In-depth introduction to the hard disk partition table

In-depth introduction to the hard disk partition table

When people are using computers, sometimes a partition disappears or the hard disk cannot be started due to abnormal operations or virus attacks. The reason is that the hard disk partition table is damaged. The hard disk partition table is a skeleton supporting the normal operation of the hard disk. the operating system divides the hard disk into Several partitions, and then creates a file system in each partition to write data files. this article describes the location, structure, and connection of partition tables. with this knowledge, even if the partition table is damaged, you can manually repair the Partition Table Based on the residual data to repair the partition.

I. location and identification mark of the Partition Table
The partition table is usually located in the 0 head and 1 sector of a cylindrical disk, and the 1st partition tables (that is, the primary Partition Table) are always located in
(0 cylinder, 1 Head, 1 Sector). The remaining Partition Table positions can be derived from the primary Partition Table in sequence. the partition table contains 64 bytes, occupying the [441-509] bytes of the sector in which it is located. to determine whether the table is a partition table, check whether the two adjacent bytes ([510-511]) are "55aa". If yes, the table is a partition table.

Ii. Partition Table Structure
A partition table consists of four items, each of which is 16 bytes. A total of 4 × 16 = 64 bytes. Each item describes the basic information of a partition. The meaning of each byte is as follows:
Partition Table item meaning

Bytes	Description
0	Activeflag. Activity flag. If it is 0x80 h, it indicates that the partition is active. If it is 0x00 h, it indicates that the partition is not active.
1, 2, 3	Start head number of the partition, Fan area number, cylinder number head number -- 1 byte, Fan area number -- 2 Byte Low 6 bit, cylinder number -- 2 byte high 2 bit + 3 byte
4	Partition File System flag: Unused partitions: 0x00 H. Extended partitions: 0x05 h, 0x0fh. Fat16 partition: 0x06 h. FAT32 partition: 0x0bh, 0x1bh, 0x0ch, 0x1ch. NTFS partition: 0x07 h.
5, 6, 7	The ending head number of the partition, Fan area number, and cylinder number.
8, 9, 10, 11	The unit ID of the logical start. The number of slice used before the start of the partition.
12,13, 14,15	The number of slice occupied by the partition.

The partition table item has several bytes, which are described as follows:

1. (254, 3) the byte head number is represented by 8 bits (1) in the range of (0 -- 28-1), that is, (0 head -- head ). The fan area number is represented by 6 Characters lower than (2), and its range is (0 -- 26-1). Because the fan area number starts from 1, therefore, the range is (1 sector-63 sectors ). The cylinder number is expressed by (2) bytes (2 bits + (3) bytes in height, with a total of 10 bits in the range of (0 -- 2 10-1 ), that is, (0 cylinder -- 1023 cylinder ). When the cylinder number exceeds 1023, the 10 digits are still expressed as 1023. (5, 6, 7) bytes are the same as the preceding values.

2. If the byte (8, 9, 10, 11) is the primary partition table, the four bytes indicate the start logical sector number of the partition and the logical 0 sector (0 cylinder, 0 head, 1 slice. If the table is not a primary partition table, the four bytes indicate either the difference between the start logical sector number of the partition and the start logical sector number of the extended partition, or 63. The details are described later.

Note:

1. The bytes on the slice are arranged in the order of the low position on the left and the high position on the right. Therefore, when taking the value, you need to reverse the byte so that the high byte is on the left and the low byte is on the right. This should be noted when reading the start sector code of the logic and the partition size. For example, the starting part of the logic of the first item is (3f 00 00 00). Before conversion to decimal, you must first reverse the byte order, which is (00 00 00 3f) then convert to decimal, that is, 63. similarly, if the partition size is (3f 04 7d 00), the reverse value (00 7d 04 3f) is converted to decimal, that is, 8193087.

2. Conversion between logical fan area numbers and (cylindrical, Head, and sector): Make L = logical fan area number, c = cylindrical, H = head number, S = fan area number. Number of sectors per slice = 63 Number of cores per cylinder = 255 Number of slices per cylinder = number of sectors per slice * Number of cores per cylinder = 63 × 255 = 16065 subscripts of the cylinder number starting from 0. Head number [0 -- 254], Fan area number [1 -- 63]. The subscript of the logical Sector Code also starts from 0. The formula for converting (cylindrical, Head, and sector) to a logical fan area number is: L = c × 16065 + H × 63 + s-1. For example, (1 cylindrical, 1 head, 1 Sector). The logical sector number is: L = 1 × 16065 + 1 × 63 + 1-1 = 16128. The formula for converting the logical sector number to (cylindrical, Head, sector) is: C = L/16065 H = (L % 16065)/63 s = (L % 16065) % 63 + 1 For example, logical Sector Code 16127: C = 16127/16065 = 1 h = (16127% 16065)/63 = 0 s = (16127% 16065) % 63 + 1 = 63 (1 cylinder, 0 head, 63 sectors)

3. There are four items in the Partition Table. Each item represents a partition. Therefore, a partition table can only represent up to four partitions. The four items in the primary partition table are used to indicate information about the primary partition and the extended partition. Because a maximum of one extended partition can exist, a hard disk can have up to four primary partitions, three primary partitions, and one extended partition. The remaining partition tables represent logical partitions. It is necessary to elaborate that the logical zone is located in the extended partition, and there is no limit on the number of logical partitions.

4. The partition table is usually located in the sector (0 head, 1 sector), and the START sector of the partition is usually located in (1 Head, 1 sector), with 63 hidden sectors separated.

3. Partition Table chain search
The partitioned table chain is actually equivalent to a one-way linked list structure. The first partition table, that is, the primary Partition Table, can have a description of extended partitions. This item is equivalent to a pointer pointing to the extended partition. Then, based on the pointer, we can expand the first shard and the first shard of the Shard to find the second shard table. For this partition table, the first item describes the information of the first partition in the extended partition, and the second item describes the next partition, the second item is equivalent to the pointer pointing to the second partition. The third and fourth items are generally 0. Based on this pointer, we can find the third partition table in the extended partition, starting from the first sector of the first cylindrical column. And so on, only to the last partition table. In the last partition table, only the first item has information, and the remaining three items are 0. It is equivalent to its NULL pointer. Therefore, if a partition table is found, all the partition tables following it can be found through derivation. However, the partition table in front of the partition table cannot be deduced. But it is gratifying that the head node of the linked list, that is, the location of the primary Partition Table is fixed at (0 cylinder, 0 head, 1 sector, we can easily find it and then find all the remaining partition tables one by one.
Take the author's hard disk as an example: a primary partition (disk C) and an extended partition. There are two logical partitions (disk D and disk E) in the extended partition. The Partition Table chain is as follows:

Figure 1 Partition Table chain

(1). Read the primary Partition Table of drive C at (0 cylinder, 0 head, 1 Sector:

 [80 01 01 00 0B FE 7F FD 3F 00 00 00 3F 04 7D 00 ]                                     [00 00 41 FE 0F FE FF FF 7E 04 7D 00 1F 2C B4 00 ] [00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ]    [00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ]

Item 1: (80) (01 01 00) (0b) (Fe 7f FD) (3f 00 00 00) (3f 04 7d 00) describes the situation of the C disk. 1. (80): Drive C is the active partition. That is, the system starts from drive C. 2. (01 01 00): indicates that the starting sector of disk C is (0 cylindrical, 0 head, 1 sector ). 3. (0b): The file system of drive C is FAT32. 4. (Fe 7f FD) :( Fe) 16 = (254) 10 (7f) 16 = (0111 1111) 2 (FD) 16 = (1111 1101) 2 Head: (254) 10; fan ID: (11 1111) 2 = (63) 10. cylindrical Number: (01 1111 1101) 2 = (509) 10 so the end sector of the C disk is (509 cylindrical, 254 head, 63 sectors ). 5. (3f 00 00): reverse, (00 00 00 3f) 16 = (63) 10, which is the difference between the logical fan area number of the drive C and the logical 0 fan area number. It indicates that 63 sectors are in front of drive C, and these 63 sectors are hidden sectors of the system. 6. (3f 04 7d 00): reverse, (00 7d 04 3f) 16 = (8193087) 10. This indicates that the drive C has 8193087 sectors. That is, (0 cylinder, 1 Head, 1 sector) to (509 cylinder, 254 head, 63 sectors) a total of 8193087 sectors.

Item 2: (00) (00 41 Fe) (0f) (Fe FF) (7E 04 7d 00) (1f 2C B4 00) describes the extended partitions. 1. (00): indicates that the partition is not an active partition. 2. (00 41 Fe) :( 00) 16 = (0) 10 (41) 16 = (0100 0001) 2 (FE) 16 = (1111 1110) 2 Head: (0) 10; fan ID: (00 0001) 2 = (1) 10. cylindrical Number: (01 1111 1110) 2 = (510) 10 so the starting sector of the extended partition is (510 cylindrical, 0 head, 1 sector ). 3. (0f): indicates that the partition is an extended partition. 4. (Fe ff) :( Fe) 16 = (254) 10 (FF) 16 = (1111 1111) 2 (FF) 16 = (1111 1111) 2; head number: (254) 10; fan ID: (11 1111) 2 = (63) 10. cylinder Number: (11 1111 1111) 2 = (1023) 10, but this is not accurate, because when the actual value of the cylinder number exceeds 1023, it indicates that the 10 digits of the cylinder number are still 1023. 5. (7E 04 7d 00): reverse. (00 7d 04 7E) 16 = (8193150) 10. it indicates that the start sector of the extended partition is 8193150 (510 cylinder, 0 head, 1 sector ). This is true and accurate. I usually use this item to locate the partition start point. 6. (1f 2C B4 00): reverse. (00 B4 2C 1f) 16 = (11807775) 10. It indicates that the extended partition has a total of 11807775 sectors. The starting point and partition size obtained above can be used to export the end position of the extended partition: 8193150 + 11807775 = sector 20000925 (1244 cylinder, 254 head, 63 sectors ).

2. Search for the D-disk partition table. Based on the above information, the second partition table, that is, the D-disk partition table is located at (510 cylinder, 0 head, 1 sector. Read this sector to obtain the partition table as follows:

[00 01 41 FE 0B FE FF 7B 3F 00 00 00 BF A3 5D 00 ]                                     [00 00 C1 7C 05 FE FF FF FE A3 5D 00 21 88 56 00 ] [00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ] [00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ]

Item 1: (00) (01 41 Fe) (0b) (Fe FF 7B) (3f 00 00 00) (Bf A3 5d 00) describes the situation of the d disk. 1. (00): indicates that disk D is not an active partition. 2. (01 41 Fe): (01) 16 = (1) 10 (41) 16 = (0100 0001) 2 (FE) 16 = (1111 1110) 2. head No.: (1) 10; fan No.: (00 0001) 2 = (1) 10. cylindrical Number: (01 1111 1110) 2 = (510) 10; therefore, the starting sector of the d disk is (510 cylindrical, 1 Head, 1 sector ). 3. (0b): The file system of drive D is FAT32. 4. (Fe FF 7B) :( Fe) 16 = (254) 10. (Ff) 16 = (1111 1111) 2 (7b) 16 = (0111 1011) 2. head No.: (254) 10; fan No.: (11 1111) 2 = (63) 10. cylindrical Number: (11 0111 1011) 2 = (891) 10. Therefore, the end sector of the d disk is (891 cylindrical, 254 head, 63 sectors ). 5. (3f 00 00 00): reverse, (00 00 00 3f) 16 = (63) 10, which is the Starting Logic sector number (510 cylinder, 1 Head, 1 sector) of the D Drive) the difference from the logical sector number (510 cylinder, 0 head, 1 Sector) at the beginning of the extended partition. It indicates that 63 sectors are in front of the d disk, and these 63 sectors are hidden sectors of the system. 6. (Bf A3 5d 00): reverse, (00 5d A3 BF) 16 = (6136767) 10. This indicates that the D disk has 6136767 sectors. The starting point and partition size obtained above can be used to export the end position of the d Disk: 8193150 + 63 + 6136767 = sector 14329980. That is, (891 cylinder, 254 head, 63 sectors ). Exactly the same as above.

Item 2: (00) (00 C1 7C) (05) (Fe FF) (Fe A3 5d 00) (21 88 56 00) describes the situation of an edisk. 1. (00): indicates that the edisk is not an active partition. 2. (00 C1 7C) :( 00) 16 = (0) 10 (C1) 16 = (1100 0001) 2 (7C) 16 = (0111 1100) 2 Head: (0) 10 sector numbers: (00 0001) 2 = (1) 10 cylinder numbers: (11 0111 1100) 2 = (892) 10 so the starting sector of the E disk is (892 cylinder, 0 head, 1 slice ). 3. (05): indicates that the edisk is in the extended partition. 4. (Fe FF) :( Fe) 16 = (254) 10 (FF) 16 = (1111 1111) 2 (FF) 16 = (1111 1111) 2 Head: (254) 10 partition numbers: (11 1111) 2 = (63) 10 Cylinder Number: (11 1111 1111) 2 = (1023) 10, but this is not accurate, as shown in the preceding figure. 5. (Fe A3 5d 00): reverse, (00 5d A3 Fe) 16 = (6136830) 10. This is very important. It locates the sector where the e-disk partition table is located. The value is the difference between the fan ID of the e-disk partition table and the fan ID of the starting extension partition. Therefore, the slice Number of the e-disk partition table is 8193150 + 6136830 = 14329980. That is, (892 cylinder, 0 head, 1 sector ). 6. (21 88 56 00): reverse. (00 56 88 21) 16 = (5670945) 10. This indicates that the edisk has a total of 11807775 sectors. The starting point and partition size obtained above can be used to export the end position of the edisk: 14329980 + 5670945 = sector 20000925 (1244 cylinder, 254 head, 63 sectors ).

3. Find the e-disk partition table. Based on the preceding information, the third partition table is located at (892 cylinder, 0 head, and 1 sector. Read this sector to obtain the partition table as follows:

[00 01 C1 7C 0b Fe FF 3f 00 00 00 E2 87 56 00] [00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00] [00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00] [00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00] the second item of the partition table is all 0, it indicates that no partition table exists. The partition table is the last node of the Partition Table chain.

Item 1: (00) (01 C1 7C) (0b) (Fe FF) (3f 00 00 00) (E2 87 56 00) this item and the second item of the D-Disk Partition Table describe the edisk, but they are different in some details. 1. (00): indicates that the edisk is not an active partition. 2. (01 C1 7C): (01) 16 = (1) 10 (C1) 16 = (1100 0001) 2 (7C) 16 = (0111 1100) 2. head Number: (1) 10 partition numbers: (00 0001) 2 = (1) 10 Cylinder Number: (11 0111 1100) 2 = (892) 10 so the starting sector of the E disk is (892 cylinder, 1 Head, 1 sector ). 3. (0b): The file system of the edisk is FAT32. 4. (Fe ff) :( Fe) 16 = (254) 10. (Ff) 16 = (1111 1111) 2 (FF) 16 = (1111 1111) 2. head No.: (254) 10; fan No.: (11 1111) 2 = (63) 10. cylinder Number: (11 1111 1111) 2 = (1023) 10, but this is not accurate, as shown in the preceding figure. 5. (3f 00 00): reverse, (00 00 00 3f) 16 = (63) 10. this item is different from the corresponding items of the D-disk partition table. it is the difference between the logical sector number (892 cylinder, 1 Head, 1 sector) and (892 cylinder, 0 head, 1 sector) of the starting disk. It indicates that there are 63 sectors in front of the edisk, and these 63 sectors are hidden sectors of the system. The operating system cannot read and write these sectors, so you can write your own confidential information here. 6. (E2 87 56 00): reverse, (00 56 87 E2) 16 = (5670882) 10. This indicates that the edisk has 5670882 sectors. The corresponding item of the D-disk partition table is 5670945. 5670945-5670882 = 63. exactly equal to 63 hidden sectors. this is because the D-disk partition table describes the number of sectors (892 cylinder, 0 head, 1 sector) to (1244 cylinder, 254 head, 63 sectors. The e-disk partition table describes the number of sectors (892 cylinders, 1 Head, 1 sector) to (1244 cylinders, 254 heads, 63 sectors.

Iv. Conclusion
At this point, we have connected the entire Partition Table chain. In the future, when data on a chain node is damaged, we can also manually locate and fix it based on the information of the upper and lower nodes.
The repair tool can use the winhex.

L reproduced from: http://www.vckbase.com/document/viewdoc? Id = 443
Author: intao, Qin Jian, China University of Geosciences, Wuhan