An Examination of the
Windows™ 7
VBR ( Volume Boot Record )

[ Embedded in untfs.dll,
winsetup.dll and various other
System files
; see Introduction
]


Web Presentation and Text are Copyright©2012 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author !

Caution: This is a NEW page; it may contain errors.

This page examines the Windows™ 7 OS's Volume Boot Record (VBR); which we consider to be only the first sector of the system area at the beginning of a Win 7 OS volume. The BOOTMGR Loader code immediately following the VBR, spans across the boundaries of eight more: Seven full 512-byte sectors, plus 40 bytes at the beginning of the eighth sector. This structure is similar to the layout of the Windows XP VBR and its NTLDR Loader code. (Note: Every byte of the BOOTMGR Loader code is the same as that found after a Windows Vista VBR.)


Other Microsoft OS Volume Boot Records:
  An Examination of the Windows 95B/98/98SE/Me OS Boot Record (MSWIN4.1)
  An Examination of the Windows 2000/XP OS Boot Record (NTFS)
  An Examination of the Windows Vista OS Volume Boot Record (NTFS)

And Microsoft MBR pages:
  An Examination of the Standard MBR created by MS-DOS FDISK
  The MBR created by Windows 95B/98/98SE and ME's FDISK
  The MBR created by Windows 2000/XP/2003 Installs or Disk Management Utility
  The MBR created by Windows Vista OS Installs or Disk Management Utility

Confused? Send me an email if you have a specific question about the MBR or any Boot Records...

 

Just as we urged readers of our Win 7 MBR page to make a copy of their MBR sector, you may wish to create copies of your Win 7 VBR. Though more difficult to work with; considering all the details stored in this sector, there may come a time when you need/want to edit or replace this and other system sectors manually.

Some advice: Save all the data from the BIOS Parameter Block (BPB) area of the sector somewhere apart from your main hard disk or write it down on paper(!); it does no good to have data you might need to access your OS on the un-accessible HD itself! There are many ways you can do this... See our MBR Tools Page. Any good Disk Editor will allow you to manually enter data you've written down, or you can use a number of utility programs to save the binary data to a file on say a thumb drive, and later on restore the VBR and other sectors from the saved file(s).


Introduction

 Relative Sector 0 (within the Volume)

                                          NTFS BPB          "OEM ID"
                                              |                 |
         0  1  2  3  4  5  6  7  8  9  A  B  C| D  E  F         |
 0000:  EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00  .R.NTFS    .....
 0010:  00 00 00 00 00 F8 00 00 3F 00 FF 00[00 28 03 00] ........?.......
 0020:  00 00 00 00 80 00 80 00 FF CF FC 02 00 00 00 00  ..........?.....
 0030:  00 00 0C 00 00 00 00 00 02 00 00 00 00 00 00 00  ................
 0040:  F6 00 00 00 01 00 00 00 6B E5 F9 78 1A FA 78 EA  ........k..x..x.
 0050:  00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB 68 C0 07  .....3.....|.h..
 0060:  1F 1E 68 66 00 CB 88 16 0E 00 66 81 3E 03 00[4E  ..hf......f.>..N
 0070:  54 46 53]75 15 B4 41 BB AA 55 CD 13 72 0C 81 FB  TFSu..A..U..r...
 0080:  55 AA 75 06 F7 C1 01 00 75 03 E9 DD 00 1E 83 EC  U.u.....u.......
 0090:  18 68 1A 00 B4 48 8A 16 0E 00 8B F4 16 1F CD 13  .h...H..........
 00A0:  9F 83 C4 18 9E 58 1F 72 E1 3B 06 0B 00 75 DB A3  .....X.r.;...u..
 00B0:  0F 00 C1 2E 0F 00 04 1E 5A 33 DB B9 00 20 2B C8  ........Z3... +.
 00C0:  66 FF 06 11 00 03 16 0F 00 8E C2 FF 06 16 00 E8  f...............
 00D0:  4B 00 2B C8 77 EF B8 00 BB CD 1A 66 23 C0 75 2D  K.+.w......f#.u-
 00E0:  66 81 FB 54 43 50 41 75 24 81 F9 02 01 72 1E 16  f..TCPAu$....r..
 00F0:  68 07 BB 16 68 70 0E 16 68 09 00 66 53 66 53 66  h...hp..h..fSfSf
 0100:  55 16 16 16 68 B8 01 66 61 0E 07 CD 1A 33 C0 BF  U...h..fa....3..
 0110:  28 10 B9 D8 0F FC F3 AA E9 5F 01 90 90 66 60 1E  (........_...f`.
 0120:  06 66 A1 11 00 66 03 06 1C 00 1E 66 68 00 00 00  .f...f.....fh...
 0130:  00 66 50 06 53 68 01 00 68 10 00 B4 42 8A 16 0E  .fP.Sh..h...B...
 0140:  00 16 1F 8B F4 CD 13 66 59 5B 5A 66 59 66 59 1F  .......fY[ZfYfY.
 0150:  0F 82 16 00 66 FF 06 11 00 03 16 0F 00 8E C2 FF  ....f...........
 0160:  0E 16 00 75 BC 07 1F 66 61 C3 A0 F8 01 E8 09 00  ...u...fa.......
 0170:  A0 FB 01 E8 03 00 F4 EB FD B4 01 8B F0 AC 3C 00  ..............<.
 0180:  74 09 B4 0E BB 07 00 CD 10 EB F2 C3 0D 0A 41 20  t.............A 
 0190:  64 69 73 6B 20 72 65 61 64 20 65 72 72 6F 72 20  disk read error 
 01A0:  6F 63 63 75 72 72 65 64 00 0D 0A 42 4F 4F 54 4D  occurred...BOOTM
 01B0:  47 52 20 69 73 20 6D 69 73 73 69 6E 67 00 0D 0A  GR is missing...
 01C0:  42 4F 4F 54 4D 47 52 20 69 73 20 63 6F 6D 70 72  BOOTMGR is compr
 01D0:  65 73 73 65 64 00 0D 0A 50 72 65 73 73 20 43 74  essed...Press Ct
 01E0:  72 6C 2B 41 6C 74 2B 44 65 6C 20 74 6F 20 72 65  rl+Alt+Del to re
 01F0:  73 74 61 72 74 0D 0A 00 8C A9 BE D6 00 00 55 AA  start.........U.
         0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F    

Figure 1.


An Examination of the Assembly Code


Location of Error Messages and
Message Offsets in Memory


First Published: March 30, 2012. (30.03.2012).
Updated: March 28, 2012 (28.03.12), April 15, 2012 (15.04.2012).

Last Update: April 19, 2012. (19.04.2012)


You can write to me using this: online reply form. (It opens in a new window.)

The Starman's FREE TOOLS Page

MBR and Boot Records Index

The Starman's Realm Index Page

 

 

 

 

Hosted by uCoz