Boot Sector Address - what determines the address during partition creation

Posted on 2004-04-23
Last Modified: 2011-10-03

I want to resize my system partition from 80GB to 15GB

Steps taken:
1) Create Ghost backup image of system partition (NOT drive)
2) Use GDISK to delete 80GB partition and create new active 15GB partition
3) Restore Ghost image of original system partition to new 15GB partition

System won't boot

My diagnosis:
XP originally created a system partition with boot sector address to 07 (which I believe is the typical address assigned?).
For some reason, GDISK set it to 0C when creating the partition, so it's pointing to the wrong start address for the system partition backed up to the GHOST image.

GDISK has never "misbehaved" before for me (it has always created partition with boot sector address 07 on my other computers - only thing I can think of is there's something different about this hard disk (5400 rpm) than the ones I've used previously (< 5400 rpm).

My Solution:
Since I didn't want to spend any more time trying to figure out how to change the boot sector address to 07 (I'm sure it's easy if you know how.  Maybe with debug?), I used XP Repair DISKPART to delete the 15GB partition and recreate it. Boot Sector address was now set to 07. Then used Ghost to restore the image. Problem solved.

Why is GDISK creating the partition with boot sector address 0C on this computer?
What determines the boot sector address during partition creation?
How do I change the boot sector address after a partition is created?

With Regards-
Question by:SAbboushi
  • 3
  • 3
LVL 41

Expert Comment

ID: 10904042
Well, let's start at the beginning...   There are actually two "boot sectors" (pardon the inappropriate use of the term).

The Master Boot Record (MBR) is typically the first sector on the physical disk... it has just enough smarts to read the partition table (coincidently lives at the save sector), and then go boot from that partition.  It's pretty much a generic routine, where (for example) and WinNT MBR can boot a WinXP disk with no problems.

The *real* boot sector, is typically the first sector in the logical partition (the C: drive's partition).  It is pretty much specific to the OS installed... (ie Win98 vs WinXP, etc) and to the filesystem (ie. FAT32 vs NTFS, etc).  So the location of the boot sector has everything to do with where the first partition starts.

So, before you try too many drastic measures, I'd suggest that you boot to the Recovery Console (via the Windows CDROM) and attempt to fix either the MBR or the Boot sector.  The two commands are FIXMBR and FIXBOOT.

Another obvious thing to look at is if your partition is marked as "Active" (meaning attempt to boot off of that partition)

Author Comment

ID: 10910202
Thanks for your comments graye.

Am still looking for answers to my specific questions though.
LVL 41

Expert Comment

ID: 10910547
Sorry I didn't answer your question...

As you propably already know... You can use any partition editor to change the physical starting sector of a partition.   And since the boot partition is always the first section in that partition, that's the way to control where the boot sector ends up.

As for why it happened?  I don't have a clue.  I do know that Microsoft (and quite a few others) like to start partitions on a "cylinder boundary".  But there are no rules against starting a partition anywhere.   Perhaps that's what happened in your case, the partition software was more aggressive and decided to make use of a few more sectors than whould otherwise be available using the more consersative cylinder approach.

Hummm... just guessing here, but perhaps the physical geometry of the drive got confused (that could happen with a BIOS upgrade to the computer).
Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.


Author Comment

ID: 10918618
Thanks graye - getting closer to my answer.

If I understood what you've said so far:
1)  The first sector of a physical disk contains the MBR and the partition table (for MBR, you say "typically" meaning there are exceptions?)  I would imagine that the partition table might extend across several sectors?  This makes me suspect that a given hard disk's available space for formatting begins after the MBR & partition table sectors?  This is outside the scope of my question, but if you have an answer...
2) The first sector of a logical partition contains the boot sector (again you say "typically", but then you seem to say "always" - are there exceptions?)
3) "You can use a partition editor to change the physical starting sector of a partition".  I am unclear how this is related - I get the impression that the boot sector of a partition is relative to a logical partition (GDISK shows "07" as SYS for most of the partitions.)  I suspect that the "07" is the starting address of the boot sector within a specific logical partition - meaning that the MBR points to the active partition and relative address within that partition for that partition's boot sector (vs. the physical starting sector of the boot sector).  Am I on the right track here and if so, my question remains:  How does one change the 07 as the boot sector of a logical partition?
LVL 41

Accepted Solution

graye earned 500 total points
ID: 10919688
Ahh.... the plot thickens!

Let's get to the last comment first...  The partition table contains a 1 byte code for the type of partition (by installed OS ).  A "07" just means NTFS.... that's not the location of anything.  So your question is now... How do I change the "partition type code"?  (err... I don't think so, there'd be no reason to do that).

The list of valid parition type codes is quite long (several hundred)... but Microsoft's FDISK only uses about 3 or 4 of the them.

Nope, the entire partition table exists within that one sector of the MBR.  It only has 4 entries, so it's pretty small.  The extended parition information (if any) is actually stored elsewhere on the disk (as the first sector in that partition, as if it was the BR).  The logical drives "inside" the extended partition each are treated just like a primary partition (with the first sector of their parition being the BR)

As far as I know the BR is *always* the first sector in any logical partition.

Yes, everything has exceptions.  There are NO standards for the MBR/BR... vendors are free to do practically anything they want.  Third-party partitioning software often capitalizes on this fact to make partitions hidden, etc.  Linux distros often attempt to fool the MBR into believing their partitions are something else, and rely on a separate bootstrapping routine that doesn't use the BR at all.

Let's look at a simple 60 Gb primary partition entry example with NTFS (the entry is 16 bytes)

80 01 01 00 07 FE FF FF 3F 00 00 00 80 3D FC 06

80                the partition header (80 means it's active and it's the first partion)
01 01 00       the starting Cylinder (01) Head (01) Sector (00)
07                the partition type (07 means NTFS)
FE FF FF       the ending CHS (not really, but real CHS are being translated as LBA by the BIOS)
3F 00 00 00   the *real* starting location (as translated by LBA)
80 3D FC 06  the *real* size (as translated by LBA)

Author Comment

ID: 10991544
Thanks graye - it seems the partition boot record is the problem.  Each time I try to restore a Ghost image, I get the same problem: machine hangs, cursor in top left of black screen.  FIXBOOT allows me to boot, but then I'm concerned about the restored image integrity because XP reported new hardware (systray baloon) and then the System Settings Change Window appears:  Windows has finished installing new devices.  The software that supports your device requires that you restart…  (is there a log that shows what hardware was found??)  Do you have the knowledge to reassure me that FIXBOOT would cause the XP new hardware message to appear, and if so, why?

My problem still exists, but my original question was bad.  You correctly pointed out that 07 was not the starting address of anything but merely the partition type code...  So I will be awarding you the points.

It seems you have the knowledge to help me solve this problem though, and I would appreciate your comments:

MY PROBLEM:  I am at a loss regarding why the Ghost images on my new laptop have bogus partition boot records - only thing I can think of is that Ghost does not get along with this particular disk geometry as I have never had this problem with other machines.  I would like to compare the partition boot sectors before and after a Ghost backup/restore to see what the heck is going on.  How do I inspect the boot sectors so I can see their contents?  Where can I find a layout guide for boot sectors like you have provided above?  I read that the boot record of NTFS volumes can be up to 16 sectors long.

If I am not mistaken from the research I've done, the partition boot sector contains the boot signature as you've provided above - and if the signature is valid, then execution is passed from the MBR partition loader to the partition's boot sector code.

If FIXBOOT got the partition to boot, then it seems there are 3 scenarios:
1) The partition boot signature is not valid (bogus starting cylinder or something like that).  I've read that the partition boot sector, in addition to what you documented above, also contains bytes per sector, sectors per cluster…)
2) The partition boot sector code is corrupt
3) Both

Any further help you can provide would be much appreciated.

With Regards-

Featured Post

Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

Join & Write a Comment

If you build your web application in Visual Studio you'll get at least a few binaries, or .DLL, files in your bin folder. However, there is more compiling to be done. Normally this would happen when an ASP.NET resource within the web site is request…
Can you find a fax from a vendor you saved a decade ago in seconds? Have you ever cursed your PC under your breath during an audit because you couldn’t find the requested statement or driver history?  If you answered no to the first question or yes …
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
This demo shows you how to set up the containerized NetScaler CPX with NetScaler Management and Analytics System in a non-routable Mesos/Marathon environment for use with Micro-Services applications.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now