How to read MBR in linux

root's picture


In OSX there is a simple feature in fdisk command which allows you to read and edit the MBR but I am not going into details because it is not the subject of this article.

osx:~ root#  fdisk -e /dev/disk0
Enter 'help' for information
fdisk: 1> print
Disk: /dev/disk0	geometry: 65270/255/63 [1048576000 sectors]
Offset: 0	Signature: 0xAA55
         Starting       Ending
 #: id  cyl  hd sec -  cyl  hd sec [     start -       size]
------------------------------------------------------------------------
 1: EE 1023 254  63 - 1023 254  63 [         1 - 1048575999] <Unknown ID>
 2: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 3: 00    0   0   0 -    0   0   0 [         0 -          0] unused      
 4: 00    0   0   0 -    0   0   0 [         0 -          0] unused


Unfortunately, in linux you don't have this luxury.
On a previous article I gave you some examples of how to save MBR, among other useful backup/restore methods.
Today I will show you the easiest way to display its contents.

This is my MBR file. As you can see, it is 512b in size:

core:img# ls -la backup-sda.mbr
-rw-r--r-- 1 root root 512 2009-12-12 06:30 backup-sda.mbr

Now let's display its contents:

core:img# file backup-sda.mbr
backup-sda.mbr: x86 boot sector; GRand Unified Bootloader, stage1 version 0x3, stage2 address 0x2000, stage2 segment 0x200; partition 1: ID=0xfd, active, starthead 1, startsector 63, 514017 sectors; partition 2: ID=0xfd, starthead 0, startsector 514080, 97659135 sectors; partition 3: ID=0xfd, starthead 254, startsector 98173215, 1366970850 sectors

Igh, ugly... let's tune up the output with sed :)

core:img# file backup-sda.mbr | sed 's/; /;\n/g'
backup-sda.mbr: x86 boot sector;
GRand Unified Bootloader, stage1 version 0x3, stage2 address 0x2000, stage2 segment 0x200;
[color=green]partition 1: ID=0xfd, active, starthead 1, startsector 63, 514017 sectors;[/color]
partition 2: ID=0xfd, starthead 0, startsector 514080, 97659135 sectors;
partition 3: ID=0xfd, starthead 254, startsector 98173215, 1366970850 sectors

Better. To make you understand a bit those lines, following is the output of my booting disk:

core:img# fdisk -l /dev/sda

Disk /dev/sda: 750.1 GB, 750156374016 bytes
255 heads, 63 sectors/track, 91201 cylinders
Units = cylinders of 16065 * 512 = 8225280 bytes
Disk identifier: 0x000c0cc0

   Device Boot      Start         End      Blocks   Id  System
[color=green]/dev/sda1   *           1          32      257008+  fd  Linux raid autodetect[/color]
/dev/sda2              33        6111    48829567+  fd  Linux raid autodetect
/dev/sda3            6112       91201   683485425   fd  Linux raid autodetect

The first partition listed in MBR is the bootable partition (notice the active flag) and the number of sectors is telling you the size of your partition, number comparable with the "Blocks" value from fdisk output, if you divide it by 2:

core:img# echo | awk '{print 514017/2}'
[color=green]257008[/color]

That's pretty much it! For now...

Thou shalt not steal!

If you want to use this information on your own website, please remember: by doing copy/paste entirely it is always stealing and you should be ashamed of yourself! Have at least the decency to create your own text and comments and run the commands on your own servers and provide your output, not what I did!

Or at least link back to this website.

Recent content