Sponsoring website: Emergency Boot CD

Microsoft's

Web Presentation and Text are Copyright 2007 by Daniel B. SedoryNOT to be reproduced in any form without Permission of the Author !

For information on the UNIX/Linux fdisk programs: fdisk, sfdisk, cfdisk, etc., try thecommands: "man fdisk" and "man sfdisk" (at your *nix console prompt).

For the FreeFDISK used by FreeDOS, You can try emulating the MS-DOS 4.xx, 5.xx, 6.xx,7.0 and 7.1 versions of FDISK using FreeFDISK; or just use it as the official fdisk of FreeDOS. If you use FreeFDISK to change a disk with a FAT32 file system, make sure that its Fdisk.ini filehas its VERSION line set to: "W98". But NOTE: there are still differences in how these FDISKprograms function, the most important one being: FreeFDISK can not create an MBR with either theStandard or FAT32 Microsoft MBR code! It uses its own 1-sector Boot manager called Booteasyinstead.

A few other alternatives for the older MS-FDISK versions would be GDISK and GDISK32 from NortonGhost, AEFDISK and the utility, Ranish Partition Manager, which can also format the partitions itcreates (supports FAT12, FAT16 and FAT32).

Reference Guides for Master Boot Record pages: The Standard MBR created by versions of FDISK.EXE from MS-DOS 3.30 through Windows 95 (withMS-DOS 7.0)

The MBR created by MS-Windows 95B, 98, 98SE (all three being MS-DOS 7.1) and WinME's (MS-DOS8.0) FDISK

Here's another important page which describes exactly:What Does MS-FDISK do to a Hard Disk Drive?

Index to this page:

The FDISK /MBR commandOther FDISK /switch commands may be found here.

Brief History of Major Changes in FDISK

1 de 12

Listing of all FDISK.EXE VersionsNotes that Apply to All Versions of FDISK examinedMS-DOS 5.0, 6.2 and 6.22Windows 95(A)Windows 95B / 98Windows 98 SEWindows MEHow to Partition Windows 2000/XP or "Where's My FDISK?"Important References and Links on FDISK

Confused? If you have a specific question about the MBR, FDISK or Volume BootRecords, you can Send me an e-mail from here.

FDISK /MBR (for all of you who wanted to know!)No matter what version of FDISK you have (from MS-DOS 5.0 or higher that is), you canalways enter the command: FDISK /? at a DOS prompt, and your Windows machineshould respond with:Configures a hard disk for use with MS-DOS. [ Ah! And Windows too! ]

FDISK [/STATUS] /X

/STATUS Displays partition information. [ A nice safe switch. ] /X Ignores extended disk-access support. Use this switch if you receive disk access or stack overflow messages.

So, where's the /MBR switch? Well, that's the reason it's often called an undocumentedswitch! It's never displayed here; neither are any of the many others... But these variousswitches are documented in a number of Microsoft books and web pages... Especially intheir Knowledge Base articles; see for example: FDISK /MBR Rewrites the MasterBoot Record (Q69013) (which has a nice summary of what this switch does).

Basically, it will overwrite everything that's not part of the 64-bytePartition Table near the end of Absolute Sector 0 (the very firstphysical sector on a hard disk). But read on...Over and over again you'll read or hear that FDISK /MBR destroys the Partition Table too!For example, here's a quote from another KB article:

" WARNING: This process will repair the bootstrap code and the 55AA signature by rewritingsector zero, but it will also overwrite the partition table entries with all zeros, rendering yourlogical drives useless (unless, that is, the 55AA signature is manually entered using a diskeditor prior to performing an FDISK /MBR). "

First, reading the quote in context, shows that this applies only if the Signature ID WordAA55h (or 55 AA as seen in a disk editor) has been corrupted! But beyond that, I canstate that after having made several tests using the newer FDISK programs from

2 de 12

Windows 95B, 98, 98SE and ME, that none of the FAT32 capable FDISK programs willever zero-out Partition Table data; even if the Signature Word AA55h has beenerased! {You should, of course, test that out yourself and always make a backup copy ofyour Partition Table.} However, it's also a proven fact that previous versions of FDISK (such as MS-DOS 6.22),will wipe out the Partition Table data with zero bytes under the same circumstances! So, itappears that Microsoft and others would rather err on the side of caution instead of telling customersit's OK to use the FDISK from, say a Win 98 boot disk, without worrying about losing their PartitionTable data (if it's used correctly).

CAUTION: After stating all of the above, you still need to understand that FDISK /MBRmay seldom be a cure for your own MBR problems! Why? Because it's almost always thePartition Table data itself that has been changed (such as the indicator showing whichpartition is Active; i.e., bootable). And if some type of multi-boot manager (which very oftenresides on more than just the first sector) should fail, FDISK /MBR might not help at all;UNLESS you kept a record of all the Partition Table data, and are capable of entering thatdata back into a Table of ALL zeros. Fortunately, there are some nice tools available (seebelow) to do that.

Conclusion: Before you even have a problem that forces you to study about theMBR... Make a binary copy of your Master Boot Record and STORE it on two ormore Floppy disks!(And make sure to UPDATE them whenever you make a change to it! Countless usershave erased the most recent Partition Table data by allowing an Anti-Virus program tooverwrite it with old data! IF you have Norton's AV, pay attention to thatstatement!)

I'd even suggest that you get yourself a disk editor and simply write the data downon paper! Once you have the raw data from your Partition Table and know how to use

it*, you could completely erase a disk's MBR and restore it whenever you want tojust for the fun of it... that is, if you have:

1) a good floppy BOOT DISK (to boot up a computer), plus2) a Disk Editor (to enter/change Partition Table data) and3) FDISK.exe on it (it's much easier to use the FDISK /MBR command to place a copyof Microsoft's MBR code in the sector than entering it one byte at a time manually! ButNOTE: FDISK's code may not be the same as that of your present MBR! Forexample, I use GRUB for multi-booting my system, so keep a copy of the whole MBRsector on a floppy diskette with a restore program. There's a nice utility calledMBRWizard for doing just that; though PowerQuest's MBRUTILD might be easier foryou to use.)

(At the very least, MAKE SURE you have those three items before attemptingto experiment with your MBR!)

[*Going over the other pages in this series about MBR/Boot Records should help you inacquiring the necessary knowledge.]

3 de 12

A Brief History of Major Changes in the FDISK ProgramMS-DOS 3.3 - Although partitions still had a maximum capacity of 32MB, this versionwas the first to introduce Extended DOS partitions* (a maximum of 24 partitions using thedrive letters C: through Z:). But, only two physical drives were supported at that time. Partition Type Capacity ranges from FAT type -------------- -------------------- --------

01 0 through 15 MB 12-bit 04 16 MB through 32 MB 16-bit 05 Extended Partitions N/A

____________

* Technically, MS-DOS 3.2 introduced an extended partition type first, but that version supported only onelogical drive apart from the primary partition.

MS-DOS 4.0 - Partition sizes increased to a maximum capacity of 2.1 GB, but full use ofthese partitions required the MS-DOS program Share.exe to be loaded first. A new partitiontype (06) was added for partition sizes over 32 MB. Partition Type Capacity ranges from FAT type -------------- -------------------- --------

06 32 MB through 2.1 GB 16-bit

MS-DOS 5.0 - The number of physical drives which could be accessed increased toeight. (Share.exe no longer required for large drives.) Although FDISK could still createonly one Primary partition per physical drive, a little known fact is that support for morethan one Primary MS-DOS partition was added to the MS-DOS 5.0 kernel.

We tested this out using a Windows install on a drive created with THREE Primary FAT32partitions plus an Extended partition with four more Logical drives... both the Windows fileExplorer and DOS mode had no problems reading and writing to all of these drivepartitions. But you'll need a 'third-party' program to create a drive with more than onePrimary partition since MS-FDISK still will not do so itself. Apart from the fact that FDISKjumbles your drive letters when doing this, we recommend you try this only as anexperiment since we've heard a person having a disk with two FAT16 primary partitions hadcorrupt data after using it for some time; unfortunately, we have no details about how orwhy that happened. Even though FDISK is supposed to be aware of this possibility, for some reason it wasprogrammed to assign drive letters to any 'Logical drives' in an Extended partition before a2nd or 3rd primary partition. This is just plain faulty logic in my opinion; apparently a patchwas added at some logical point in the program following the place where FDISK alreadydecides that no more than one primary DOS partition can exist, then it goes back and'tacks on' those drive letters later! Our test drive looked like this in FDISK:

4 de 12

You can clearly see three Primary DOS partitions on this drive, butbecause of the logical drives in the Extended Partition they are

assigned the letters I: and J: rather than E: and F: (as seen below);

the letter D: having already been assigned to the first DOS partition of a second physicalhard disk connected to the computer (both MS-DOS and Win9x make their drive letterassignments in ways that frustrate all of us!).

Versions of FDISK used in the Boot Record Studies: OS Type Filename File Size Release Date ----------- --------- --------- ---------------

MS-DOS 3.30 FDISK.COM 48,919 07-24-87 12:00a MS-DOS 4.01 FDISK.EXE 60,935 04-07-89 12:00a(Only 3 copies of the MBR code can be found inside FDISK prior to MS-DOS 5.0) MS-DOS 5.0 FDISK.EXE 57,224 11-11-91 5:00a MS-DOS 6.2 FDISK.EXE 29,334 09-30-93 6:20a

MS-DOS 6.22 FDISK.EXE 29,336 05-31-94 6:22a(MD5 checksum is: 1b7010dcc3b84db402744751da321da8)

Windows 95(A)(MS-DOS 7.0) FDISK.EXE 59,128 07-11-95 9:50a

Windows 95B(MS-DOS 7.1) FDISK.EXE 63,116 08-24-96 11:11a

Windows 98(MS-DOS 7.1) FDISK.EXE 63,900 05-11-98 7:01p(MD5 checksum is: cf1024be244cb51adddf9aeaa8199084)

Windows 98 SE

5 de 12

(MS-DOS 7.1) FDISK.EXE 63,916 04-23-99 10:22p(MD5 checksum is: 7da2cc665c38784c555225b727f7660e)

Windows ME(MS-DOS 8.0) FDISK.EXE 66,060 06-08-00 5:00p

[ Note: Windows NT/2000/XP OSs do not have an FDISK program; in order to partition ahard drive, they use what's called: the Disk Management MMC which is built into the OS;we'll have more to say about this below. ]

Notes that Apply to All Versions of FDISK examined here

All of the FDISK.EXE files are packed with at least one EXE packer. The older DOS fileswere also PKlite'd to further reduce the overall size since DOS was sold on floppy disksand users were still concerned about how little free space they had on their 250 to 500 MBdrives. [ Details on how to unpack the files are available upon request. ]

Inside every FDISK program (from DOS version 5.0 or higher), there arenine duplicate copies of the code for the MBR. Why does FDISKneed nine copies? If anyone knows for sure, please e-mail me so I canpost the info here. (The FDISK in DOS 3.30 through 4.01 has only threecopies of the MBR code inside it; even so, why more than one or at mosttwo?)

For example, if you open either the Windows98 (5-11-98) or theWindows 98SE (4-23-99) version of FDISK.EXE in a Hex editor, you'llfind all the code for 2nd through 9th copies of the MBR between offsets54,762 (D5EAh) and 57,113 (DF19h). The 1st (first) copy of the code islocated between offsets 53,718 (D1D6h) and 54,011 (D2FBh). Thecode is also in a 'packed form' let's say, since most of its zero bytes havebeen removed resulting in this:

6 de 12

If you compare the bytes 'highlighted in yellow' with those on my page"95BMEMBR.htm", you'll find that this is indeed the code section of anMBR plus the "Magic Number" of AA55h. There are also some extrabytes (underlined in the pic above) which may be related to how manyzero-bytes are to be placed in which locations by the program.

NOTES on MBR Error Message Creation :Ever since the original version of Windows 95 (or '95A' if you prefer), none of the FDISKprograms have included exact copies of the MBR code as they had in the MS-DOSversions! The differences though are only related to its error messages: none of the errormessages appear in any of the nine copies of the MBR within the FDISK program.

Instead, the error messages which FDISK places into the nine MBR copies are all takenfrom a single location in the code. For Windows 95B, the text appears between 3b1ahand 3b6bh. For Win ME, it's between 3d39h and 3d8ah. And here's a pic of this portionof the code which is exactly the same for both Windows 98 and 98SE (and appearsbetween offsets 3d35h and 3d86h:

Note: The circled bytes (18h, 1Fh and 19h) are NOT part of the error messages;they're used by the FDISK program to simply count the number of bytes whichfollow that are to be copied to the final MBR code! For example, the first errormessage is 24 (18h) bytes long; including the ASCII-Z Zero byte (00h) stringterminator. [1Fh is 31 bytes, and 19h is 25 bytes.]

There are also two bytes in the nine copies of the MBR which are always changed whenthe code is finally written to the hard disk: For example, in the Windows 95A version ofFDISK ( the Standard MBR ), these bytes are located at 074h and 079h (or 0674h and0679h at execution time in memory). These are the bytes which are used as pointers to the2nd and 3rd error messages, and both of them contain an 8Bh instead of the StandardMBR values of A3h and C2h. Thus, all three of the error msg. routines are pointing to thesame byte where the error messages would normally begin; only there's nothing but zerobytes there (in its unpacked form that is) all the way from 8Bh to the MBR sector'ssignature ID of AA55h in these nine copies.

Perhaps, buried deep inside of the FDISK code, there's some way that the standard errormessages can be changed under certain conditions... but trying to disassemble FDISK

7 de 12

to determine this (something I might never be able to do anyway!), is not a task I reallywant to bother with. Someone from Europe once suggested that the reason for why theydid this seemed rather obvious: Because of all the different languages that FDISK's errormessages must be translated into (which vary in length from their original Englishversions). However, since the error messages for other languages are already contained inthose versions of FDISK, just as they are in the English version, this does not reallyexplain why all the extra code is necessary; code which would allow for the messages to bechanged while the FDISK program is running!

In the past, I started to think that this extra programming might be related to the strangeerror messages I've seen in some Windows 98/98SE MBRs which contain the phrase,"Setup cannot continue." (see below), but there doesn't seem to be any relationshipbetween the two. The odd error messages (and the removal of the third standard one!)always seem to be found in MBRs that were used by a CD-ROM install of Windows 98.[ If you can shed any light on why these program routines were created and and how theyare used, please send me an e-mail so I can post the info here. ]

For reference, here's the same area (as shown in the pic above) for the French version ofWin98SE's FDISK: 1Bh = 27 decimal4130 65 63 20 2F 43 4D 42 52 2E 0D 0A(1B)54 61 62 6C ec /CMBR....Tabl4140 65 20 64 65 20 70 61 72 74 69 74 69 6F 6E 20 65 e de partition e4150 72 72 6F 6E 82 65 00(34)45 72 72 65 75 72 20 6C rron.e.4Erreur l4160 6F 72 73 20 64 75 20 63 68 61 72 67 65 6D 65 6E ors du chargemen4170 74 20 64 75 20 73 79 73 74 8A 6D 65 20 64 27 65 t du syst.me d'e4180 78 70 6C 6F 69 74 61 74 69 6F 6E 00(20)53 79 73 xploitation. Sys4190 74 8A 6D 65 20 64 27 65 78 70 6C 6F 69 74 61 74 t.me d'exploitat41A0 69 6F 6E 20 6D 61 6E 71 75 61 6E 74 00 34 BD 04 ion manquant.4..

34h = 52 decimal 20h = 32 decimal

The circled bytes above (1Bh, 34h and 20h) will, of course, vary for other languages whenever thelength of their error messages are different.

MS-DOS 5.0, 6.2 and 6.22All three of these FDISK programs are packed with EXEPACK 5.31.009 (LINK 3.69), butthe version 6 series is also PKlite'd (PKLITE 1.15). All three contain the phrase "MSRun-Time Library - Copyright (c) 1988"* . The DOS 5.0 program also contains thephrase "DOS Version 5.00 (C)Copyright 1981-1991" while each of the DOS 6 filescontain: "DOS Version 6 (C)Copyright 1981-" with version 6.2 ending in 1993 andversion 6.22 ending in 1994.

* One reader states concerning the phrases found above: This is a tell-tale sign that this program was compiledwith Microsoft C 5.1. The newer version of EXEPACK was probably to avoid the bug that EXEPACKed programsdo not load below 64K without relying on the 20-bit address wraparound.

The string of parameters which FDISK accepts on the command line looks like this insideall three of these FDISK files:/PRI /EXT /LOG /Q /STATUS /? /MBR

Here's my page about all the other Undocumented FDISK.EXE Switches for DOS

8 de 12

and Windows.

Windows 95(A)

Windows 95's FDISK contains the phrases: "MS Run-Time Library - Copyright (c)1992"* and "MS-DOS Version 7 (C)Copyright 1981-1995"The string of parameters is no different than that found in MS-DOS 6.2

* The same reader we quoted above, adds here: This is a sign that the program was compiled with Microsoft C7.0 orVisual C++ 1.x.

This version added support for two new partition types (0Eh and 0Fh) if the computer'sBIOS had INT13 Extensions for the LBA (Logical Block Addressing) method of accessingthe sectors on a large hard drive. Partition Type Capacity ranges from FAT type -------------- -------------------- --------

0E 32 MB through 2.1 GB 16-bit 0F Extended Partitions N/A

Windows 95B and 98

Both Windows 95B and 98 contain the same phrases and copyright dates as those foundin Win 95, but here we have a half-dozen new switches that were added to the string ofparameters which FDISK accepts on the command line! The string looks like this insideFDISK:/PRI /EXT /LOG /PRIO /LOGO /Q /STATUS /? /MBR/X /ACTOK /CMBR /FPRMT

Win 95 OSR2 and Windows 98 introduced two new partition types for the FAT32file system:

Partition Type Capacity ranges from FAT type -------------- -------------------- -------- 0B 512 MB - 2 terabytes 32-bit 0C 512 MB - 2 terabytes 32-bit

Type 0Ch requires the computer's BIOS to support the LBA method ofaccessing large hard drive's using INT13 Extensions.

When you start FDISK, you'll be presented with the following notice:Your computer has a disk larger than 512 MB. This version of Windowsincludes improved support for large disks, resulting in more efficientuse of disk space on large drives, and allowing disks over 2 GB to beformatted as a single drive.

IMPORTANT: If you enable large disk support and create any new drives onthis disk, you will not be able to access the new drive(s) using other

9 de 12

operating systems, including some versions of Windows 95 and Windows NT,as well as earlier versions of Windows and MS-DOS. In addition, diskutilites that were not designed explicitly for the FAT32 file system willnot be able to work with this disk. If you need to access this disk withother operating systems or older disk utilities, do not enable largedrive support.

Do you wish to enable large disk support (Y/N)...........? [Y]

If you have an existing NTFS partition on your computer, you may also see the following:Your computer has NTFS partitions which may require large drivesupport. If you are using another operating system, such asWindows NT, which supports large drives you should enable treatingthese partitions as large. NOTE: If you answer Y and thepartition display looks incorrect or a hang or crash occursdo nothing, run FDISK again, and answer N to this question.

Should NTFS partitions on all drives be treated as large (Y/N)? [Y]

Windows 98 SE (Second Edition)

Windows 98SE still contains the same Run Time phrase and Copyright dates as Windows95, but one new switch was added near the end of the string of parameters inside FDISK:/XMBR

For some strange reason, many Windows 98 users who examine their MBR will find thephrase: "Setup cannot continue." added to the end of each of the first two standardMBR error messages; and the third message has been eliminated altogether... because, Iassume, there is not enough empty space remaining!

From the small amount of data I've gathered so far, it appears that these messages arecreated directly from a Windows CD-ROM installation. I can only guess that this mighthappen when using an OEM version vs. the full Retail version, but don't have enough datato know for sure.

If you see this message in your MBR, and know for sure how your drive was firstpartitioned (by MS-FDISK from a Boot Diskette or from a CD-ROM and which version,etc.), then please send me the information. If you don't find these alternate 'errormessages' in your own MBR at the present time, you might find them near the end of a fileon your Win 98 drive called "SUHDLOG.DAT" (this is a Hidden, Read-only file in C:\ andthe messages were in my file) which appears to be a record of the changes made to theMBR(s).

Windows ME (Millennium Edition)

Windows ME's FDISK contains the new phrase: "MS-DOS Version 8 (C)Copyright1981-1999" Except for that, this FDISK program is essentially the same as theWindows 98SE version.

10 de 12

Windows 2000/XP/2003

As stated above (at the end of our "Versions" section), the Windows NT/2000/XP/2003OSs do *not* contain any FDISK program; although you will find a copy of FORMAT.COMinside of any CMD or Command window (for use on floppy diskettes). If you wish to partition a hard drive for use by these or any other OS, you must run theDisk Management MMC "snap-in" tool in the Computer Management window; it's foundunder the item "Storage" (in a tree view). You can access "Disk Management" from the"Administrative Tools" menu; and must have Administrator privileges to use it.

NOTE: When using Windows 2000/XP to partition a drive, you should never use what areknown as Dynamic Volumes; unless you have a very good reason for doing so! Theuse of Basic Volumes will, for example, still allow you to access an NTFS partition from aspecial DOS boot diskette, whereas you can not do so if it's a Dynamic volume! At thistime, Dynamic volumes can only be accessed by your Windows boot OS, and make datarecovery much more difficult. Why? Because they move the MBR and other systemstructures to a different (and varying) location called a "private region database," andplace a 42h byte in what is then called the 'legacy' MBR's Partition Table entry/entries forthese volumes (to identify them and the disk as being Dynamic). For more information,see here. [ If you have Windows 2000/XP, then look up 'Disk Management' in the generalHELP, and read about Dynamic disks and volumes in your OS's own Help file. ]

Links and ReferencesWayback Machine copy of: firmware.com/support/bios/fdisk.htm Notes onDOS FDISK Command. READ THIS TEXT. A good article covering major versions ofFDISK.exe and their peculiarities up to the beginning of the FAT32 file system. Unfortunately, thematerial was never updated beyond a problem with the first version of Windows 98 (text is dated:04/22/1999).

MS-DOS Partitioning Summary (Q69912). A Knowledge Base article which brieflydescribes all of the MS-DOS and Windows partitions through Windows 98.

Dynamic vs. Basic Disk Storage in Windows XP (Q314343).A Knowledge Base article briefly describing Dynamic Storage concepts and how it differs fromthat of "Basic" disks. You should also read "Upgrading the System or Boot Drive to Dynamic(Rooting)" (KB article Q222188).See KB article: Q175761 for Windows 2000 Dynamic disks/volumes.

11 de 12

Last Update: 18 November 2007.

You can write to me using this: online reply form. (It opens in a new window.)

The Starman's FREE TOOLS Page

MBR and Boot Records Index

The Starman's Realm Index Page

12 de 12