Devices Partition - Data

This section gives a more detailed breakdown of partition type devices - more specifically the actual data stored within the element in order to identify the partition correctly. There are significant differences between how partitions are identified on MBR and GPT partitioned disks -


BIOS Firmware - MBR Disk

The following data is from the device element within an application osloader type object - in this case a Windows 8.1 Operating System installed on a MBR type hard disk. It was displayed as partition=C: in bcdedit.exe -

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,06,00,00,00, 00,00,00,00,48,00,00,00,00,00,00,00,00,00,f0,15,00,00,00,00, 00,00,00,00,00,00,00,00,00,00,00,00,01,00,00,00,f1,a8,eb,b3, 00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00, 00,00,00,00,00,00,00,00

The green data at hex offset 0x10 (06) indicates that this is a partition type device.

The red data at hex offset 0x38 contains the disk signature - this corresponds to hex offset 0x01B8 in the Master Boot Record (LBA0) in the screenshot below -

The blue data at hex offset 0x20 contains partition offset information (in bytes). The data is read in pairs from right to left - using the above example 00,00,f0,15,00,00,00,00 translates to 00,00,00,00,15,f0,00,00 (hexadecimal 0x15f00000 = 368050176 decimal). The partition table entry in the Master Boot Record for the same partition is a four byte value at hex offset 0x01D8 - in this case 00,F8,0A,00.

These bytes are also read in pairs from right to left - 00,F8,0A,00 translates to 00,0A,F8,00. Hexadecimal 0x0af800 = 718848 decimal. Unlike the data stored in the BCD element, the offset information in the MBR is in sectors. Assuming a 512 byte sector size, 718848 sectors x 512 bytes = 368050176 bytes.

For a detailed explanation of entries in the partition table see http://thestarman..../PartTables.htm


UEFI Firmware - GPT Disk

The following data is from the device element within an application osloader type object - in this case a Windows 8.1 Operating System installed on a GPT type hard disk (UEFI Firmware). It was displayed as partition=C: in bcdedit.exe -

00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,06,00,00,00,00,00,00,00,48,00,00,00,00,00,00,00,d2,54,ac,d9,87,ea,2c,43,86,b5,66,c4,e8,10,5f,9d,00,00,00,00,00,00,00,00,08,63,e5,bb,e7,18,34,41,9b,6c,4b,31,4d,12,ea,b4,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00

Unlike MBR partitioned disks in use on systems with BIOS firmware, GPT disks do not contain a disk signature. They do however contain a unique Disk GUID at hex offset 0x38 in the second sector of the disk (LBA1) -

As you can see from the above screenshot, the unique Disk GUID corresponds with the data at hex offset 0x38 in the element for this object - the red data.

Partitions on GPT disks also have unique GUID's. This information is stored in the GUID partition table. On the test system this data is stored in the third sector of the hard disk (LBA2) at hex offset 0x0190 -

As you can see from the above screenshot, the unique partition GUID corresponds with the data at hex offset 0x20 in the element for this object - the blue data.