1. Master Boot Record (MBR)
Executable Code
Machine Language Code
Processor Specific
Decodes Partition Table
446 bytes long
Partition Table
4 Entries
First Entry Starts at offset 0x01BE
MBR “Signature”
0x55AA
2008 Richard T. Turley

2. Decoding a Partition Table Entry
Entry #3 starting at offset 0x01DE
Starting Sector
Offset 2
6 bits (use 6 LSB)
Decode as bits
0xC1 = 1100|0001
6 LSB = = Sector #1
Starting Cylinder
Offset 3
10 bits (use remaining 2 bits from sector as upper 2 bits)
Decode as bits
0xFF = 1111|1111
10 bits = 11|1111|1111 = 0x3FF = Cylinder # 1023
Bootable?
Offset 0
Value 0x80 means bootable
Starting Head
Offset 1
1 Byte
0x00 = 0 Starting Head
File System Type
Offset 4
Decode as table entry
0x0C = Win 95 Fat-32 LBA
Number of Sectors
Offset 12
4 Bytes
Decode as Number (swap)
0x000E37BA = 931,770
# of sectors in this partition
477,066,240 bytes (*512)
Ending Head 5
Relative Sectors
Offset 8
4 Bytes
Decode as Number (swap)
0x1D0D9045 = 487,428,165
# of sectors from start of drive to start of this partition
Ending Sector 6
Ending Cylinder 7
2008 Richard T. Turley

3. Partition Boot Record (PBR)
BIOS Parameter Block
Executable Code
Machine Language Code
Processor Specific
Decodes BPB
Searches for OS
PBR “Signature”
0x55AA
2008 Richard T. Turley

4. Decoding a Partition Boot Record (BIOS Parameter Block – BPB)
Jump Instruction
Offset 0x00
3 bytes
OEM Name
Offset 0x03
8 bytes
Decode as ASCII
“MSDOS5.0”
Bytes Per Sector
Offset 0x0B
2 bytes
Decode as Number
(Swap “endian”)
0x0200 = 512
Sectors Per Cluster
Offset 0x0D
1 byte
Decode as Number
0x08 = 8
8 * 512 = 4096 bytes/cluster
Media Type
Offset 0x15
1 byte
Decode from Table
0xF8 means HD
Heads
Offset 0x1A
2 bytes
Decode as Number
(Swap “endian”)
0x00FF = 255
Sectors per Track
Offset 0x18
2 bytes
Decode as Number
(Swap “endian”)
0x003F = 63
Total Sectors
Offset 0x20
4 bytes
Decode as Number
(Swap “endian”)
0x000E37BA = 931,770
477,066,240 Bytes
FAT Size (Sectors)
Offset 0x24
4 bytes
Decode as Number
(Swap “endian”)
0x D = 909
465,408 Bytes (*512)
58,176 Entries (/4)
238,288,896 bytes addressed
(*4096)
File System Type
Offset 0x52
8 bytes
Decode as ASCII
“FAT32 ”
2008 Richard T. Turley

5. FAT Root Directory Volume ID Directory Entry
Single Directory Entry for a file with a “short” filename.
Multiple Directory Entries for a file with a “long” filename. There are 4 entries to contain the long file name, and 1 entry to contain the complete set of file information including the “short” file name.
Designates Attribute Bits
0x08 = Volume Label
0x20 = Archive
0x0F = Long File Name
2008 Richard T. Turley

6. Decoding a Root Directory Entry (1)
Create Time (Coarse)
Offset 0x0E
2 bytes
Decode as Number (swap)
0x6E4D = 01101|110010|01101
1st 5 bits: 13 hour
Next 6 bits: 50 min
Last 5 bits: 13 => 26 seconds
13:50: fine above
13:50:27.02
DOS File Name
Offset 0x00
8 bytes
Decoded as ASCII
“LONGY “
DOS File Extension
Offset 0x08
3 bytes
Decoded as ASCII
“TXT “
Create Time (Fine)
Offset 0x0D
1 byte
Decode as Number
0x66 = 102
102 * 10 ms = 1.02 sec.
Create Date
Offset 0x10
2 bytes
Decode as Number (swap)
0x3562 = |1011|00010
1st 7 bits: = year
Next 4 bits: 11 month = November
Last 5 bits: 2 day
November 2, 2006
Last Access Date
Offset 0x12
2 bytes
See Create Date
File Size
Offset 0x1C
4 bytes
Decode as Number (swap)
0x = 14,658 bytes
Occupies 4 clusters (/4096)
Has 4* = 1726 bytes of slack
First Cluster
Offset 0x14 (High Bytes)
Offset 0x1A (Low Bytes)
4 bytes
Decode as Number (swap)
0x = 3 start cluster
2008 Richard T. Turley

7. Decoding a Root Directory Entry (2)
Bit
Meaning
Read Only 1
Hidden 2
System 3
Volume Label 4
Subdirectory 5
Archive 6
Device 7
Unused
Attributes
Offset 0x0B
1 byte
Decode as bits – 0th bit on right, 7th bit on left
0x0F means Long Filename entry
0x20 = 0010| Archive
Last Modified Time
Offset 0x16
2 bytes
Decode as Number (swap)
0x6E1A = 01101|110000|11010
1st 5 bits: 13 hour
Next 6 bits: 48 min
Last 5 bits: 26 => 52 seconds
13:48:52
Last Modified Date
Offset 0x18
2 bytes
Decode as Number (swap)
0x3562 = |1011|00010
1st 7 bits: = year
Next 4 bits: 11 month = November
Last 5 bits: 2 day
November 2, 2006
2008 Richard T. Turley

8. This file occupies 4 clusters or 4 * 4096 = 16,384 bytes on the drive.
Cluster 3 Entry
First Cluster of File as identified in directory entry
Offset 0x08
4 bytes
Decoded as Number (swap)
0x = 4 next cluster
FAT Table (FAT)
Cluster 4 Entry
Offset 0x08
4 bytes
Decoded as Number (swap)
0x = 5 next cluster
Cluster 5 Entry
Offset 0x08
4 bytes
Decoded as Number (swap)
0x = 6 next cluster
Cluster 6 Entry
Offset 0x08
4 bytes
Decoded as Number (swap)
0x0FFFFFFF = EOF
This file occupies 4 clusters or 4 * 4096 = 16,384 bytes on the drive.
It is not always the case that a file will occupy sequential clusters.
2008 Richard T. Turley