Jump to content

MBR / GPT Drive Dissection


98SE

Recommended Posts


11 hours ago, Tripredacus said:

The default formatting on the forum is messy, you should try using a code box with no syntax highlighting.

Relevant: http://thestarman.pcministry.com/asm/mbr/MSWin41BRinHexEd.htm

Is there a page on all the forum commands / features and how to use them?

How do I get the MSFN links from showing a preview or shorten links to a small clickable object?

Can you create collapsible spoiler windows?

Link to comment
Share on other sites

All the things you can do are in the editor bar above the text entry field. There is not a list of commands. The software supports some of the legacy commands but does not translate them properly, such as using quote or code tags manually can result in deforming your post and even then not being able to edit your own test besides deleting it. So it is recommended that you do all changes within the built in editors. Such as code editor, you can re-enter it by double clicking the object. IT SUCKS but apparently we are just old hats shaking our fists at clouds and not hip with the times.

When you post a link to something that generates a preview, a black bar shows below the text entry field you can click to make the preview go away.

Spoiler seems to only partly work, at least for me. It puts in the HR but doesn't actually hide the content.

Link to comment
Share on other sites

On 26/10/2017 at 1:14 PM, 98SE said:

This 8TB drive was USB externally connected so any MBR won't be visible.  That is the first sector of the external drive so we can assume that's the same region the MBR would have been.  I was giving output of the drive to see if anything unusual about it from a normal drive hooked up via USB.  I probably won't hook this 8TB drive internally since I have vital data on it that can't risk accidental corruption.  I might do a 3TB internal vs external Sector 1 snapshot which might be interesting to see what this adapter does to it if different.

Come on :), think a bit before making these kind of incorrect statements :w00t::ph34r:.

Of course the MBR is perfectly accessible on a USB disk, otherwise you wouldn't be able to access partition(s) on it (or to re-partition it).

A USB disk drive (like any other mass storage device) exposes a \\.\PhysicalDrive object in any NT base system (i.e. what you see in disk management) and of course ALL sectors of a \\.\PhysicalDrive are accessible.

The sector(s) you posted is NOT the first sector of the external disk drive, it is at offset 63, and it is the PBR or VBR.

That you (or the software you are using) are incapable of accessing the MBR of that disk is another thing.

You can get a "better" disk editor (such as the Tiny-Hexer I posted a screenshot of) that will be capable of accessing the \\.\PhysicalDrive just fine (and BTW will default to the "correct" 16 byte view), or get any of the tools suggested by the Starman, such as HxD:

http://thestarman.pcministry.com/asm/mbr/BootToolsRefs.htm

More generally, if you could take some time reading the Starman's page on MBR and PBR/VBR's it would surely increase your understanding of the matter and help you avoid making these erroneus statements.

On 26/10/2017 at 1:14 PM, 98SE said:

Analyze this drive instead.  Same procedure different drive.

WHY? :dubbio:

I mean what particular "news" do  you believe it contains?

It is another bootsector, this time FAT16, invoking as well BOOTMGR, and as well with 63 sectors before, 4192865 sectors in size, 512 bytes/sector i.e. roughly slightly less than 2 Gib, with a cluster size of 64 sectors or 32 Kb, nothing particular about it at first sight.

Analyze it yourself, it would be the perfect complement homework to actually put in practice what you will learn reading the Starman's pages:

http://thestarman.pcministry.com/asm/mbr/index.html

jaclaz

 

Link to comment
Share on other sites

On 27/10/2017 at 12:03 AM, rloew said:

In reference to The Starman link, either Jump format is acceptable. All of the integrity checkers I have seen check for  E8 xx 90  or  E9 xx xx.

Just in case, previous related discussion/findings:

http://www.msfn.org/board/topic/152097-on-superfloppies-and-their-images/?do=findComment&comment=987482

jaclaz

Link to comment
Share on other sites

I never used FreeDOS or IMDISK.

Windows 9x also does the same Integrity checks, as does DOS 7.1. These are the two OSes I am most familiar with.

XP only checks the first byte, but for reasons I don't know, it also allows 0x49.

Link to comment
Share on other sites

1 hour ago, rloew said:

... but for reasons I don't know, it also allows 0x49.

Good to know :)

0x49 should be "dec ecx" quite "strange". :unsure:

 

1 hour ago, rloew said:

I never used FreeDOS or IMDISK.

In this case IMDISK is just some means to mount a volume easily, the mechanism involved and the results of the experiments came/come from the "standard" XP detecting/mounting.

 

@98SE

Just to show off a bit :w00t: find attached the output of the batch you can find here:

http://www.msfn.org/board/topic/152097-on-superfloppies-and-their-images/?do=findComment&comment=1001712

on "your" last posted bootsector (please note that it is designed to work ONLY for FAT12 or 16 bootsectors).

 

jaclaz

viewbs.jpg

viewbs2.jpg

Link to comment
Share on other sites

On 11/3/2017 at 5:09 AM, jaclaz said:

Come on :), think a bit before making these kind of incorrect statements :w00t::ph34r:.

Of course the MBR is perfectly accessible on a USB disk, otherwise you wouldn't be able to access partition(s) on it (or to re-partition it).

A USB disk drive (like any other mass storage device) exposes a \\.\PhysicalDrive object in any NT base system (i.e. what you see in disk management) and of course ALL sectors of a \\.\PhysicalDrive are accessible.

The sector(s) you posted is NOT the first sector of the external disk drive, it is at offset 63, and it is the PBR or VBR.

Calm down my digital mucker friend... Patience... It takes awhile to get all the data collected in my spare time. :realmad::yes::lol:

Got about 3 systems I will have to build after the 3TB testing so I can move stuff onto it and free up some spare boot drives which could allow me to do more testing without shutting down my main system.

Quote

That you (or the software you are using) are incapable of accessing the MBR of that disk is another thing.

You can get a "better" disk editor (such as the Tiny-Hexer I posted a screenshot of) that will be capable of accessing the \\.\PhysicalDrive just fine (and BTW will default to the "correct" 16 byte view), or get any of the tools suggested by the Starman, such as HxD:

First you didn't care when asked the DOS MBR tools to use and now you seem to have an interest...?:huh:

The 16 Byte View was condensed by default probably because the program was expecting a larger video resolution which caused the initial truncation effect.  But since it's just numbers/letters this shouldn't affect you copying it as the data wasn't altered just how it was presented.  There is another output where it spits it all out without any spaces if that interests you more and can be loaded into a MBR analyzer.

I found a DOS method to "properly" and "safely" extract a copy of the MBR a week ago.  I've been busy gathering all the different capacity drives I have and analyzing them to see any differences.  Though the program I used does have a feature to extract the MBR but it has a somewhat hidden way to get it and since you never used my program then you would not have a clue.  I might test your Tiny-Hexer for MBR extracting as well.

Quote

http://thestarman.pcministry.com/asm/mbr/BootToolsRefs.htm

More generally, if you could take some time reading the Starman's page on MBR and PBR/VBR's it would surely increase your understanding of the matter and help you avoid making these erroneus statements.

Although I've seen some better sites relating to the real "StarMan" (1984) and MBR research.  Yours didn't have what I was looking for at first glance and some other MBR sites did but will check it out StarMan again in more detail if necessary to accomplish a future goal.

However I did spot an erroneous statement. :yes:

 

Quote

WHY? :dubbio:

I mean what particular "news" do  you believe it contains?

It is another bootsector, this time FAT16, invoking as well BOOTMGR, and as well with 63 sectors before, 4192865 sectors in size, 512 bytes/sector i.e. roughly slightly less than 2 Gib, with a cluster size of 64 sectors or 32 Kb, nothing particular about it at first sight.

It may not look like much but this is the template that makes DOS -> Windows 10 Bootable off a small partition.  At least you recognized some of the characteristics but I thought you also could gleen the possible OS info.

For your analysis you probably would want to use 2 GiB for 2 GiBiBytes since you like that binary form and 32 KB.  The large B is for Bytes, the small b is for Bits.  32Kb would imply 32 Kilobits not Kilobytes.  So be careful and don't get sloppy there as you've been pretty concise.

http://www.overclockers.com/forums/showthread.php/262320-Dont-get-confused-KB-vs-kb

http://www.wu.ece.ufl.edu/links/dataRate/DataMeasurementChart.html

:thumbup

Edited by 98SE
Link to comment
Share on other sites

I see now, according to you it is the same thing to make a serious conceptual error (such as stating that it is not possible to access the MBR through a USB connection and presenting a PBR or VBR - BTW a NTFS one, 16 sectors long - as if it was a MBR, without understanding what they represent) and a - anyway debatable - case of small/CAPITAL letters typo  in a measurement unit symbol.

Good to know :)

JFYI, and to be as picky as you seemingly are:

The 28-bit "barrier" happens on (2^28-1)*512=137,438,952,960 bytes, i.e. at roughly 137 GB or 137,438,952,960/(1024^3)=128 GiB.

 

Oh, and before I forget:

Quote

It may not look like much but this is the template that makes DOS -> Windows 10 Bootable off a small partition.  At least you recognized some of the characteristics but I thought you also could gleen the possible OS info.

I did state (and it was obvious) that the bootsector invoked BOOTMGR, but of course that could be any Vista or later OS or *any* other file renamed to BOOTMGR.

jaclaz

 

Link to comment
Share on other sites

Quote

JFYI, and to be as picky as you seemingly are:

I'm the picky one?  LOL.  This is the computer standard I grew up with in the USA and especially during the golden age of computers.

Unless in your country they started labeling everything in Kilo Binary Bytes from the start?

Did all your hard drive manufacturer boxes show 120GiB, 100GiB, 80GiB, 60GiB, 40GiB, 20GiB?

or did they show 120GB, 100GB, 80GB, 60GB, 40GB, 20GB like in the USA?

 

8 hours ago, jaclaz said:

The 28-bit "barrier" happens on (2^28-1)*512=137,438,952,960 bytes, i.e. at roughly 137 GB or 137,438,952,960/(1024^3)=128 GiB.

Oh, and before I forget:

I did state (and it was obvious) that the bootsector invoked BOOTMGR, but of course that could be any Vista or later OS or *any* other file renamed to BOOTMGR.

Yes in the USA this is known as the 128 GB / 137.4 GB barrier.  The so called Kilo Binary Bytes naming never took off in the USA that you prefer however this may be different in your country and you are claiming your country always used the KiB, MiB, GiB, TiB unit naming scheme on all their products?

In the USA it is more well known as the 128GB barrier and as far hard drives there is and has never been a 137.4 GB or a 140GB hard drive to fully capitalize on it.  This would have given someone roughly 9GB more of usable space which is about 14% then so quite a boost.

There were only three capacities that came close to this barrier before and after.

120GB, 128GB (usually SSDs) and 160GB.

Now I would never tell someone at the time to get a 160GB drive to max out the so called 137.4GB barrier.  Sticking to 120/128GB was the smarter thing to do.  Stressing the 137.4GB may cause people to take a risk and go for the 160GB drive.  Unless you've ever lost 40GB or more of significant data you probably won't understand my point.

 

8 hours ago, jaclaz said:

I see now, according to you it is the same thing to make a serious conceptual error (such as stating that it is not possible to access the MBR through a USB connection and presenting a PBR or VBR - BTW a NTFS one, 16 sectors long - as if it was a MBR, without understanding what they represent) and a - anyway debatable - case of small/CAPITAL letters typo  in a measurement unit symbol.

Good to know :).

Please stop making wild accusations about what I said.  Just to be clear I never said you couldn't access the MBR off a regular USB device as you know I can make these bootable to 98SE so it's obvious in this case that is false.

I said because this one used a special SATA to USB adapter not a regular SATA to USB adapter and I didn't want to risk damaging 8TB of DATA and I couldn't shut down the machine since I do work on it I would try to find a DOS based MBR program to access it directly connected to the SATA port.  Now maybe this came out to you as a "conclusive" no way to access the MBR via a regular SATA to USB adapter.

 

You do know there is a difference between how the data is interpreted using the special SATA to USA adapter and a regular SATA to USB adapter when it comes to these > 2.2TB drives?

 

The Windows program I had tried to access the MBR which you were not familiar nor did you volunteer any DOS based equivalent MBR extracting programs in a typical jaclaz manner or show any interest I went and tried using a Windows program I found myself that supposedly claimed to be able to do it and as a first attempt at trying to get some data going on the topic even though there was never any indication my data gathering was fully done and even I would call it still not "complete".

My preliminary work since it is a work in progress and thus the Partition Boot Record or Volume Boot Record was only accessible at the time by default in the way the program was set up for examining the first sector and you neglected to understand the 14 byte width was the default setup on my system so using a new program I cannot predict how the information would be extracted in the same manner instead of the standard 16 byte width.  Since there were several options to extract all code and pop it out without any spaces or try to retain the structure of it with the addresses which I felt would be more digestible for people.  So it's obvious someone who has done it before would have recognized what they were seeing which is the goal.  So any incorrect information could be correctly updated.

 

Now unlike you the only time I really examined the MBR was on the early 8088 way before your first 486 machine that you used.

I mainly studied copy protected NON-DOS bootable floppy disks probably something you weren't interested in because I got a ton of these unique MBR snowflakes.  Hard disk MBRs didn't interest me at all and this was during the MFM days of FAT not NTFS.

Also I didn't see any need to waste time looking at the MBR of my hard drive then.  All you had pretty much to use was IBM PC-DOS and MS-DOS.  There was not a multiple OS installation then and DOS was all most people used.  Now I could go on about the other NON IBM based computers I have but that probably doesn't interest you.  But if it does which ones do you have?

In general no one needs to waste time examining regular MBRs to get their systems running.  No problem getting DOS->W10 working on all my systems and no need to study the MBR in detail.  As long as you can image your boot partition to recover it when something goes awry that's all the necessary info you need.

It's like someone who drives a car and knows what tires to buy.  Studying the MBR would be someone who cares about looking at the tire treads for what kind of wear it accumulated over time.  No one cares.  They just care their tires are fine and the car drives and continue with their life.

In your case since you tend to dabble more on the Linux side this became more of a necessity which is the mother of invention.  However on my side it doesn't add to the experience since Microsoft took care of such headaches quite nicely so no real fiddling is required of the MBR as long as you have the right tools to restore your boot partition or OS image which takes much less time to get back up and running.

I would say your other claim about everyone knowing how to boot a full XP SP3 off USB in SkyLake also is a bit ridiculous.  If 99.99% knew how to do this on their modern system today you'd see a surge of XP OS browser usage maybe close to 25%.

https://www.netmarketshare.com/operating-system-market-share.aspx?qprid=10&qpcustomd=0

You also forget I didn't shift from FAT32 to NTFS till probably late 2012-13 when large HD videos became too burdensome when exceeding over thirty minutes in recording length since the file sizes would run into the 4GB limit quite easily.  Mainly used to store HD videos and not bootable drives.

 

 

There is really only one purpose of this Drive Discussion I opened here and it's to find a way to either replicate the special SATA to USB connector so it uses regular USB power rather than a brick.  If this was a standard regular < 2.2TB drive or a GPT drive there would absolutely be no interest to me to gather the info.  However since this is still in the data gathering phase nothing is set in stone yet so any incorrect data can be fixed if spotted.

Any information gathering I am doing is for the MSFN community not for you alone.  I know you admittedly stated to me that the largest drive you have is only 500GB which seems a bit outdated so you may have a bias towards larger capacity drives of 8TB and up.  You don't specify what computer have so I have guess it's probably a socket 1366 era or at best Ivy Bridge but with 500GB as the largest drive it's questionable.  Now I don't know if you just can't afford larger capacities or simply don't need to upgrade your system as you are not taxing it much with what you use it for.  So if you have no interest in the actual data gathering I'm doing or getting larger capacity drives working in 2K/XP I don't see why you even care about arguing with me here.  But if you do have a positive interest your mannerisms do not invoke it.

 

 

 

Now given IF maybe you do have actual interest and since you seem to think you know it all and are into puzzles and profess to be an expert on things concerning MBR then you should be able to correctly answer these questions without faltering.

 

Setup 1:

Can the 3TB hard drive be accessed and then made bootable to 98SE DOS using this special SATA to USB adapter attached to the USB port (not a regular SATA to USB) adapter during computer BIOS boot up set for USB bootable device priority?

 

Setup 2:

When the 3TB hard drive is directly connected to the SATA controller and under 98SE DOS

using FDISK to partition the Primary Partition as FAT16 2047MB

then an Extended Partition as FAT32 size of 14311 MB

with the Logical drives to fully use up the space made in this Extended Partition as (4GB, 4GB, 4GB, 2GB)

Formatting all 5 Partitions in 98SE DOS and Partition 1 made bootable and active.

Now... using the special SATA to USB adapter (not a regular SATA to USB adapter) to hook up the 3TB hard drive to the USB port.

Under Windows XP's Disk Management the exact total capacity for the drive will be 2794.51GB.

 

You should be able to answer the following.

What will the break down of the partition sizes be shown in XP Disk Management?

In XP can these partitions be accessed correctly as it was created under 98SE DOS?

What will be the size of the "Unallocated" partition space be in XP Disk Management?

 

Link to comment
Share on other sites

What is so "Special" about your SATA to USB Adapter. It sounds like a standard Translating Adapter like the ones I have.

There is no difference in the layout of data because of that translation. Only the size of the chunks (Sectors) is different.

The MBR would still appear first and any PBRs much later. It would not report the PBR at the beginning unless you added a DDO.

My experience is that 4K translated USB Drives are not Bootable. See my Thread on 4Kn Drives for more info.

Link to comment
Share on other sites

@98SE, as much as I hate to get involved in this conversation at all, I couldn't find where you specify exactly what this "special SATA to USB adapter" is, ie exact part number and/or link to where it is described or where you can purchase it.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...