Disk Partitioning

• https://en.wikipedia.org/wiki/Disk_partitioning
• aka Disk Slicing
• The process of dividing a single physical block device’s flat, linear LBA array into one or more isolated logical regions called Partitions (or Volumes)
• Partition editors are tools to manage partitioning
  • Windows: diskpart, Disk Management
  • Linux: fdisk, parted, GParted
  • macOS: Disk Utility
• Boot info
  • disk signature is also stored in the Boot Configuration Data (BCD) store, and the boot process depends on it??

Boot Sector

• https://en.wikipedia.org/wiki/Boot_sector
• It contains machine code to be loaded into RAM and then executed by System Firmware like BIOS
• It is usually the first physical sector of disk regardless of MBR or GPT partition scheme

Partition Table

• It is a table maintained on a disk by the OS that outlines and describes the partitions on that disk

Partitioning Schemes

Master Boot Record Scheme

• uses MBR and VBR

Master Boot Record

• aka MBR
• Historically used in DOS, Windows, Linux
• It is type of boot sector in the first block of partitioned disk (LBA 0)
• Supports exactly 4 entries in partition table
• Partition Types
  • Primary Partition
  • Extended Partition
• One of the primary partition entry is marked active or bootable
• Only one extended partition is possible
• MBR bootstrap code scans the table, locates the active partition, loads its Volume Boot Record (VBR) into RAM, and jumps execution to it, This is known as Chain loading
• https://en.wikipedia.org/wiki/Master_boot_record

Structure of MBR

• Bootstrap code
  • Instructions to identify the configured bootable partition
  • It then load and execute its volume boot record (VBR)
  • Optional Disk timestamp (6 bytes)
  • Optional Disk signature (4 bytes)
• Partition Entry (16 bytes)
  • Partition Headers & Reserved Space (8 bytes)
    • Boot or Active Flag (1 byte)
    • Legacy Starting CHS (3 bytes)
    • Partition Type ID (1 byte)
    • Legacy Ending CHS (3 bytes)
  • Starting sector LBA address (4 bytes)
  • Total number of sectors (4 bytes)
• Boot Signature
  • aka Magic Bytes
  • Validates that the sector contains executable boot loader code
  • Checked by the System BIOS and MBR loaders before passing CPU execution control
• Maximum Partition size
  • Total max sectors (4 bytes) = $2^{4\cdot 8}=2^{32}$
  • 512 bytes sector (or 512e): $512\cdot 2^{32}=2^{41}$ bytes = 2 TB
  • 4KB sector (4Kn): $4\cdot 2^{10}\cdot 2^{32}=2^{44}$ = 16 TB

Address	Description	Size
0x0000 (Byte 0) - 0x01BD (Byte 445)	Bootstrap code area including: - disk timestamp (optional) - disk signature (optional) - Windows NT signature (optional) - Reserved bytes (optional)	446 bytes
0x01BE (Byte 446) - 0x01FD (Byte 509)	Partition Table containing: - Partition Entry 1 (0x01BE) - Partition Entry 2 (0x01CE) - Partition Entry 3 (0x01DE) - Partition Entry 4 (0x01EE)	16x4 = 64 bytes
0x01FE (Byte 510) - 0x01FF (Byte 511)	Boot Signature values - Byte 510: 0x55 - Byte 511: 0xAA	2 bytes
		Total = 512 bytes

Volume Boot Record

• aka VBR, Volume boot Sector, Partition Boot Record or Partition Boot Sector
• Non-partitioned disk
  • VBR is first sector of disk
• Partitioned disk
  • MBR acts as first sector of the whole disk
  • VBR is first sector of individual partition
• The code in volume boot records is invoked either directly by the machine’s firmware (like BIOS) or indirectly by code in the MBR or a Boot Manager
• Code in the MBR and VBR is in essence loaded the same way
• https://en.wikipedia.org/wiki/Volume_boot_record

Extended Boot Record

• aka EBR, Extended Partition Boot Record
• It is first sector in Extended Partition
• It is identical to MBR but contains following in its partition table:
  • Partition 1: Link to Logical Partition
  • Partition 2: Link to next Extended Partition
  • Partition 3: Unused
  • Partition 4: Unused
• https://en.wikipedia.org/wiki/Extended_boot_record

GUID Partition Table Scheme

• uses GPT and ESP
• It is part of UEFI standard
• modern successor to MBR partitioning scheme
  • supports more than 4 primary partitions
  • only supports LBA
  • Total number of sectors are stored in 8 bytes

GUID Partition Table

• Protective MBR
  • loaded in RAM
  • only executed if booted via Compatibility Support Module (CSM)
• Primary GPT Header
  • Disk GUID
  • Disk size limit (Total LBAs in the disk starting from LBA 0 to the last LBA)
  • First and Last usable LBA
  • Contains CRC32 checksums for Header + Partition Entry Array to prevent corruption
• Each Partition entry = 128 bytes
• Partition Entry Array
  • 512/512e Drive
    • 1 LBA = 512 bytes = 4 partitions
    • Total LBAs = 32
    • Total = $4\cdot 32=128$ partition entries
  • 4Kn Drive
    • 1 LBA = 4096 bytes = 32 partitions
    • Total LBAs = 4
    • Total = $32\cdot 4=128$ partition entries
• Partition Entry (128 bytes)
  • Partition Type GUID (16 bytes)
    • ESP: C12A7328-F81F-11D2-BA4B-00A0C93EC93B
    • MSR: E3C9E316-0B5C-4DB8-817D-F92DF00215AE
    • Microsoft Basic Data: EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
      • Examples: NTFS, exFAT, FAT32
    • Linux Filesystem Data: 0FC63DAF-8483-4772-8E79-3D69D8477DE4
      • Examples: ext4, Btrfs, XFS
    • Linux swap: 0657FD6D-A4AB-43C4-84E5-0933C84B4F4F
    • Apple APFS Container: 7C3457EF-0000-11AA-AA11-00306543ECAC
  • Unique Partition GUID (16 bytes)
    • randomized unique ID
  • Starting LBA (8 bytes)
  • Ending LBA (8 bytes)
  • Attribute Flags (8 bytes)
    • Bit 0 = Boot/System
    • Bit 60 = Read-Only
    • Bit 62 = Hidden
  • Partition Name (72 bytes)
    • uses UTF-16 LE
    • max human readable characters = 36

LBA	Description
LBA 0	Protective MBR (Legacy)
LBA 1	Primary GPT Header
LBA 2 - LBA 33 (512 or 512e drive) LBA 2 - LBA 5 (4Kn drive)	Partition Entry Array = 128 partition entries

EFI System Partition

• Extensible Firmware Interface System Partition
• GPT Partition Type ID: C12A7328-F81F-11D2-BA4B-00A0C93EC93B
• MBR Partition Type ID: 0xEF
• Filesystem: FAT32
• Filesystem does not support symlinks
• ESP contains
  • Boot loaders
  • Kernel images of installed operating systems
  • Device driver files for hardware devices present in a computer and used by the firmware at boot time
  • System utility programs that are intended to be run before an OS is booted
  • Data files such as error logs
• Boot loader Locations
  • Fallback Boot loader: \EFI\BOOT\bootx64.efi
    • Generally a copy of main boot loader
    • Checked by the firmware if NVRAM boot entries are missing
  • Linux
    • Shim: \EFI\ubuntu\shimx64.efi
      • UEFI firmware looks for a signed boot loader in Secure Boot
      • Shim is a signed boot loader from Microsoft
      • It looks for grubx64.efi in the same directory it was executed from
    • GRUB2: \EFI\ubuntu\grubx64.efi
    • systemd-boot: \EFI\systemd\systemd-bootx64.efi
  • Windows
    • Windows Boot Loader: \EFI\Microsoft\Boot\bootmgfw.efi
  • macOS
    • This is not supported by Apple Silicon MacBooks
    • Instead iBoot is implemented across MacBooks, iPhones, iPads

UEFI

• Unified Extensible Firmware Interface
• Initially created by Intel but now under UEFI Forum
  • https://uefi.org/
• It replaces the legacy BIOS
• Boots faster than BIOS
• Defines
  • Secure Boot
  • UEFI Shell
  • NVRAM Variables
  • GUI and native mouse navigation support
  • support extensible drivers like PXE (Network Boot) or storage controllers (NVMe/RAID/AHCI)
• Uses Secure Boot by default and only loads signed boot loaders
• Stores boot priorities and state telemetry in non-volatile hardware storage (NVRAM)
  • accessible via /sys/firmware/efi/efivars on Linux
• NVRAM Boot Variables
  • BootOrder
    • A hexadecimal boot order sequence
  • BootXXXX
    • Human-readable device tag
    • Direct hardcoded structural entry path to the boot file on the ESP
    • Example: Boot0001, Boot0002