BIOS Parameter Block BPB
 		Previous Topic  Next Topic 

Home



The partition boot sector contains the BIOS Parameter block is used to define the details of a logical partition.  The sector is pointed to from the entry in the partition table.  A very common location for the first BPB on a disk is sector 0x3F  (63).  For camera memory chips, sector 0x20  (32) is also common



000000   EB 52 90 4E 54 46 53 20 - 20 20 20 00 02 08 00 00    RNTFS      

000010   00 00 00 00 00 F8 00 00 - 3F 00 FF 00 3F 00 00 00           ? ?  

000020   00 00 00 00 80 00 80 00 - 98 FF 14 13 00 00 00 00           

000030   00 00 0C 00 00 00 00 00 - F9 4F 31 01 00 00 00 00            O1   

000040   F6 00 00 00 01 00 00 00 - 12 73 96 1C A6 96 1C 24          s––$

000050   00 00 00 00 FA 33 C0 8E - D0 BC 00 7C FB B8 C0 07        3м |

000060   8E D8 E8 16 00 B8 00 0D - 8E C0 33 DB C6 06 0E 00       3

000070   10 E8 53 00 68 00 0D 68 - 6A 02 CB 8A 16 24 00 B4    S h  hjˊ$

000080   08 CD 13 73 05 B9 FF FF - 8A F1 66 0F B6 C6 40 66    sf@f

000090   0F B6 D1 80 E2 3F F7 E2 - 86 CD C0 ED 06 41 66 0F    р?Af

0000A0   B7 C9 66 F7 E1 66 A3 20 - 00 C3 B4 41 BB AA 55 8A    ff  ôAU

0000B0   16 24 00 CD 13 72 0F 81 - FB 55 AA 75 09 F6 C1 01    $ rUu 

0000C0   74 04 FE 06 14 00 C3 66 - 60 1E 06 66 A1 10 00 66    t f`f f

0000D0   03 06 1C 00 66 3B 06 20 - 00 0F 82 3A 00 1E 66 6A     f;  : fj

0000E0   00 66 50 06 53 66 68 10 - 00 01 00 80 3E 14 00 00     fPSfh  > 

0000F0   0F 85 0C 00 E8 B3 FF 80 - 3E 14 00 00 0F 84 61 00      >  a

000100   B4 42 8A 16 24 00 16 1F - 8B F4 CD 13 66 58 5B 07    B$ fX[

000110   66 58 66 58 1F EB 2D 66 - 33 D2 66 0F B7 0E 18 00    fXfX-f3f

000120   66 F7 F1 FE C2 8A CA 66 - 8B D0 66 C1 EA 10 F7 36    fŠff6

000130   1A 00 86 D6 8A 16 24 00 - 8A E8 C0 E4 06 0A CC B8     ֊$  ̸

000140   01 02 CD 13 0F 82 19 00 - 8C C0 05 20 00 8E C0 66       f

000150   FF 06 10 00 FF 0E 0E 00 - 0F 85 6F FF 07 1F 66 61      ofa

000160   C3 A0 F8 01 E8 09 00 A0 - FB 01 E8 03 00 FB EB FE    à  

000170   B4 01 8B F0 AC 3C 00 74 - 09 B4 0E BB 07 00 CD 10    < t  

000180   EB F2 C3 0D 0A 41 20 64 - 69 73 6B 20 72 65 61 64      A disk read

000190   20 65 72 72 6F 72 20 6F - 63 63 75 72 72 65 64 00     error occurred

0001A0   0D 0A 4E 54 4C 44 52 20 - 69 73 20 6D 69 73 73 69      NTLDR is missi

0001B0   6E 67 00 0D 0A 4E 54 4C - 44 52 20 69 73 20 63 6F    ng   NTLDR is co

0001C0   6D 70 72 65 73 73 65 64 - 00 0D 0A 50 72 65 73 73    mpressed   Press

0001D0   20 43 74 72 6C 2B 41 6C - 74 2B 44 65 6C 20 74 6F     Ctrl+Alt+Del to

0001E0   20 72 65 73 74 61 72 74 - 0D 0A 00 00 00 00 00 00     restart       

0001F0   00 00 00 00 00 00 00 00 - 83 A0 B3 C9 00 00 55 AA              U



Another example


000000   EB 3C 90 4D 53 44 4F 53 - 35 2E 30 00 02 01 02 00    <MSDOS5.0 

000010   02 00 02 60 F4 F8 F3 00 - 3F 00 FF 00 20 00 00 00     ` ?     

000020   00 00 00 00 00 00 29 B7 - E1 51 58 4E 4F 20 4E 41          )QXNO NA

000030   4D 45 20 20 20 20 46 41 - 54 31 36 20 20 20 33 C9    ME    FAT16   3



Two easy points to help recognise the sector are the terminating 0x55 0xAA characters, but also the operating system name starting at byte 3.  In the examples above these are NTFS and MSDOS5.0 


For FAT disks, you also expect to see FAT12  or FAT16  or FAT32 near the top of the sector


The first bytes of the sector are a JMP instruction so normally starts 0xEB



Logically, the FDC data starts at byte 0xB.  Full details can be found in FDC Descriptor for FAT or FDC Descriptor for NTFS



NTFS details


Bytes 0x0B-0x0C        00 02                0x200 or 512 bytes per sector


Byte 0x0D                08                8 sector per cluster (normal value).  Possible values are

                                       1,2,4,8,16,32,64


Bytes 0x0E-0x0F        00 00                2 reserved sectors NTFS always starts at 0.


Byte 0x10-0x12        00 00 00        Always zero


Bytes 0x13-0x14        00 00                Always zero


Byte 0x15                F8                Media type - always F8 for hard drive


Bytes 0x16-0x17        00 00                Always zero


Bytes 0x18-0x19        3F 00                Not checked by NTFS


Bytes 0x1A-0x1B        FF 00                Not checked by NTFS


Bytes 0x1C-0x1F        3F 00 00 00        Not checked by NTFS


Bytes 0x20-0x23        00 00 00 00        Must be


Bytes 0x24-0x27        80 00 80 00        Not checked by NTFS


Bytes 0x28-0x2F        98 FF 14 13

                       00 00 00 00  Total sectors on hard drive


Bytes 0x30-0x37        00 00 0C 00

                       00 00 00 00   Logical cluster number for $MFT


Bytes 0x38-0x3F        F9 4F 31 01

                       00 00 00 00   Logical cluster number for $MFTMirr


Byte 0x40                F6                Cluster per MFT record


Bytes 0x41-0x43        00 00 00        Not used by NTFS


Bytes 0x44                01                Clusters per Index Buffer


Bytes 0x45-0x47        00 00 00        Not used by NTFS


Bytes 0x48-0x4F        12 73 96 1C

                       A6 96 1C 24        Volume serial number


Bytes 0x50-0x53        00 00 00 00        Not used by NTFS