Pages

Tuesday, June 5, 2012

Parsing MBR

The Master Boot Record(MBR) contains the boot code and information about the partition table. It resides in the first 512 bytes (first sector) of a bootable disk.  The boot loader is in the first 446 bytes of MBR. A backup of MBR can help recover after a partition table corruption.
Some easy ways to understand MBR info and disk geometry:

Linux: dd + file commands

dd can be used to acquire the first sector of the bootable disk:
$ sudo dd if=/dev/sda of=mbr count=512
512+0 records in
512+0 records out
262144 bytes (262 kB) copied, 0.00553819 s, 47.3 MB/s

Information about partitions is obtained with file utility, that recognizes the dump as an MBR dump (by the MBR signature 0x55AA):
$ file mbr  
mbr: x86 boot sector; 
partition 1: ID=0x83, starthead 32, startsector 2048, 39061504 sectors; 
partition 2: ID=0x7, active, starthead 254, startsector 39070080, 44998065 sectors; 
partition 3: ID=0x83, starthead 254, startsector 84068145, 13671315 sectors; 
partition 4: ID=0x5, starthead 254, startsector 97739460, 214837245 sectors, code offset 0x63

In Windows:

Acquiring the MBR can be done with dd command (from UnxUtils):
>dd if=\\.\PhysicalDrive0 of=mbr count=1
1+0 records in
1+0 records out

Then, a small python script can be used to extract information, similar with file utility.

Other useful tools in Windows:
Information regarding disk geometry (Total Cylinders/Sectors/Tracks,  Sectors per Track, Tracks per cylinder) can be obtained with System Information utility from Windows:
System Information


The WinHex editor prints information about the first sector of every partition (provided also by file command):