Sponsored by:

Fully Managed Technology Services

 

An Examination of the
Windows Vista
VBR ( Volume Boot Record )
or Boot Sector

[ Embedded in untfs.dll,
winsetup.dll and various other
System files
; see Introduction
]


Web Presentation and Text are Copyright©2009, 2012, 2015 by Daniel B. Sedory
NOT to be reproduced in any form without Permission of the Author !

This page examines Windows™ Vista's Volume Boot Record (VBR); which we consider to be only the first sector of the system area at the beginning of a Vista OS volume. The BOOTMGR Loader code, immediately following the VBR, spans across the boundaries of eight more sectors: Seven full 512-byte sectors, plus 40 bytes at the beginning of the eighth sector. This structure is quite similar to the layout of the Windows XP VBR and its NTLDR Loader code.


Other Microsoft OS Volume Boot Records:
  An Examination of the Windows 95B/98/98SE/Me OS Boot Record (MSWIN4.1)
  An Examination of the Windows 2000/XP OS Boot Record (NTFS)
  An Examination of the Windows 7 OS Volume Boot Record (NTFS)
  A Comparison of Windows™ Vista, 7 and 8 VBR Code

And Microsoft MBR pages:
  An Examination of the Standard MBR created by MS-DOS FDISK
  The MBR created by Windows 95B/98/98SE and ME's FDISK
  The MBR created by Windows 2000/XP/2003 Installs or Disk Management Utility
  The MBR created by Windows 7 OS Installs or Disk Management Utility

Confused? Send us an email if you have a specific question about the MBR or any Boot Records...

 

Just as we urged readers of our Vista MBR page to make a copy of their MBR sector, you may wish to create copies of your Vista VBR. Though more difficult to work with; considering all the details stored in this sector, there may come a time when you need/want to edit or replace this and other system sectors manually.

Some advice: Save all the data from the BIOS Parameter Block (BPB) area of the sector somewhere apart from your main hard disk or write it down on paper(!); it does no good to have data you might need to access your OS on the un-accessible HD itself! There are many ways you can do this... See our MBR Tools Page. Any good Disk Editor will allow you to manually enter data you've written down, or you can use a number of utility programs to save the binary data to a file on say a thumb drive, and later on restore the VBR and other sectors from the saved file(s).


Introduction

 Relative Sector 0 (within the Volume)

                                          NTFS BPB          "OEM ID"
                                              |                 |
         0  1  2  3  4  5  6  7  8  9  A  B  C| D  E  F         |
 0000:  EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00  .R.NTFS    .....
 0010:  00 00 00 00 00 F8 00 00 3F 00 FF 00[00 08 00 00] ........?.......
 0020:  00 00 00 00 80 00 80 00 FF EF 3F 01 00 00 00 00  ..........?.....
 0030:  04 00 00 00 00 00 00 00 FF FE 13 00 00 00 00 00  ................
 0040:  F6 00 00 00 01 00 00 00 6B E5 F9 78 1A FA 78 EA  ........k..x..x.
 0050:  00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB 68 C0 07  .....3.....|.h..
 0060:  1F 1E 68 66 00 CB 88 16 0E 00 66 81 3E 03 00[4E  ..hf......f.>..N
 0070:  54 46 53]75 15 B4 41 BB AA 55 CD 13 72 0C 81 FB  TFSu..A..U..r...
 0080:  55 AA 75 06 F7 C1 01 00 75 03 E9 D2 00 1E 83 EC  U.u.....u.......
 0090:  18 68 1A 00 B4 48 8A 16 0E 00 8B F4 16 1F CD 13  .h...H..........
 00A0:  9F 83 C4 18 9E 58 1F 72 E1 3B 06 0B 00 75 DB A3  .....X.r.;...u..
 00B0:  0F 00 C1 2E 0F 00 04 1E 5A 33 DB B9 00 20 2B C8  ........Z3... +.
 00C0:  66 FF 06 11 00 03 16 0F 00 8E C2 FF 06 16 00 E8  f...............
 00D0:  40 00 2B C8 77 EF B8 00 BB CD 1A 66 23 C0 75 2D  @.+.w......f#.u-
 00E0:  66 81 FB 54 43 50 41 75 24 81 F9 02 01 72 1E 16  f..TCPAu$....r..
 00F0:  68 07 BB 16 68 70 0E 16 68 09 00 66 53 66 53 66  h...hp..h..fSfSf
 0100:  55 16 16 16 68 B8 01 66 61 0E 07 CD 1A E9 6A 01  U...h..fa.....j.
 0110:  90 90 66 60 1E 06 66 A1 11 00 66 03 06 1C 00 1E  ..f`..f...f.....
 0120:  66 68 00 00 00 00 66 50 06 53 68 01 00 68 10 00  fh....fP.Sh..h..
 0130:  B4 42 8A 16 0E 00 16 1F 8B F4 CD 13 66 59 5B 5A  .B..........fY[Z
 0140:  66 59 66 59 1F 0F 82 16 00 66 FF 06 11 00 03 16  fYfY.....f......
 0150:  0F 00 8E C2 FF 0E 16 00 75 BC 07 1F 66 61 C3 A0  ........u...fa..
 0160:  F8 01 E8 08 00 A0 FB 01 E8 02 00 EB FE B4 01 8B  ................
 0170:  F0 AC 3C 00 74 09 B4 0E BB 07 00 CD 10 EB F2 C3  ..<.t...........
 0180:  0D 0A 41 20 64 69 73 6B 20 72 65 61 64 20 65 72  ..A disk read er
 0190:  72 6F 72 20 6F 63 63 75 72 72 65 64 00 0D 0A 42  ror occurred...B
 01A0:  4F 4F 54 4D 47 52 20 69 73 20 6D 69 73 73 69 6E  OOTMGR is missin
 01B0:  67 00 0D 0A 42 4F 4F 54 4D 47 52 20 69 73 20 63  g...BOOTMGR is c
 01C0:  6F 6D 70 72 65 73 73 65 64 00 0D 0A 50 72 65 73  ompressed...Pres
 01D0:  73 20 43 74 72 6C 2B 41 6C 74 2B 44 65 6C 20 74  s Ctrl+Alt+Del t
 01E0:  6F 20 72 65 73 74 61 72 74 0D 0A 00 00 00 00 00  o restart.......
 01F0:  00 00 00 00 00 00 00 00 80 9D B2 CA 00 00 55 AA  ..............U.
         0  1  2  3  4  5  6  7  8  9  A  B  C  D  E  F

Figure 1.


An Examination of the Assembly Code


Location of Error Messages and
Message Offsets in Memory


First Published: August 16, 2009. (16.08.09).
Updated: October 3, 2010. (03.10.10); March 30, 2012 (30.03.2012); May 1, 2015 (01.05.2015).

Last Update: June 1, 2015. (01.06.2015)


You can write to me using this: online reply form. (It opens in a new window.)

The Starman's FREE TOOLS Page

MBR and Boot Records Index

The Starman's Realm Index Page