The GPT Protective MBR and Partition Table by Daniel B. Sedory aka "thestarman" When a disk is initialized as GPT by Windows 7 (or Windows 8), the first sector (Absolute Sector 0) still contains the same boot code as a Windows 7 MBR initialized disk drive, but with this exception: The NT Disk Signature is set to zero ("00 00 00 00" as shown in Figure 1 below). Note, however, that connecting such a drive to a Windows XP (and perhaps others) PC, will result in an NT Disk Signature being assigned to the drive. The partition table contains only a single "GPT Protective" entry which in all cases is set to the maximum 32-bit limitation (even though a drive may have far less than a 2.2 TB capacity). The "GPT Protective MBR Sector" has exactly the same contents for all GPT disk drives created by the Windows 7 (or 8) OS. But, note: This does not follow the UEFI Specification, which states that the "SizeInLBA" should be "set to the size of the disk minus one" if it's not too large to be represented.[1] (GPT drives partitioned under various Linux and Apple® Mac OS systems do follow the UEFI Specification in this regard.) Figure 1. : Hexadecimal View of the GPT Protective MBR's Partition Table ------------------------------------------------------------------------ Offset: 0 1 2 3 4 5 6 7 8 9 A B C D E F 01B0: 65 6D 00 00 00 63 7B 9A 00 00 00 00 00 00 00 00 em...c{......... 01D0: 02 00 EE FF FF FF 01 00 00 00 FF FF FF FF 00 00 ................ 01E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 01F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA ..............U. Figure 2 shows how to interpret this 16-byte Partition Table entry in Figure 1: The first byte ("00") at offset 1BEh means not bootable (but this is only to ensure a legacy BIOS or OS will not attempt to boot from this drive; EFI/UEFI BIOS do not use this byte!), the next three bytes ("00 02 00") indicate the partition starts at CHS (0,0,2) or Absolute Sector 1 (this is where the GPT Header is located). The Partition Type byte at offset 1C2h ("EE") indicates this is a GPT partitioned disk. The next three bytes hold the CHS Ending values which were only used if the partition didn't end beyond 16,450,560 ectors (or about 8.4 GB). Otherwise, it was agreed to fill these bytes with "FE FF FF" (CHS values 1023, 254 and 63, for a total of: 1024 cylinders, 255 heads and 63 sectors); see our note on the MS-DOS Head Count Error for the reason all BIOS companies standardized the head count at 255 instead of 256. But here we have an 'FF' in every byte: FF FF FF". Though used only to ensure no legacy utility or OS will find any unpartitioned space on the disk, by always filling this field with 0xFFFFFF, the Windows 7 (or 8) OS is not following the UEFI Specification which states the EndingCHS should be "set to the CHS address of the last logical block on the disk" unless it's too large to be represented.[2] The next 4 bytes in the first GREEN box ("01 00 00 00") indicate the number of sectors which precede the partition (sometimes called "Relative Sectors"); so, one sector: The MBR. And the last 4 bytes ("FF FF FF FF") indicate a artition size of 4,294,967,295 sectors. As we mentioned above, Windows 7 always fills this field with 0xFFFFFFFF, even though the UEFI Specification states this should be "set to the size of the disk minus one" for drives under 2.2 TB. Figure 2. : GPT Partition Table ------------------------------- Absolute Sector 0 (Cylinder 0, Head 0, Sector 1) Starting loc Ending loc Relative Number of Type ID Boot Cyl Head Sec Cyl Head Sec Sectors Sectors GPT EE No 0 0 2 1023 255 63 1 4292967295 Partition table signature (0AA55h) : 0AA5H The GPT Header always begins with the 8-byte EFI "Signature" string: "45 46 49 20 50 41 52 54" (ASCII: "EFI PART"); declared in the UEFI Specification as the 64-bit Hex constant: "0x5452415020494645". The following table explains every byte in this Header: Figure 3. : Specifications for the GPT Header Sector ---------------------------------------------------- Offset (Hex) Length (bytes) Contents 000 8 Signature: Identifies this as an EFI-compatible GPT Header; must contain the ASCII string: "EFI PART" 008 4 Revision: Revision number for this header. This revision is not related to the UEFI Specification version. The current GPT Header version is still 1.00, so 0x00010000 (or "00 00 01 00") is the correct value. 00C 4 HeaderSize: Size in bytes; usually 92 (5Ch), the field being filled with: "5C 00 00 00". The UEFI Spec states this "must be greater than 92" (and should be the logical block size). But every drive we've examined does not follow the UEFI Specification here[4]. 010 4 HeaderCRC32: CRC32 of the GPT Header, with this field zeroed during calculation. ( In our example above, this is "C8 03 40 5B". See below: Calculating the CRC32 Checksums.) 014 4 Reserved; must be set to zero ("00 00 00 00"). 018 8 MyLBA: LBA location of this GPT Header. (Most often 0x0000000000000001.) 020 8 AlternateLBA: LBA address of the alternate GPT Header (i.e., the location of the backup copy of this header). Note: That EFI Header will have its own 'MyLBA' location and also its own CRC32 checksum, and if fact, will point to where this EFI Header is located in its 'AlternateLBA' field. [ In our example above, the "EF FF 3F 00 00 00 00 00" points to Sector 4194287.] 028 8 FirstUsableLBA: First usable LBA Sector for any partition; equal to: 1 + the last LBA Sector of the Primary GUID Partition Table. Most often Sector 34 (0x0000000000000022), which is "22 00 00 00 00 00 00 00" in our example above. 030 8 LastUsableLBA: Last usable LBA Sector for any partitions; equal to: The first LBA Sector of the Secondary Partition Table - 1. In our example above, this is Sector 4194254 ("CE FF 3F 00 00 00 00 00"). 038 16 DiskGUID: Disk GUID (Globally Unique IDentifier; also referred as UUID, UniversallyUID, on UNIXes) for this physical disk drive. In our example above this is the whole 16 byte string of "5E 86 90 EF D0 30 03 46 99 3D 54 6E B0 E7 1B 0D" (or 0x0d1be7b06e543d99460330d0ef90865e). 048 8 PartitionEntryLBA: Starting LBA of the array of GUID Partition entries; most often Sector 2 for the Primary Partition. ("02 00 00 00 00 00 00 00" in our example above.) 050 4 NumberOfPartitionEntries: Number of Partition Entries in the GUID Partition Entry array. Most often 0x00000080 (which is 128). 054 4 SizeOfPartitionEntry: Size, in bytes, of each GUID Partition Entry. This field should be set to a value of: 128 x 2n where n is an integer greater than or equal to zero (thus, although this is usually set to 128, it may also be 256, 512, etc.)[5]. 0x00000080 (80 hex) = 128. 058 4 PartitionEntryArrayCRC32: CRC32 of the GUID Partition Array. ("Starts at PartitionEntryLBA and is computed over a byte length of NumberOfPartitionEntries * SizeOfPartitionEntry.") In our example above, this is "1E C5 0F B7" (or 0xb70fc51e). 05C (BlockSize - 92) Reserved; the remainder of the block is reserved by UEFI and must be padded with zero bytes.