Two weeks ago we encountered a blast from the past in the form of a rather old NAS unit that had failed requiring data recovery. The device was an Iomega NAS A300u and amongst other issues, the partitions had been damaged via a previous retrieval attempt (before it arrived at TRC, naturally).
The NAS was running a software RAID 5 and two of the three disks had failed due to degradation of their media. The prior recovery attempt had caused some data overwriting but the media seemed to be in fairly good condition. Having done a brief scan with some in-house developed tools, structures indicating UFS partitions was located but for some reason Disklabel partition tables were never added to our tools - I cannot even begin to figure out how or why UFS file system plugins were developed but we were unable to parse the partition table!
Having dealt with BSD Disklabels many moons ago, I decided that I needed to refresh my memory on their structure and update our tools to fully support Disklabel for future cases. This idea developed into the brief article before you, two weeks from now it will probably be forgotten again but at least my notes will be a little more comprehensive! As an initial stage, I created a Winhex template file which will enable you to investigate and manually edit Disklabel sectors; I have linked to at the bottom of the article, if you feel it might be of any use you are welcome to download it.
BSD Disklabel (which is also known as ‘bsdlabel’ in later verisons of FreeBSD) is a partitioning scheme for computer storage media. On modern BSD systems the Disklabel will normally be located at sector 1 within a 'slice'.
Slices within BSD are actually Master Boot Record (MBR) partitions (often known as DOS partitions in the BSD world), which contain the actual BSD partitions which are managed through Disklabel. The usage of a widely recognised scheme like MBR is a protective measure, preventing MBR aware utilities from misrecognising and repartitioning or otherwise damaging a BSD disk. Without MBR, DOS, Windows and other operating systems would not know that the BSD disk was partitioned and in use, something which could easily lead to user confusion and potentially damage.
So let's get down to the nitty-gritty. A Disklabel will take up 1 x 512 byte sector of a storage media. Bootcode normally surrounds the Disklabel sector, this boot code is located at sector 0 of the slice or partition but can then extend to sector 2 if necessary. The basic structure of the Disklabel sector is as follows:
A table describing the offset, size and content of the key areas of Disklabel can be found below, followed by a deeper look at the contents of the header and the structure of individual partition entries.
| ||148||Partition entry 1||Disklabel Partition entries||16|
| ||164||Partition entry 2||16|
|0xB4||180||Partition entry 3||16|
| ||196||Partition entry 4||16|
| ||212||Partition entry 5||16|
| ||228||Partition entry 6||16|
| ||244||Partition entry 7||16|
|0x104||260||Partition entry 8||16|
| ||276||Partition entry 9||16|
|0x124||292||Partition entry 10||16|
|0x134||308||Partition entry 11||16|
|0x144||324||Partition entry 12||16|
|0x154||340||Partition entry 13||16|
|0x164||356||Partition entry 14||16|
|0x174||372||Partition entry 15||16|
|0x184||388||Partition entry 16||16|
|Total size (bytes):||512|
The header of the Disklabel is necessary as it identifies characteristics and features of the media onto which the Disklabel is written,
The table below shows the BSD Disklabel header which takes up the first 147 bytes of the Disklabel structure. The header contains a Disklabel signature which aids in it’s visual identification, it also contains details of the type of media that it is written to and the physical geometry of that media. Much of this information is not relevant for modern ATA drives and will therefore be left blank. The table below highlights the purpose of each entry within the header but falls short of explaining each one as this is rarely relevant for modern systems.
| ||0||Signature||Hex: 0x57455682 ASCII: WEV||4|
| ||4||Drive type indicator byte||2|
| ||6||Drive subtype indicator byte||2|
|0x8||8||Drive type name||16|
| ||24||Pack identifier name||16|
| ||40||Size of a sector (bytes)||eg: Hex: 0200 Dec: 512||4|
| ||44||Number of tracks per sector||4|
| ||48||Number of tracks per cylinder||4|
| ||52||Number of cylinders per unit||4|
| ||56||Number of sectors per cylinder||2|
| ||60||Number of sectors per unit||4|
| ||64||Number of spare sectors per track||2|
| ||66||Number of spare sectors per cylinder||4|
| ||68||Number of alternate cylinders per unit||2|
| ||72||Disk rotational speed||2|
| ||74||Hardware sector interleave||2|
| ||76||Track Skew||2|
| ||78||Cylinder skew||2|
| ||80||Head switch time||4|
| ||84||Track to track seek time||4|
| ||92||Drive specific information||20|
| ||132||Disklabel signature||Hex: 0x57455682 ASCII: WEV||4|
| ||138||Number of partitions||Little endian||2|
| ||140||Size of boot area||4|
| ||144||Maximum size of file system super block||4|
|Total size (bytes):||148|
Beginning at offset 0x94 (148 decimal), are the individual partition entries. There can be up to 16 in total and any unused entries are simply left blank.
An individual entry will be 16 bytes in length and take the following form:
(relative to entry start)
|0||Size of partition ( in sectors, sector size is defined in header) - little endian||4|
|4||First sector - little endian||4|
|8||File system fragment size - not required||4|
|12||File System type - normally used but not required||1|
|13||File system fragments per block - not required||1|
|14||File system cylinders per group - not required||2|
|Total size (bytes):||16|
As shown in the table above, just like with an MBR based partition table, each Disklabel entry will also contain a system type flag. This is not always used and when it is it is often not specific to a file system type. A table of known partition types can be found below:
| ||Eighth edition|
| ||4.2BSD fast file system (FFS)|
| ||MSDOS (FAT variants)|
| ||4.4BSD (LFS)|
| ||OS/2 (HPFS)|
| ||CD-ROM (ISO9660)|
To aid with reading a BSD Disklabel, we have created a Winhex template file which you can download and use for free. Click the button below to get access and enjoy :-)Access your free download
3 Years, 6 Months, 1 Week, 6 Days, 11 Hours, 19 Minutes ago.
Spotted an error? Wish to make a request for more information? Get in touch with us here: Contact Us