Philipp's Computing Blog

Success is about speed and efficiency

Have a look at your MBR using `dd`, `hexdump` and `file`

With two little tools (dd and hexdump) you can use your command line to inspect / investigate the master boot record of a hard disk.

The command is

sudo dd if=/dev/sda bs=512 count=1 | hexdump -C

where /dev/sda is the hard disk you want to inspect.

So here I provide an example of a USB stick I recently bought. It contains the master boot record:

philipp@lion:~$ sudo dd if=/dev/sdb bs=512 count=1 | hexdump -C
[sudo] password for philipp: 
1+0 records in
1+0 records out
512 bytes (512 B) copied, 4.8121e-05 s, 10.6 MB/s
00000000  eb 58 90 4d 53 44 4f 53  35 2e 30 00 02 08 22 00  |.X.MSDOS5.0...".|
00000010  02 00 00 00 00 f8 00 00  3f 00 ff 00 00 00 00 00  |........?.......|
00000020  00 00 f0 00 e3 3b 00 00  00 00 00 00 02 00 00 00  |.....;..........|
00000030  01 00 06 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000040  00 00 29 18 d1 63 80 4e  4f 20 4e 41 4d 45 20 20  |..)..c.NO NAME  |
00000050  20 20 46 41 54 33 32 20  20 20 33 c9 8e d1 bc f4  |  FAT32   3.....|
00000060  7b 8e c1 8e d9 bd 00 7c  88 4e 02 8a 56 40 b4 08  |{......|.N..V@..|
00000070  cd 13 73 05 b9 ff ff 8a  f1 66 0f b6 c6 40 66 0f  |..s......f...@f.|
00000080  b6 d1 80 e2 3f f7 e2 86  cd c0 ed 06 41 66 0f b7  |....?.......Af..|
00000090  c9 66 f7 e1 66 89 46 f8  83 7e 16 00 75 38 83 7e  |.f..f.F..~..u8.~|
000000a0  2a 00 77 32 66 8b 46 1c  66 83 c0 0c bb 00 80 b9  |*.w2f.F.f.......|
000000b0  01 00 e8 2b 00 e9 48 03  a0 fa 7d b4 7d 8b f0 ac  |...+..H...}.}...|
000000c0  84 c0 74 17 3c ff 74 09  b4 0e bb 07 00 cd 10 eb  |..t.<.t.........|
000000d0  ee a0 fb 7d eb e5 a0 f9  7d eb e0 98 cd 16 cd 19  |...}....}.......|
000000e0  66 60 66 3b 46 f8 0f 82  4a 00 66 6a 00 66 50 06  |f`f;F...J.fj.fP.|
000000f0  53 66 68 10 00 01 00 80  7e 02 00 0f 85 20 00 b4  |Sfh.....~.... ..|
00000100  41 bb aa 55 8a 56 40 cd  13 0f 82 1c 00 81 fb 55  |A..U.V@........U|
00000110  aa 0f 85 14 00 f6 c1 01  0f 84 0d 00 fe 46 02 b4  |.............F..|
00000120  42 8a 56 40 8b f4 cd 13  b0 f9 66 58 66 58 66 58  |B.V@......fXfXfX|
00000130  66 58 eb 2a 66 33 d2 66  0f b7 4e 18 66 f7 f1 fe  |fX.*f3.f..N.f...|
00000140  c2 8a ca 66 8b d0 66 c1  ea 10 f7 76 1a 86 d6 8a  |...f..f....v....|
00000150  56 40 8a e8 c0 e4 06 0a  cc b8 01 02 cd 13 66 61  |V@............fa|
00000160  0f 82 54 ff 81 c3 00 02  66 40 49 0f 85 71 ff c3  |..T.....f@I..q..|
00000170  4e 54 4c 44 52 20 20 20  20 20 20 00 00 00 00 00  |NTLDR      .....|
00000180  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001a0  00 00 00 00 00 00 00 00  00 00 00 00 0d 0a 52 65  |..............Re|
000001b0  6d 6f 76 65 20 64 69 73  6b 73 20 6f 72 20 6f 74  |move disks or ot|
000001c0  68 65 72 20 6d 65 64 69  61 2e ff 0d 0a 44 69 73  |her media....Dis|
000001d0  6b 20 65 72 72 6f 72 ff  0d 0a 50 72 65 73 73 20  |k error...Press |
000001e0  61 6e 79 20 6b 65 79 20  74 6f 20 72 65 73 74 61  |any key to resta|
000001f0  72 74 0d 0a 00 00 00 00  00 ac cb d8 00 00 55 aa  |rt............U.|
00000200

You will get an interpretation of the data using the Linux command file:

philipp@lion:~$ sudo dd if=/dev/sdb bs=512 count=1 of=mbr_usb.bin
philipp@lion:~$ file mbr_usb.bin 
mbr_usb.bin: x86 boot sector, code offset 0x58, OEM-ID "MSDOS5.0", sectors/cluster 8, 
reserved sectors 34, Media descriptor 0xf8, heads 255, 
sectors 15728640 (volumes > 32 MB) , FAT (32 bit), sectors/FAT 15331, 
serial number 0x8063d118, unlabeled

Interesting about it is that there are no valid partitions in the MBR. USB sticks often use the whole writable space for the file system without a partition.

My bootable hard disk drive on my Ubuntu machine contains some partitions too:

philipp@lion:~$ sudo dd if=/dev/sda bs=512 count=1 of=mbr.bin
philipp@lion:~$ file mbr.bin
mbr.tmp: x86 boot sector; GRand Unified Bootloader, 
stage1 version 0x3, stage2 address 0x2000, stage2 segment 0x200; 
partition 1: ID=0x83, active, starthead 1, startsector 63, 3903732 sectors; 
partition 2: ID=0x83, starthead 0, startsector 3903795, 58589055 sectors; 
partition 3: ID=0x83, starthead 254, startsector 62492850, 421481340 sectors; 
partition 4: ID=0x5, starthead 254, startsector 483974190, 1469545875 sectors, 
code offset 0x63

Resources

The Wikipedia entry on the master boot record states all the needed information to decipher the MBR.