Master Boot Record (MBR) Partition Table
| Format | Master Boot Record (MBR) Partition Table |
|---|---|
| Short name | MBR |
| Category | filesystem |
| Platforms | Windows, macOS, Linux, iOS, Android, QNX |
| Crush support | Supported (RawImageVFS) |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The classic PC partition scheme in the first sector of a disk: boot code, a 4-byte disk signature at offset 440 (used by Windows to map volumes in the MountedDevices registry key), up to four primary partition entries and the 0x55AA boot signature. Further partitions chain through extended boot records. Each entry carries a type byte and a start and length in sectors; space outside every entry (before the first partition, between partitions, after the last) can hold remnants of earlier layouts. A GPT disk keeps a protective MBR with a single 0xEE entry.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 510 (0x1FE) | 55 AA | U. | Boot signature 0x55AA at the end of sector 0 (also present in FAT/NTFS boot sectors) |
Known extensions
None recorded
References
- Master Boot Record (MBR) partition table format (libyal/libvsmbr) https://github.com/libyal/libvsmbr/blob/main/documentation/Master%20Boot%20Record%20(MBR)%20partition%20table%20format.asciidoc
- ForensicsWiki — Master boot record https://forensics.wiki/master_boot_record/
- abrignoni/qnxprobe — MBR/GPT, LVM2 and filesystem reader for raw images (QNX6/QNX4, ETFS, EFS, ext2/3/4, F2FS, FAT32/16/12, exFAT, NTFS, HFS+, APFS, QNX IFS, SquashFS, JFFS2, UBI/UBIFS, YAFFS) https://github.com/abrignoni/qnxprobe
Cite this entry
Crush Format Reference, “Master Boot Record (MBR) Partition Table”. https://kalink0.github.io/crush-forensics/formats/mbr/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction