Definition

Master boot record (MBR) is a boot sector typically found in the first sector of a partitioned storage device. It is one of two disk structures used by Windows operating systems (the other structure is known as a GUID partition table or GPT).

Introduction

MBRs are found in the first 512-byte sector of a disk. The MBR contains information on how the logical partitions (and their file systems) are organized on a storage device. It also contains executable code that launches the operating system (known as boot code), and a master partition table.

The following table describes the components of the MBR (offsets are shown from the start of the MBR):

Byte offset	Number of bytes	Description	Value
0	440	Boot code used to launch the operating system
440	4	Drive signature (hexadecimal string)
444	2		00 00
446	64	Master partition table (four 16-byte entries to describe partitions).
510	2	Marker to notate the end of the MBR	55 AA

Partition tables

The MBR partition table is comprised of four 16-byte entries that define the size, type, and location of logical volumes on the disk. Partition tables identify the type and location of partitions on a disk and conform to a standard layout regardless of the operating system. Each 16-byte entry in the MBR partition table includes the following information:

Boot indicator
Starting CHS address
Partition type ID
Endinging CHS address
Starting LBA address
Number of sectors in the partition

The following table further describes the fields in each 16-byte entry in the partition table (offsets are shown from the start of the partition entry, not the start of the MBR):

Byte offset	Number of bytes	Description	Value
0	1	Boot indicator - Indicates whether the volume is the active partition (i.e., bootable). 00 for "do not use for booting" and 80 for "active partition."	00 or 80
Starting CHS address (3 bytes)
1	1	Starting head
2	6 bits	Starting sector - uses bits 0-5. Bits six and seven are used by the starting cylinder field
2	10 bits	Starting cylinder - uses 1 byte in addition to the upper two bits from the starting sector field to make up the cylinder value. The starting cylinder is a 10-bit number, with a maximum value of 1023
4		Partition type (system ID) - defines the volume. In Windows NT, it also indicates that a partition is part of a volume that requires the use of the HKEY_LOCAL_MACHINE\SYSTEM\DISK Registry subkey.
Ending CHS address (3 bytes)
5	1	Ending head
6	6 bits	Ending sector -uses bits 0-5. Bits six and seven are used by the ending cylinder field.
6	10 bits	Ending cylinder - uses 1 byte in addition to the upper two bits from the ending sector field to make up the cylinder value. The ending cylinder is a 10-bit number, with a maximum value of 1023
8	4	Relative sectors (LBA offset to the partition) - The offset from the beginning of the disk to the beginning of the logical volume. Used to locate partitions larger than 8.4 GB.
12	4	Total sectors (length of the partition) - Total number of sectors in the logical volume

Partition type codes

The partition type (i.e., system ID) field identifies the file system used to format the volume. Windows NT uses this field to determine what file system device drivers to load during startup. It also identifies the extended partition, if there is one defined. The following table explains the values that can appear in the system ID field:

Value	File system	Addressing	Description
00	None		No file system or partition defined
01	DOS / FAT12	CHS	Primary partition or logical drive Fewer than 32,680 sectors in the volume (less than 16 MB)
04	DOS 3.0+ / FAT 16	CHS	Primary partition or logical drive 32,680–65,535 sectors (between 16 and 33 MB)
05	Microsoft extended	CHS
06	FAT 16	CHS
07	NTFS / HPFS		New technology file system (NTFS) or logical drive
0B	FAT32	CHS	FAT32 partition or logical drive
0C	FAT32	LBA
0E	FAT16	LBA	32 MB to 2 GB
0F	Microsoft extended	LBA

Examine the MBR

Forensic tools like FTK Imager allow archivists to examine the MBR. The MBR is displayed in the Viewer Pane when the highest level of the evidence item is selected in the Evidence Tree.

Related terms

GUID partition table (GPT)

References

Carrier, Brian. File system forensic analysis. Boston: Pearson Education (2005): 81-101.

Howell, David. Master boot record and partition tables. https://github.com/davidhowell-tx/PS-WindowsForensics/wiki/Master-Boot-Record-and-Partition-Tables.

Microsoft. Master boot record. https://technet.microsoft.com./en-us/library/cc976786.aspx.

NTFS.com. Hard drive partition. partition table. http://www.ntfs.com/partition-table.htm.

Browser not supported