 1024 (from 0 to 1023), tracks are 16 (from 0 to 15), sectors are 63 (from 1 to 63), and the maximum disk capacity available in this broadcast without using special programs is 504 MB . In disk operations, the sector address is transferred to the computer's BIOS by the hard disk controller without changing it.
LBA (Logical Block Addressing) - this translation mode uses not the geometry of the disk, which it tells the BIOS of the computer. The reduction is made to the format when the number of cylinders does not exceed 1024, and the number of sectors per track is 63. The number of tracks depends on the BIOS of the computer and the volume of the hard disk and can be 16, 64, 128 or 255, the latest BIOS versions as a rule Use the reduction to 255 (0-254) tracks regardless of the volume of the drive. When accessing the disk, the number of the cylinder, heads and sectors transferred in the LBA translation are recalculated to the absolute sector number, and it is transferred to the computer's BIOS by the hard disk controller to perform the operation. With a drive capacity of more than 8 GB, the number of cylinders is more than 1024, therefore, on computers that do not support the Int 13h advanced mode, without the installation of special software, space beyond 8 GB is not available (regardless of the broadcast mode). Sometimes, however, helps update the BIOS of the computer.
LARGE, or ECHS (Extended CHS) - in this translation mode, the number of cylinders is reduced to less than 1024 due to a multiple increase in the number of tracks. The given number of tracks is strictly a multiple of the actual number of sectors per track does not change. However, in most modern drives the number of sectors per track (according to the controller of the drive) is 63. The maximum available volume on computers that do not support the Int 13h advanced mode depends on the actual number of tracks, but not more than 8 GB (for example, if the disk has 16 tracks, then in the LARGE translation they can be 16, 32, 48 ... 240, but not 255, because 255 is not a multiple of 16, and the maximum available volume is 1024 * 240 * 63 * 512 / (1024 3 ) = 7.38 GB).
When using LBA or LARGE translation due to rounding up to integer values, several sectors at the end of the drive can "fall out" from the described space and become inaccessible. However, the losses are usually small.
As for SCSI-drives, they always work in the mode of LBA-translation. Rather, the SCSI controller represents the geometry of the drive in accordance with the requirements of the LBA translation, and, when accessing the disk, transfers the absolute address of the sector to it. Naturally, it is the BIOS of the SCSI controller that is responsible for performing the necessary conversions.
Let's return to the MBR. As already mentioned, it contains 4 data blocks about the elements of the partition table. This means that the maximum number of partitions that can be described in the MBR is four. However, this does not mean that the maximum number of partitions on which the drive can be divided is four. To overcome this barrier, a special type of section with code 05h - an extended partition (Extended Partition) was introduced.
The extended partition is very different from all other partition types. First, it describes not the partition, but the storage space region in which the other partitions are located. The number of sections in it is theoretically unlimited. True, those sections that are located in this area are somewhat "limited in rights", the most significant limitation is that they can not be active (or rather, it can be done from such a section of the OS will be loaded, but the staffing of most existing OS does not allow this, you will have to use special tools). Secondly, only one record of the extended partition should be present in the MBR. Rather, they can be done and more (though all four), but how will the OS behave, having met such, it is difficult to predict. For example, MS-DOS 6.20 simply ignores all the extended partitions, except the first one in the list, as if they do not exist at all. Third, unlike the other types of sections in the sector that is registered in the structure as the sector of the beginning of the section, there is by no means a BR. There is actually another MBR that has a signature and partition table, but usually does not contain any program code (usually the sector containing the partition table, but not containing the boot code, is called Abstract MBR). However, since there are no active partitions, then the code is of no use. In the partition table of such a sector, there is usually one or two entries. The first describes a regular partition (Partition), and this partition should be completely inside the Extended Partition space. If a regular partition does not occupy the entire space, a second entry appears in the partition table, which describes the remaining space as Extended Partition. In the next sector, one section is also described exactly and, if the space is left, another record of the Extended Partition. And this continues until the space is over. In fact, all the records for the extended partitions are an Extended Partition Chain in which pieces of the disk space are plucked into regular partitions until the space is exhausted. An error in any element of this chain will lead to its spillage, as a result, all records after the break will not be found by the OS, and the OS space they occupy will be considered unoccupied.
When filling a chain, the OS generally follows several rules. Firstly, the normal partition described in the next "link" of the circuit should not be located in the middle, since then to describe the resulting two pieces of unoccupied space, it will be necessary to enter two entries in the PT of this element about two different extended sections of a, as I said earlier, ignore all such records except the first, and as a result, part of the disk space will fall out of the partition. Secondly, as a rule, a record about a normal partition is made so that it occupies the initial area of ​​the extended partition, and the next element of the partition chain is the remainder.
What problems can arise with the contents of the MBR? First, physical or logical destruction, i.e. damage to the surface or other mechanical problem or the destruction of the servo, which prevents the sector from reading the disk. However, such cases go beyond our consideration. And the second most common problem is the destruction of all or part of the information contained in the sector, as a result of which the partitions either can not be found by the operating system or their parameters are determined incorrectly.
The easiest case is the destruction of the signature. In this case, the OS believes that the sector contains some random information, "garbage", and the drive itself is not divided into sections and there is no information on it. For recovery, it is enough only by any means of direct access to disk sectors (DISKEDIT from NORTON UTILITIES package is most popular) to restore the signature. Most of the OS, however, needs to be rebooted, since the OS as a rule at startup reads information about partitioning the disk into partitions and then does not take into account its changes in the process of work.
A more complicated case is the destruction of the code. At the same time, the ability to boot the operating system from the drive is lost, and the boot attempt usually ends with the computer "hanging up". At the same time, if you boot from another drive (another hard disk, floppy disk, boot CD-ROM, etc.), then all the information on the drive is available for use. In this case, it is recommended to use the native bootstrap code recovery tools that are available in each OS. For example, in Windows 9x for this purpose, the program FDISK.EXE, which is started with the / MBR key, is used.
The destruction of code is not so rare a case as it may seem. Typically, such a nuisance occurs when one drive is consistently installed different OS into one or different partitions. Any OS at installation wishes to have own code in MBR, but far not all care of preservation of that code which was in sector earlier. For example, Windows 9x rewrites the bootloader code without informing the user and irretrievably destroying the old content. However, this case is not very scary, because all OS loaders are very similar. The problem occurs when third-party software tools such as EZ-drive, ODM or SpeedStore are used for partitioning a drive, for which MBR and MBS concepts are not equivalent. Due to another load ideology (which we will consider later), the code in MBS performs another function, namely, searching and loading a piece of MBR code located in other sectors of the disk. Replacement of the code leads to the fact that this function is lost, and accordingly there are problems of a different nature. The user should be very careful if using such software tools - restoring the code in such cases can be very difficult.
And the most difficult and unpleasant case is the destruction of the partition table itself. However, as you know, the trouble never comes alone, and most often all three components of the MBR are destroyed, but it is the destruction of PT that leads to the most severe consequences, as it does not allow access to the information stored on the drive. PT can be destroyed completely, and maybe partially - i.e. some of the elements are destroyed, and the rest are intact. There are times when the PT in the MBR is intact, and the partition record in one of the links in the Extended Partition chain is destroyed. However, since the structure of the MBR and the structure are absolutely identical (except that there is no code in the Extended Partition elements), the recovery technique is the same in both cases.
There are enough programs that can repair destroyed PTs. The quality of their work is different and depends mainly on how difficult it was to partition the disk, whether the types of partitions that were on the disk are known to the program and whether there are any other data corruption in other sectors, especially in the BR partitions, besides the destruction of PT. However, we are not looking for easy ways, and if you do not have a boss hanging over your head, "print out my form faster, jump, I'm late for vacation!", You will get much more pleasure if you yourself, without any automatic programs, using only their knowledge, will be able to restore all information. You can even just do all the necessary research, get all the numbers that you need to write in PT, and then run the recovery program and after its work make sure that everything is calculated correctly. Or maybe even correct the results of her work, if she did not work 100%.
So, for work we need: boot floppy with any DOS, which copied the file DISKEDIT.EXE, pencil, paper, calculator (however, the calculator is in DISKEDIT) and a few brains. It is desirable, of course, that both DOS and DISKEDIT are fresher. I use DOS 7.10 from Windows 98 SE and DISKEDIT from the NORTON UTILITIES 2002 package. No drivers are needed at this stage, except when the drive is connected to an old SCSI controller and without loading the driver is simply not visible. You can download the mouse driver - it will be a little more convenient. Now the main trifle - except for the specified files on the floppy disk there should be nothing! This is important - if there is no configuration file on the diskette, DISKEDIT.EXE will start in read-only mode and no data on the disk will be changed until we explicitly ask for it. A floppy in general would be closed from the record.
Boot from the floppy. Run DISKEDIT.EXE. After loading, press the Alt-D keys (or through the Object-Drive menu). A window appears with the available disk devices. First, we point out that we need physical disks, and then select the correct disk (say Hard Disk 1) and click OK. In this case, all sectors of the disk from the first to the last will be selected as the viewing range. This is what we need.
First we will ask the program to do a disk scan and find all the sectors that can be elements of the Extended Partition or BR chain. And although DISKEDIT will simply look for sectors that have a signature, and not analyze the contents (this we take on ourselves), the results can make the work much easier. The truth will have to be patient - the process is not quick, and besides every sector that you find will need to be taken for a pencil, but the candlelight costs.
So, Tools - Find Object - Partition / Boot. Go. Each time a sector with a signature comes across, the search stops, the sector dump is displayed, and the sector number in the lower right corner. These are the addresses you need to take on a pencil. However, if we did not use particularly sophisticated methods when partitioning a disk, all sectors of interest to us will be located on the zero or first side in the first sector, i.e. Side 0 or 1, Sector 1. Other sectors, such as some Cyl 12, Side 4, Sector 52, can be safely ignored - this is by chance. True, we get the absolute sector number, but it's not terrible, for the "right" sectors the number will be divided by the number of sectors per track, usually 63 (other values ​​are much less common now - 17, 26, 40, 56, so further in the text wherever I will talk about the number of sectors 63, keep in mind that on your particular drive may have to use a different number). And this figure we can look through the menu (Info - Drive Info). Unfortunately, the number of sides and cylinders there may be wrong (not appropriate for the broadcast used), but it's not terrible either. After writing down the number of the next sector, we continue the search (you can use the Tools - Find Again menu, you can just Ctrl-G). And so until we get a message that the object was not found. At this moment, we have on our hands (or rather, on paper) all the sector numbers in which the signature is present.
Теперь обрабатываем список, отсеивая явно случайные номера (это которые не делятся на 63), и особо выделяя пары номеров, которые различаются на 63. Эти пары - не что иное как пара из элемента Extended Partition и BR описанного в нём раздела.
Теперь отложим на минутку листок с цифрами и попытаемся вспомнить, какого размера разделы были на диске. Так, крупными мазками, 600 мегабайт, 12 гигабайт… запишем всё что помним. Если сумма не равна объёму накопителя - либо что-то забылось, либо неверно вспомнилось, либо было пространство, не принадлежавшее ни одному разделу (а что, бывает… знаю не один случай, когда десятигигабайтный жёсткий диск разбивался на компьютере, материнская плата которого не понимала более восьми гигабайт, а при апгрейде это как-то не вспомнилось… вот так 2 гигабайта и зависли). На этом этапе желательно вспомнить ещё и типы файловых систем в каждом из разделов.
Теперь возьмём оба листка и попытаемся совместить полученные данные. Мегабайт - две тысячи секторов, гигабайт - два миллиона… приблизительно. Но обычно удаётся совершенно однозначно наложить одно на другое. Полезно бывает нарисовать длинный прямоугольник, расставить на нём границы, соответствующие найденным секторам, и поделить на кусочки, соответствующие размерам разделов. Даже если однозначности нет - не беда. Разберёмся. При совмещении данных рекомендую помнить, что некоторые BR и элементы цепи Extended Partition могут быть разрушены (и соответственно не будут найдены), причём наиболее часто разрушаются BR первого (по положению на накопителе) раздела и BR активного раздела.
Впрочем, на данном этапе, пожалуй, всё… и не потому, что дальше некуда, а по другой причине - для дальнейшей работы по восстановлению требуется анализ других структур, которые располагаются уже в "найденных" разделах - это BR, FAT/MFT, каталоги и пр… мы их пока не рассматривали. Впрочем, иногда и найденной и вспомненной информации достаточно. В конце статьи приведен пример такого восстановления (пока не написан).
Иногда знание структуры разделов применяют совершенно для других целей - например, для создания своего собственного разбиения диска на разделы. Пример такого применения также есть в конце статьи.
При создании нестандартного разбиения диска на разделы, кроме требований, описанных ранее (один расширенный раздел и пр.), рекомендую также учитывать то, в каком порядке ОС MS-DOS и Windows назначают разделам буквы логических дисков ( Q51978 - Order in Which MS-DOS and Windows Assign Drive Letters ). Буквы присваиваются, начиная с C: (A: и B: зарезервированы для дисководов гибких дисков, возможно виртуальных). Порядок подключения таков:
  1. Раздел, с которого загружается ОС (при загрузке с жёсткого диска).
  2. Первые первичные разделы остальных жёстких дисков в порядке их нумерования (инициализации) BIOS компьютера.
  3. Разделы в Extended Partition жёстких дисков в порядке их нумерования (инициализации) BIOS компьютера, в порядке их записи в Partition Table дисков.
  4. Остальные первичные разделы дисков, в порядке их записи в Partition Table по порядку их нумерования (инициализации) BIOS компьютера.
  5. Устройства, формируемые драйверами, запускаемыми в файлах config.sys и autoexec.bat, в порядке их формирования и инициализации, если формируемому устройству не назначается в явной форме определённая буква или диапазон букв.
  6. Для ОС, которые могут опознавать и подключать накопители, не инициализируемые BIOS компьютера (не описанные в установках CMOS накопители) - разделы этих накопителей в соответствии с правилами 3 и 4 в порядке инициализации накопителей операционной системой.
Разделы не известных ОС типов не инициализируются и буквы им не присваиваются.
Следует помнить, что ОС семейства Windows NT имеют штатные средства переопределения букв логических дисков.

Пример 1. Ручное разбиение на разделы.

  • Параметры накопителя в LBA-трансляции (взяты из BIOS - Autodetect Hard Disk) - Cylinders 1216, Heads 255, Sectors 63, Capacity 10 Gb.
  • Желаемое разбиение: система 2 Гбайт, данные - 2 Гбайт, игры и дистрибутивы - остальное. Желательно разместить системный раздел в конце диска (по тестам там самая быстрая область), игры - в начале диска (по заверениям специалистов, наиболее часто данные повреждаются именно там).
  • Операционная система - Windows 98 SE rus, все разделы - FAT-32.
Исходя из желаемого разбиения, видится следующая схема: сначала расширенный раздел с двумя логическими дисками в нём - 6 и 2 Гбайт, потом первичный активный раздел 2 Гбайт, либо 3 первичных раздела в указанном порядке и с указанными размерами. Последний вариант нам не подходит (неважно по каким соображениям). Особенности работы программы FDISK выбранной ОС не позволяют выполнить разбиение штатно: если сначала мы создадим первичный раздел, он будет находиться в начале накопителя, если же мы сначала создадим расширенный раздел, то программа отказывается создавать первичный.
Принимаем решение провести разбиение с помощью FDISK насколько возможно, а затем доделать вручную. Первый этап: создать расширенный раздел с двумя дисками; второй: вручную добавить запись о первичном разделе.
Первый этап проблем не вызывает: загружаемся с дискеты, создаём extended partition размером 8 Гбайт, и в ней два логических диска - 6 Гбайт и 2 Гбайт. Перезагружаемся с дискеты, убеждаемся, что на диске появились (но недоступны - ведь мы не форматировали разделы!) диски C: и D:. Форматируем их при помощи стандартного FORMAT и в процессе форматирования убеждаемся, что диск C: имеет размер 6 Гбайт, диск D: - 2 Гбайт. Запускаем DISKEDIT и смотрим содержимое MBR. В нём имеется следующая запись:
 Starting location Ending location Relative Number of
System Boot Side Cylinder Sector Side Cylinder Sector Sectors Sectors
EXTEND No 1 0 1 254 972 63 63 15631182
unused No 0 0 0 0 0 0 0 0
unused No 0 0 0 0 0 0 0 0
unused No 0 0 0 0 0 0 0 0
Нам нужно добавить запись о первичном разделе. Тип (System) будет 0Ch (FAT32x), признак загрузки установлен, начало раздела по адресу 973/0/1, конец раздела по адресу 1215/254/63, относительный сектор начала раздела 15631245 (973*255*63+0*63+1-1), относительный сектор конца раздела 19535039 (1215*255*63+254*63+63-1), количество секторов 3903795 (19535039-15631245+1). Весьма существенная тонкость - если номер цилиндра более 1023, в соответствующее поле вносится значение 1023 - увы, это максимальное значение, которое можно туда записать - а правильное значение ОС рассчитает исходя из заданного количества секторов.
Переводим DISKEDIT в режим Read-Write (Tools-Configuration) и во второй строке вписываем рассчитанные данные. После ввода и проверки всех значений выходим из DISKEDIT клавишей Esc, а на вопрос, что делать с изменениями, отвечаем - записать (write). We reboot the computer. Убеждаемся, что на диске теперь три раздела - C: - недоступен, D: - 6 Гбайт, E: - 2 Гбайт. Форматируем диск C: с переносом на него системных файлов, в процессе форматирования убеждаемся, что диск C: имеет размер 2 Гбайт. Обновляем код MBR командой FDISK /MBR, вынимаем дискету, перезагружаем компьютер, убеждаемся, что ОС загрузилась, диски C:, D: и E: доступны и имеют размеры 2, 6 и 2 Гбайт. Запускаем NDD и убеждаемся, что ошибок ни в таблице разделов, ни на дисках нет. Разбиение закончено.
Теперь таблица разделов при просмотре через DISKEDIT выглядит так:
 Starting location Ending location Relative Number of
System Boot Side Cylinder Sector Side Cylinder Sector Sectors Sectors
EXTEND No 1 0 1 254 972 63 63 15631182 ; Расширенный раздел
FAT32x Yes 0 973 1 254 1023 63 15631245 3903795 ; Первичный раздел (C :)
unused No 0 0 0 0 0 0 0 0
unused No 0 0 0 0 0 0 0 0
Если поставить курсор на строку с записью о расширенном разделе и нажать Enter, то DISKEDIT автоматически перенесёт просмотр в сектор, на который указывает адрес начала раздела (для первичного раздела это будет BR, для расширенного - элемент цепи разделов). В нашем случае мы увидим такое содержимое элемента цепи разделов:
 Starting location Ending location Relative Number of
System Boot Side Cylinder Sector Side Cylinder Sector Sectors Sectors
FAT32x No 2 0 1 254 728 63 63 11711259 ; Логический раздел (D :)
EXTEND No 0 729 1 254 972 63 11711322 3919923 ; Расширенный раздел
unused No 0 0 0 0 0 0 0 0
unused No 0 0 0 0 0 0 0 0
Продолжим движение по цепи разделов в следующий элемент:
 Starting location Ending location Relative Number of
System Boot Side Cylinder Sector Side Cylinder Sector Sectors Sectors
FAT32x No 1 729 1 254 972 63 63 3919860 ; Логический раздел (E :)
unused No 0 0 0 0 0 0 0 0
unused No 0 0 0 0 0 0 0 0
unused No 0 0 0 0 0 0 0 0
Очередной элемент цепи не содержит записи о расширенном разделе. Цепь закончилась.