Sponsoring website: Emergency Boot Kit



Detailed Notes on
Microsoft's™ FDISK.EXE
Program


Web Presentation and Text are Copyright © 2007 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author !


For information on the UNIX/Linux fdisk programs:   fdisk, sfdisk, cfdisk, etc., try the commands: "man fdisk" and "man sfdisk" (at your *nix console prompt).

For the FreeFDISK used by FreeDOS, You can try emulating the MS-DOS 4.xx, 5.xx, 6.xx, 7.0 and 7.1 versions of FDISK using FreeFDISK; or just use it as the official fdisk of FreeDOS.
   If you use
FreeFDISK to change a disk with a FAT32 file system, make sure that its Fdisk.ini file has its VERSION line set to: "W98".   But NOTE: there are still differences in how these FDISK programs function, the most important one being: FreeFDISK can not create an MBR with either the Standard or FAT32 Microsoft MBR code!  It uses its own 1-sector Boot manager called Booteasy instead.

A few other alternatives for the older MS-FDISK versions would be GDISK and GDISK32 from Norton Ghost, AEFDISK and the utility, Ranish Partition Manager, which can also format the partitions it creates (supports FAT12, FAT16 and FAT32).

 

Reference Guides for Master Boot Record pages:

  The Standard MBR created by versions of FDISK.EXE from MS-DOS 3.30 through Windows 95 (with MS-DOS 7.0)

  The MBR created by MS-Windows 95B, 98, 98SE (all three being MS-DOS 7.1) and WinME's (MS-DOS 8.0) FDISK


Here's another important page which describes exactly:
What Does MS-FDISK do to a Hard Disk Drive?


Index to this page:



Confused? If you have a specific question about the MBR, FDISK or Volume Boot Records, you can Send me an e-mail from here.

FDISK /MBR    (for all of you who wanted to know!)

No matter what version of FDISK you have (from MS-DOS 5.0 or higher that is), you can always enter the command: FDISK /? at a DOS prompt, and your Windows machine should respond with:

Configures a hard disk for use with MS-DOS.      [ Ah! And Windows too! ]

FDISK [/STATUS] /X

  /STATUS   Displays partition information.       [ A nice safe switch. ]
  /X        Ignores extended disk-access support. Use this switch if you
            receive disk access or stack overflow messages.
So, where's the /MBR switch? Well, that's the reason it's often called an undocumented switch! It's never displayed here; neither are any of the many others... But these various switches are documented in a number of Microsoft books and web pages... Especially in their Knowledge Base articles; see for example: FDISK /MBR Rewrites the Master Boot Record (Q69013) (which has a nice summary of what this switch does).

Basically, it will overwrite everything that's not part of the 64-byte Partition Table near the end of Absolute Sector 0 (the very first physical sector on a hard disk). But read on...

Over and over again you'll read or hear that FDISK /MBR destroys the Partition Table too! For example, here's a quote from another KB article:

First, reading the quote in context, shows that this applies only if  the Signature ID Word AA55h (or  55 AA  as seen in a disk editor) has been corrupted!  But beyond that, I can state that after having made several tests using the newer FDISK programs from Windows 95B, 98, 98SE and ME, that none of the FAT32 capable FDISK programs will ever zero-out Partition Table data; even if the Signature Word AA55h has been erased! {You should, of course, test that out yourself and always make a backup copy of your Partition Table.}
    However, it's also a proven fact that previous versions of FDISK (such as MS-DOS 6.22), will wipe out the Partition Table data with zero bytes under the same circumstances! So, it appears that Microsoft and others would rather err on the side of caution instead of telling customers it's OK to use the FDISK from, say a Win 98 boot disk, without worrying about losing their Partition Table data (if it's used correctly).

CAUTION: After stating all of the above, you still need to understand that FDISK /MBR may seldom be a cure for your own MBR problems! Why? Because it's almost always the Partition Table data itself that has been changed (such as the indicator showing which partition is Active; i.e., bootable). And if some type of multi-boot manager (which very often resides on more than just the first sector) should fail, FDISK /MBR might not help at all; UNLESS you kept a record of all the Partition Table data, and are capable of entering that data back into a Table of ALL zeros. Fortunately, there are some nice tools available (see below) to do that.

Conclusion:   Before you even have a problem that forces you to study about the MBR... Make a binary copy of your Master Boot Record and STORE it on two or more Floppy disks!
(
And make sure to UPDATE them whenever you make a change to it! Countless users have erased the most recent Partition Table data by allowing an Anti-Virus program to overwrite it with old data! IF you have Norton's AV, pay attention to that statement!)

I'd even suggest that you get yourself a disk editor and simply write the data down on paper! Once you have the raw data from your Partition Table and know how to use it*, you could completely erase a disk's MBR and restore it whenever you want to just for the fun of it... that is, if you have:

1)
a good floppy BOOT DISK (to boot up a computer), plus
2) a Disk Editor (to enter/change Partition Table data) and
3) FDISK.exe on it (it's much easier to use the FDISK /MBR command to place a copy of Microsoft's MBR code in the sector than entering it one byte at a time manually! But NOTE: FDISK's code may not be the same as that of your present MBR! For example, I use GRUB for multi-booting my system, so keep a copy of the whole MBR sector on a floppy diskette with a restore program. There's a nice utility called MBRWizard for doing just that; though PowerQuest's MBRUTILD might be easier for you to use.
)

(At the very least, MAKE SURE you have those three items before attempting to experiment with your MBR!)


[*Going over the other pages in this series about MBR/Boot Records should help you in acquiring the necessary knowledge.]




A Brief History of Major Changes in the FDISK Program

MS-DOS 3.3 - Although partitions still had a maximum capacity of 32MB, this version was the first to introduce Extended DOS partitions* (a maximum of 24 partitions using the drive letters C: through Z:). But, only two physical drives were supported at that time.

  Partition Type    Capacity ranges from    FAT type
  --------------    --------------------    --------
        01              0  through 15 MB     12-bit
        04           16 MB through 32 MB     16-bit
        05           Extended Partitions       N/A

____________
* Technically, MS-DOS 3.2 introduced an extended partition type first, but that version supported only one logical drive apart from the primary partition.

MS-DOS 4.0 - Partition sizes increased to a maximum capacity of 2.1 GB, but full use of these partitions required the MS-DOS program Share.exe to be loaded first. A new partition type (06) was added for partition sizes over 32 MB.

  Partition Type    Capacity ranges from    FAT type
  --------------    --------------------    --------
        06          32 MB through 2.1 GB     16-bit
MS-DOS 5.0 - The number of physical drives which could be accessed increased to eight. (Share.exe no longer required for large drives.) Although FDISK could still create only one Primary partition per physical drive, a little known fact is that support for more than one Primary MS-DOS partition was added to the MS-DOS 5.0 kernel.

We tested this out using a Windows install on a drive created with THREE Primary FAT32 partitions plus an Extended partition with four more Logical drives... both the Windows file Explorer and DOS mode had no problems reading and writing to all of these drive partitions. But you'll need a 'third-party' program to create a drive with more than one Primary partition since MS-FDISK still will not do so itself. Apart from the fact that FDISK jumbles your drive letters when doing this, we recommend you try this only as an experiment since we've heard a person having a disk with two FAT16 primary partitions had corrupt data after using it for some time; unfortunately, we have no details about how or why that happened.
      Even though FDISK is supposed to be aware of this possibility, for some reason it was programmed to assign drive letters to any 'Logical drives' in an Extended partition before a 2nd or 3rd primary partition. This is just plain faulty logic in my opinion; apparently a patch was added at some logical point in the program following the place where FDISK already decides that no more than one primary DOS partition can exist, then it goes back and 'tacks on' those drive letters later! Our test drive looked like this in FDISK:



You can clearly see three Primary DOS partitions on this drive, but
because of the logical drives in the Extended Partition they are
assigned the letters I: and J: rather than E: and F: (as seen below);


the letter D: having already been assigned to the first DOS partition of a second physical hard disk connected to the computer (both MS-DOS and Win9x make their drive letter assignments in ways that frustrate all of us!).



Versions of FDISK used in the Boot Record Studies:

   OS Type      Filename  File Size   Release  Date
 -----------   ---------  ---------  ---------------
 MS-DOS 3.30   FDISK.COM    48,919   07-24-87 12:00a
MS-DOS 4.01 FDISK.EXE 60,935 04-07-89 12:00a (Only 3 copies of the MBR code can be found inside FDISK prior to MS-DOS 5.0) MS-DOS 5.0 FDISK.EXE 57,224 11-11-91 5:00a MS-DOS 6.2 FDISK.EXE 29,334 09-30-93 6:20a
MS-DOS 6.22 FDISK.EXE 29,336 05-31-94 6:22a (MD5
checksum is: 1b7010dcc3b84db402744751da321da8)

Windows 95
(A) (MS-DOS 7.0) FDISK.EXE 59,128 07-11-95 9:50a
Windows 95B
(MS-DOS 7.1) FDISK.EXE 63,116 08-24-96 11:11a
Windows 98
(MS-DOS 7.1) FDISK.EXE 63,900 05-11-98 7:01p
(MD5
checksum is: cf1024be244cb51adddf9aeaa8199084)
Windows 98 SE (MS-DOS 7.1) FDISK.EXE 63,916 04-23-99 10:22p (MD5 checksum is: 7da2cc665c38784c555225b727f7660e)

Windows ME
(MS-DOS 8.0) FDISK.EXE 66,060 06-08-00 5:00p

[ Note: Windows NT/2000/XP OSs do not have an FDISK program; in order to partition a hard drive, they use what's called: the Disk Management MMC which is built into the OS; we'll have more to say about this below. ]

Notes that Apply to All Versions of FDISK examined here

All of the FDISK.EXE files are packed with at least one EXE packer. The older DOS files were also PKlite'd to further reduce the overall size since DOS was sold on floppy disks and users were still concerned about how little free space they had on their 250 to 500 MB drives. [ Details on how to unpack the files are available upon request. ]

Inside every FDISK program (from DOS version 5.0 or higher), there are nine duplicate copies of the code for the MBR. Why does FDISK need nine copies? If anyone knows for sure, please e-mail me so I can post the info here. (The FDISK in DOS 3.30 through 4.01 has only three copies of the MBR code inside it; even so, why more than one or at most two?)

For example, if you open either the Windows™98 (5-11-98) or  the Windows™ 98SE (4-23-99) version of FDISK.EXE in a Hex editor, you'll find all the code for 2nd through 9th copies of the MBR between offsets 54,762 (D5EAh) and 57,113 (DF19h). The 1st (first) copy of the code is located between offsets 53,718 (D1D6h) and 54,011 (D2FBh). The code is also in a 'packed form' let's say, since most of its zero bytes have been removed resulting in this:

If you compare the bytes 'highlighted in yellow' with those on my page "95BMEMBR.htm", you'll find that this is indeed the code section of an MBR plus the "Magic Number" of AA55h. There are also some extra bytes (underlined in the pic above) which may be related to how many zero-bytes are to be placed in which locations by the program.



NOTES on  MBR Error Message Creation :
Ever since the original version of Windows 95 (or '95A' if you prefer), none of the FDISK programs have included exact copies of the MBR code as they had in the MS-DOS versions! The differences though are only related to its error messages: none of the error messages appear in any of the nine copies of the MBR within the FDISK program.

Instead, the error messages which FDISK places into the nine MBR copies are all taken from a single location in the code. For Windows 95B, the text appears between 3b1ah and 3b6bh. For Win ME, it's between 3d39h and 3d8ah. And here's a pic of this portion of the code which is exactly the same for both Windows 98 and 98SE (and appears between offsets 3d35h and 3d86h:

  Note: The circled bytes (18h, 1Fh and 19h) are NOT part of the error messages;
they're used by the FDISK program to simply count the number of bytes which
follow that are to be copied to the final MBR code! For example, the first error
message is 24 (18h) bytes long; including the ASCII-Z Zero byte (00h) string terminator. [1Fh is 31 bytes, and 19h is 25 bytes.]


There are also two bytes in the nine copies of the MBR which are always changed when the code is finally written to the hard disk: For example, in the Windows 95A version of FDISK ( the Standard MBR ), these bytes are located at 074h and 079h (or 0674h and 0679h at execution time in memory). These are the bytes which are used as pointers to the 2nd and 3rd error messages, and both of them contain an 8Bh instead of the Standard MBR values of A3h and C2h. Thus, all three of the error msg. routines are pointing to the same byte where the error messages would normally begin; only there's nothing but zero bytes there (in its unpacked form that is) all the way from 8Bh to the MBR sector's signature ID of AA55h in these nine copies.

Perhaps, buried deep inside of the FDISK code, there's some way that the standard error messages can be changed under certain conditions... but trying to disassemble FDISK to determine this (something I might never be able to do anyway!), is not a task I really want to bother with. Someone from Europe once suggested that the reason for why they did this seemed rather obvious: Because of all the different languages that FDISK's error messages must be translated into (which vary in length from their original English versions). However, since the error messages for other languages are already contained in those versions of FDISK, just as they are in the English version, this does not really explain why all the extra code is necessary; code which would allow for the messages to be changed while the FDISK program is running!

In the past, I started to think that this extra programming might be related to the strange error messages I've seen in some Windows 98/98SE MBRs which contain the phrase, "Setup cannot continue." (see below), but there doesn't seem to be any relationship between the two. The odd error messages (and the removal of the third standard one!) always seem to be found in MBRs that were used by a CD-ROM install of Windows 98.
[ If you can shed any light on why these program routines were created and and how they are used, please send me an e-mail so I can post the info here. ]

For reference, here's the same area (as shown in the pic above) for the French version of Win98SE's FDISK:                1Bh = 27 decimal

4130  65 63 20 2F 43 4D 42 52 2E 0D 0A(1B)54 61 62 6C   ec /CMBR....Tabl
4140  65 20 64 65 20 70 61 72 74 69 74 69 6F 6E 20 65   e de partition e
4150  72 72 6F 6E 82 65 00(34)45 72 72 65 75 72 20 6C   rron.e.4Erreur l
4160  6F 72 73 20 64 75 20 63 68 61 72 67 65 6D 65 6E   ors du chargemen
4170  74 20 64 75 20 73 79 73 74 8A 6D 65 20 64 27 65   t du syst.me d'e
4180  78 70 6C 6F 69 74 61 74 69 6F 6E 00(20)53 79 73   xploitation. Sys
4190  74 8A 6D 65 20 64 27 65 78 70 6C 6F 69 74 61 74   t.me d'exploitat
41A0  69 6F 6E 20 6D 61 6E 71 75 61 6E 74 00 34 BD 04   ion manquant.4..

                       34h = 52 decimal   20h = 32 decimal
The circled bytes above (1Bh, 34h and 20h) will, of course, vary for other languages whenever the length of their error messages are different.


MS-DOS 5.0, 6.2 and 6.22

All three of these FDISK programs are packed with EXEPACK 5.31.009 (LINK 3.69), but the version 6 series is also PKlite'd (PKLITE 1.15). All three contain the phrase "MS Run-Time Library - Copyright (c) 1988"* . The DOS 5.0 program also contains the phrase "DOS Version 5.00 (C)Copyright 1981-1991" while each of the DOS 6 files contain: "DOS Version 6 (C)Copyright 1981-" with version 6.2 ending in 1993 and version 6.22 ending in 1994.

* One reader states concerning the phrases found above: This is a tell-tale sign that this program was compiled with Microsoft C 5.1. The newer version of EXEPACK was probably to avoid the bug that EXEPACKed programs do not load below 64K without relying on the 20-bit address wraparound.

The string of parameters which FDISK accepts on the command line looks like this inside all three of these FDISK files:
/PRI /EXT /LOG /Q /STATUS /? /MBR

Here's my page about all the other Undocumented FDISK.EXE Switches for DOS and Windows.



Windows 95(A)

Windows 95's FDISK contains the phrases: "MS Run-Time Library - Copyright (c) 1992"* and "MS-DOS Version 7 (C)Copyright 1981-1995"
The string of parameters is no different than that found in MS-DOS 6.2

* The same reader we quoted above, adds here: This is a sign that the program was compiled with Microsoft C 7.0 or
Visual C++ 1.x.

This version added support for two new partition types (0Eh and 0Fh) if the computer's BIOS had INT13 Extensions for the LBA (Logical Block Addressing) method of accessing the sectors on a large hard drive.

  Partition Type    Capacity ranges from    FAT type
  --------------    --------------------    --------
        0E          32 MB through 2.1 GB     16-bit
        0F           Extended Partitions       N/A

Windows 95B and 98

Both Windows 95B and 98 contain the same phrases and copyright dates as those found in Win 95, but here we have a half-dozen new switches that were added to the string of parameters which FDISK accepts on the command line! The string looks like this inside FDISK:
/PRI /EXT /LOG /PRIO /LOGO /Q /STATUS /? /MBR
/X /ACTOK /CMBR /FPRMT

Win 95 OSR2 and Windows 98 introduced two new partition types for the FAT32 file system:

  Partition Type    Capacity ranges from    FAT type
  --------------    --------------------    --------
        0B          512 MB - 2 terabytes     32-bit
        0C          512 MB - 2 terabytes     32-bit
Type 0Ch requires the computer's BIOS to support the LBA method of accessing large hard drive's using INT13 Extensions.

When you start FDISK, you'll be presented with the following notice:
Your computer has a disk larger than 512 MB. This version of Windows
includes improved support for large disks, resulting in more efficient
use of disk space on large drives, and allowing disks over 2 GB to be
formatted as a single drive.

IMPORTANT: If you enable large disk support and create any new drives on
this disk, you will not be able to access the new drive(s) using other
operating systems, including some versions of Windows 95 and Windows NT,
as well as earlier versions of Windows and MS-DOS.  In addition, disk
utilites that were not designed explicitly for the FAT32 file system will
not be able to work with this disk.  If you need to access this disk with
other operating systems or older disk utilities, do not enable large
drive support.

Do you wish to enable large disk support (Y/N)...........? [Y]

If you have an existing NTFS partition on your computer, you may also see the following:

Your computer has NTFS partitions which may require large drive
support. If you are using another operating system, such as
Windows NT, which supports large drives you should enable treating
these partitions as large. NOTE: If you answer Y and the
partition display looks incorrect or a hang or crash occurs
do nothing, run FDISK again, and answer N to this question.

Should NTFS partitions on all drives be treated as large (Y/N)? [Y]

Windows 98 SE (Second Edition)

Windows 98SE still contains the same Run Time phrase and Copyright dates as Windows 95, but one new switch was added near the end of the string of parameters inside FDISK: /XMBR

For some strange reason, many Windows 98 users who examine their MBR will find the phrase: "Setup cannot continue." added to the end of each of the first two standard MBR error messages; and the third message has been eliminated altogether... because, I assume, there is not enough empty space remaining!

From the small amount of data I've gathered so far, it appears that these messages are created directly from a Windows CD-ROM installation. I can only guess that this might happen when using an OEM version vs. the full Retail version, but don't have enough data to know for sure.

If you see this message in your MBR, and know for sure how your drive was first partitioned (by MS-FDISK from a Boot Diskette or from a CD-ROM and which version, etc.), then please send me the information. If you don't find these alternate 'error messages' in your own MBR at the present time, you might find them near the end of a file on your Win 98 drive called "SUHDLOG.DAT" (this is a Hidden, Read-only file in C:\ and the messages were in my file) which appears to be a record of the changes made to the MBR(s).


Windows ME (Millennium Edition)

Windows ME's FDISK contains the new phrase: "MS-DOS Version 8 (C)Copyright 1981-1999" Except for that, this FDISK program is essentially the same as the Windows 98SE version.

 

Windows 2000/XP/2003

As stated above (at the end of our "Versions" section), the Windows NT/2000/XP/2003 OSs do *not* contain any FDISK program; although you will find a copy of FORMAT.COM inside of any CMD or Command window (for use on floppy diskettes).
    If you wish to partition a hard drive for use by these or any other OS, you must run the Disk Management MMC "snap-in" tool in the Computer Management window; it's found under the item "Storage" (in a tree view). You can access "Disk Management" from the "Administrative Tools" menu; and must have Administrator privileges to use it.

NOTE: When using Windows 2000/XP to partition a drive, you should never use what are known as Dynamic Volumes; unless you have a very good reason for doing so!   The use of Basic Volumes will, for example, still allow you to access an NTFS partition from a special DOS boot diskette, whereas you can not do so if  it's a Dynamic volume!  At this time, Dynamic volumes can only be accessed by your Windows boot OS, and make data recovery much more difficult. Why? Because they move the MBR and other system structures to a different (and varying) location called a "private region database," and place a 42h byte in what is then called the 'legacy' MBR's Partition Table entry/entries for these volumes (to identify them and the disk as being Dynamic). For more information, see here. [ If you have Windows 2000/XP, then look up 'Disk Management' in the general HELP, and read about Dynamic disks and volumes in your OS's own Help file. ]

 




Links and References

Wayback Machine copy of: firmware.com/support/bios/fdisk.htm Notes on DOS FDISK Command.  READ THIS TEXT. A good article covering major versions of FDISK.exe and their peculiarities up to the beginning of the FAT32 file system. Unfortunately, the material was never updated beyond a problem with the first version of Windows 98 (text is dated: 04/22/1999).

MS-DOS Partitioning Summary (Q69912). A Knowledge Base article which briefly describes all of the MS-DOS and Windows partitions through Windows 98.


Dynamic vs. Basic Disk Storage in Windows XP (Q314343).
A Knowledge Base article briefly describing Dynamic Storage concepts and how it differs from that of "Basic" disks. You should also read "Upgrading the System or Boot Drive to Dynamic (Rooting)" (KB article Q222188).
See KB article: Q175761 for Windows 2000 Dynamic disks/volumes.


 

Last Update: 18 November 2007.

You can write to me using this: online reply form. (It opens in a new window.)

The Starman's FREE TOOLS Page

MBR and Boot Records Index

The Starman's Realm Index Page