Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Clarifications of the Hybrid MBR

Hello All,


I am in the process of trying to wrap my head around some details regarding a multi-boot setup with OS X Lion and Windows 7 on an early 2011 15" MacBook Pro.


Specifically, I am trying to get a clear understanding of a Hybrid MBR in relation to this. I have scoured this forum along with the Mac Rumors forums and to some extent the InsanleyMac forums. I have found a lot of info, but in some cases, the info is confusing because various sources seem to contradict each other.


I am looking for some details about the hybrid MBR and how it is actually created.


Below is what I have come to understand so far . . .


My questions are on BOLD . . . and indented . . .




Most of the sources explain that the hybrid MBR is a modified GPT Protective MBR.


"The protective MBR is an MBR that defines a single partition entry (of type 0xEE) that covers the entire area of the disk used by GPT structures and partitions. It is designed to prevent GPT-unaware programs from accidentally modifying a GPT disk." (Apple TN2166)


The MBR has space or slots for four partition entries (primary partitions) and in the case of the protective MBR only one is used to define the entire area of disk that is partitioned via GPT???



A hybrid MBR is a modified GPT protective MBR.


It uses up to three of the MBR's four primary partitions to point to the same space that's marked out by three GPT partitions. (The remaining MBR primary partition contains the EFI System Partition)


In the case of Lion, the Recovery HD accounts for one more of these partitions, leaving two that can point to GPT partitions????


I ran across a statement somewhere as follows: (can't remember the source at the moment . . .)


"As you may know, your drive has two partition tables. A GUID partition table and an MBR partition table. It's a hybrid scheme."


"When you use Disk Utility to add a FAT partition, say, it alters both partition tables."


The reference to TWO partition tables refers to a partition table contained within the protective MBR as well as the GPT partition tables???


Even without a "hybrid MBR" there are still two partition tables are there not??



If I understand the above correctly:


hybrid MBR refers to the fact that the four partition entries in the protective MBR now point to the same space as the first four GPT partitions. (There is no longer an entry in the protective MBR of type 0xEE that covers the entire area of the GPT partitioned disk . . .)



If anyone can point point to any other source for info like this I would appreciate it. My curiosity is now peaked. I have read the stuff on www.rodsbooks.com, which as a lot of good info but still does not answer the questions I pose above . . .

MacBook Pro (15-inch Early 2011), Mac OS X (10.7.3)

Posted on Mar 13, 2012 7:46 AM

Reply
9 replies

Mar 13, 2012 8:27 AM in response to John Kauble

The MBR has space or slots for four partition entries (primary partitions) and in the case of the protective MBR only one is used to define the entire area of disk that is partitioned via GPT?


Correct. That partition entry in the MBR is also assigned the partition type code EE or EF, to indicate it is an EFI disk.


In the case of Lion, the Recovery HD accounts for one more of these partitions, leaving two that can point to GPT partitions?


False.


The 10.7 Lion recovery partiton uses a GPT partition entry, with (per Wikipedia) the GUID 5265636F-7665-11AA-AA11-00306543ECAC. (Each different type of partition referenced by a partition table entry in a GPT has its own unique GUID assigned.)


No changes to the MBR are required to add the recovery partition, and the MBR can remain with a single protective partition.


The reference to TWO partition tables refers to a partition table contained within the protective MBR as well as the GPT partition tables?


It's quite possible for a tool or a user to get the MBR and GPT quite tangled, when something modifies the MBR and doesn't track the changes in the GPT. When conflicting address ranges are present, that then can lead to disk corruptions, of course.


Per the EFI specs, the protective MBR partition (and with partition type EE or EF) should typically cover the whole disk. This means the GPT has free use of the whole disk, other than the MBR block.


Even without a "hybrid MBR" there are still two partition tables are there not?


There are always two partition tables in a disk with a GPT. The MBR, and the GPT.


There's also a second use of the term "hybrid" in what you're citing, which may be confusing.


The hybrid scheme used within Boot Camp makes three general (and entirely related) adjustments to the two partition tables present. It configures the GPT to not cover the whole disk. It also adjusts the protective MBR partition entry for the EE or EF partition types to cover just what blocks the GPT partitioning references, and not the whole disk. And it uses one of the three remaining partition entries to reference the disk storage outside the GPT.


Now if Microsoft Windows 7 has the ability to share an GPT-partitioned disk and can avoid the shenanigans required with the "hybrid" MBR, then that's the way I'd look to use here. (And while I don't follow what Microsoft is up to here, I recall hearing that various recent Windows configurations could boot via EFI.) But failing that configuration, do use what Apple provides with the Boot Camp stuff.

Mar 23, 2012 2:47 PM in response to MrHoffman

No changes to the MBR are required to add the recovery partition, and the MBR can remain with a single protective partition.


Perhaps I worded my question incorrectly. I meant to say, in a MBR modified by Boot Camp or by formatting one of the partitions as MSDOS, the Recovery HD is one of the partitions that the modified MBR point to. When using fdisk to examine the MBR on my MacBook Pro (with Windows 7 installed) that includes a 10.7.3, Recovery HD, Windows 7, and data partition, ALL THREE are listed in the modified MBR. Therefore, in this case, the EFI partition and the Recovery HD take up two slots in the modified MBR leaving two possible locations for installing Windows 7 (depending on which one is formatted MSDOS - NTFS)







The hybrid scheme used within Boot Camp makes three general (and entirely related) adjustments to the two partition tables present. It configures the GPT to not cover the whole disk. It also adjusts the protective MBR partition entry for the EE or EF partition types to cover just what blocks the GPT partitioning references, and not the whole disk. And it uses one of the three remaining partition entries to reference the disk storage outside the GPT.


I did NOT use Boot Camp to create the Windows partition. I formatted my drive with Disk Utility and set the format for the desired Windows 7 partition to "MSDOS-FAT32" (later to be formatted NTFS by the Windows installer). I did this because I have a need to also boot 10.6.8 on another partition as well as wanting a separate partition for some data. The resulting MBR I got (based of running fdisk from Terminal), was the four entries in the MBR pointing to 1-EFI(disk0s1) 2-LION (disk0s2) 3-Recovery HD(disk0s3) 4-Windows 7(disk0s4). The data partition(disk0s5) is on slice 5 and does not appear in the modified MBR.


The point, more or less, of this exercise is to determine if triple booting in this manner will have any unintended consequences or if there is a compelling reason not to create the Windows partition in this manner rather than with Boot Camp. I know that the "hybrid MBR" can be dangerous. I am also aware that making any changes to partitions after the fact can damage the GPT/MBR or put them "out of sync".


I have been using a similar setup on an older MacBook Pro running 10.5 / 10.6 / Windows 7 with no problems for going to two years. The added Recovery HD in Lion added an extra twist which got me curious about what is going on "under the hood" and I took the time to do some exploring . . .

Mar 23, 2012 3:36 PM in response to John Kauble

A Master Boot Record (MBR) is an MBR. What's in the partitions referenced within the MBR matters not. NTFS or FAT, or ODS-2 or ODS-5, or if it's a GPT which itself contains partitions containing NTFS or FAT or ODS-2 or ODS-5 or whatever, it's all the same MBR structure.


If you're not familiar with indirection and pointers or similar programming constructs, these structures can all look rather cryptic. As for your question, find out. Run it for a while and find out if it's stable. See if it works. Look at the contents of the MBR and GPT data structures for the details of the particular configuration, too.


You're (already) somewhat on your own with this configuration, after all; it's not based on Boot Camp.


But you (also) have something that you can look at here, too.


I do not know what Microsoft Windows 7 has chosen to do with populating the structures here. You'll have to use the existing tools and look at the contents of your MBR and your GPT. (I don't run Microsoft Windows 7 here, but am familiar with other operating systems that do use the MBR and GPT structures.) (One tool that's built into OS X is the gpt tool. See man gpt at the Terminal.app prompt. There's probably a graphical display tool around somewhere on the 'net, too, but I haven't looked for one.)


On thinking about it, I don't entirely understand your question, either. Are you looking for some form of "absolution" here? If you "know that the "hybrid MBR" can be dangerous", then you should either spend some time to understand it in some detail - which usually involves looking at what you have configured now, and looking at available structure definitions, and testing to see whether a Windows or OS X upgrade might mess something up - or you should not use it. If you're looking for the safest choice here, then use Boot Camp and use the GPT, and follow what Apple has set up. That gets tested.


Irrespective of whether you use this hybrid MBR structure or not, keep backups of all of the operating systems, and preferably on volumes that are not hybrid-structured.

Apr 3, 2015 1:12 PM in response to John Kauble

On osx, not using Boot Camp, can anyone tell me how to convert an Ms Dos FAT GPT UEFI partition into an Windows NT filesystem (NTSF) GPT UEFI partition on a multi-boot osx?


Windows will do this while installing windows 7 on an Ms DOS GPT UEFI partition, but when it tries to do this while restoring its backup disk image to a fresh Ms Dos FAT GPT UEFI partition, it doesn't understand that partition table and destroys it by converting the whole drive back into an MBR Scheme. All osx partitons are then lost or misplaced and only one is left with just the windows partition.


I have been able to correct the destroyed misplaced gpt drive using gdisk, which fixes the problem simply, restoring it back to a normal GPT UEFI disk with its Hybrid MBR intact, (without any data loss), as well as the other 3 Mac osx Extended Journaled partitions.


I would just rather convert it up front, when I first partition the drive so that either Windows recognizes this while restoring its disk image, or maybe another software will be able to recognize it and be able to restore back to it.


I also would like to know if there is imaging software available that will create a backup image of the Windows 7 portion of the drive.

This software has to be capable of backing up and restoring to a Hybrid MBR, also known as a (Windows NT Filesystem (NTSF) on a GPT UEFI partition.


I would greatly appreciate it if anyone has any knowledge on this subject.


I have already been in touch with Rod Smith, author of gdisk and expert on Hybrid MBR's.


Thanks for any help on this.


Michael Breskin

michebre

Apr 4, 2015 2:23 PM in response to michebre

Windows will do this while installing windows 7 on an Ms DOS GPT UEFI partition, but when it tries to do this while restoring its backup disk image to a fresh Ms Dos FAT GPT UEFI partition, it doesn't understand that partition table and destroys it by converting the whole drive back into an MBR Scheme. All osx partitons are then lost or misplaced and only one is left with just the windows partition.

Well, your mistake was using windows backup.


I've had good luck with Clonezilla. It's based on Linux. I've only used it on simple MBR machines running Windows and Linux. I run it off of a bootable cd.


"Both MBR and GPT partition format of hard drive are supported. Clonezilla live also can be booted on a BIOS or uEFI machine. "

http://clonezilla.org/

Apr 4, 2015 4:10 PM in response to rccharles

RCCharles:


Thanks very much for your prompt reply.


In waiting for responses to my question concerning backing up Windows 7 on Hybrid MBR GPT, I just happen to do a test run this morning on a couple of test drives using clonezilla Live.


I had two identical drives with two partitions. One with windows and a blank partition for osx. I was only really concerned with the Windows 7 test partition at the moment. I use Carbon Copy Cloner for all of my osx partitions which works flawlessly.


I cloned the bootloader mbr from one drive to the other, and Clonezilla indicated it was a successful clone. I then cloned the Windows 7 system partition, to the other like partition of my test drive ,and again, Clonezilla indicated it was a successful clone.


When I tried to boot from the cloned drive it wouldn't boot. Being very familiar now with repairing Windows 7 boot loaders, I used the repair disk thinking all I have to do is repair the boot loader. I went to the command prompt in the repair disk, and executed "Bootsect /nt60 All /Force" which always repairs the boot loader when I restore the windows system image with Windows backup and restore utility. A very quick and easy fix.


I then use the Gdisk tool to repair the partitions back to a GPT drive which is a very quick and simple procedure that gets my GPT disk fully functioning again in osx. Thank you very much Rod Smith!, author of the gdisk tool and expert authority on Hybrid MBRs!


So far, this is the only backup and restore method I have been able to use that will consistently and successfully backup and restore my Windows 7 Hybrid MBR on a Yosemite Quadboot GPT UEFI Hackintosh.


I am very open to any other softwares out there that you think will work on my system.


I am also curious as to what platform you had success with using Clonezilla.


If you use Bootcamp, that is not an option for my Windows 7 osx platform.


Thanks very much for your suggestion. If you have any others I would greatly appreciate hearing them.


Regards,

Michael Breskin

(miche bre)

Apr 4, 2015 7:23 PM in response to michebre

Post issue in clonezilla forum. Authors seems responsive to issues.


http://sourceforge.net/p/clonezilla/discussion/Open_discussion/



I used the dd command to backup my mac system for awhile. Should work with any partition as long as your OS understands the partition structure.

# reduce the number of blocks that are backed up by making it ease to compress.

dd if=/dev/zero of=zero bs=1024k count=101


# can be a hassle to figure out the partition name. I used usually mount partition then unmount to see what changed. use df command?


# back up partition

dd if=/dev/disk0s10 bs=4096 | gzip | dd of=~/disk0-s10 bs=4096

# restore partition.

dd if=~/disk0-s10 bs=4096 | gunzip | dd of=/dev/disk0s10 bs=4096


# to find out how for along dd has gotten ( not sure of the why of double pids. )

sudo kill -s SIGINFO <pid> <pid> # get dd info

Apr 4, 2015 9:15 PM in response to rccharles

Thanks again RCCharles for your prompt response and interest and for referring me to the Clonezilla forum.

I will present my issue with Clonezilla there.


Are you running the dd commands from the Clonezilla prompt or from terminal in osx?


I am familiar with some very basic commands in osx terminal. I have just started today experimenting with Clonezilla and used it on auto mode today.


I am curious as to what platform you are running. Linux and Windows dual or Multiboot? osx and Windows, and Linux?


Macintosh, or Hackintosh. Are we allowed to discuss Hackintosh here?

Forgive me, I am new to this forum and don't want to break any rules here.


Thanks again for your interest.


Regards,

Michael Breskin

(miche bre)

Apr 5, 2015 12:09 PM in response to michebre

or Hackintosh. Are we allowed to discuss Hackintosh here?

Nothing that Apple does not approve. The word is mum. Several regular ASC members hang out here: http://x704.net/bbs/


I have an apple imac g3 600 with 9.22 & Tiger 10.4.11 & Ubuntu '96 and Lenovo T61 with Linux Fedora 21 & Windows XP dual boot. I use the dd command on my iMac. I have two external harddrives with Tiger on them. I run CCC and dd from the command line. I use Clonezilla on my T61. I'd use clonezilla if you can. It looks at the filesystem and avoids backing up unused blocks.


Robert

Clarifications of the Hybrid MBR

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple ID.