-1

According to the MBR strcuture definitions I have found, the partition table data should be within the bytes ranging from 446 to 510 of the first block of the disk. However, when I run:

sudo xxd -g 1 -u -l 512 /dev/sda1

I see that there is some BOOTMGR related text in those bytes instead of the partition definitions. Why is this? And where are the partitions defined?

Here is the output of the above command:

0000000: EB 52 90 4E 54 46 53 20 20 20 20 00 02 08 00 00  .R.NTFS    .....  
0000010: 00 00 00 00 00 F8 00 00 3F 00 FF 00 00 08 00 00  ........?.......  
0000020: 00 00 00 00 80 00 80 00 F8 17 03 00 00 00 00 00  ................  
0000030: C0 06 00 00 00 00 00 00 78 06 00 00 00 00 00 00  ........x.......  
0000040: F6 00 00 00 01 00 00 00 40 3C CD 9B 25 88 CF 01  ........@<..%...  
0000050: 00 00 00 00 FA 33 C0 8E D0 BC 00 7C FB 68 C0 07  .....3.....|.h..  
0000060: 1F 1E 68 66 00 CB 88 16 0E 00 66 81 3E 03 00 4E  ..hf......f.>..N  
0000070: 54 46 53 75 15 B4 41 BB AA 55 CD 13 72 0C 81 FB  TFSu..A..U..r...  
0000080: 55 AA 75 06 F7 C1 01 00 75 03 E9 D2 00 1E 83 EC  U.u.....u.......  
0000090: 18 68 1A 00 B4 48 8A 16 0E 00 8B F4 16 1F CD 13  .h...H..........  
00000a0: 9F 83 C4 18 9E 58 1F 72 E1 3B 06 0B 00 75 DB A3  .....X.r.;...u..  
00000b0: 0F 00 C1 2E 0F 00 04 1E 5A 33 DB B9 00 20 2B C8  ........Z3... +.  
00000c0: 66 FF 06 11 00 03 16 0F 00 8E C2 FF 06 16 00 E8  f...............  
00000d0: 40 00 2B C8 77 EF B8 00 BB CD 1A 66 23 C0 75 2D  @.+.w......f#.u-  
00000e0: 66 81 FB 54 43 50 41 75 24 81 F9 02 01 72 1E 16  f..TCPAu$....r..  
00000f0: 68 07 BB 16 68 70 0E 16 68 09 00 66 53 66 53 66  h...hp..h..fSfSf  
0000100: 55 16 16 16 68 B8 01 66 61 0E 07 CD 1A E9 6A 01  U...h..fa.....j.  
0000110: 90 90 66 60 1E 06 66 A1 11 00 66 03 06 1C 00 1E  ..f`..f...f.....  
0000120: 66 68 00 00 00 00 66 50 06 53 68 01 00 68 10 00  fh....fP.Sh..h..  
0000130: B4 42 8A 16 0E 00 16 1F 8B F4 CD 13 66 59 5B 5A  .B..........fY[Z  
0000140: 66 59 66 59 1F 0F 82 16 00 66 FF 06 11 00 03 16  fYfY.....f......  
0000150: 0F 00 8E C2 FF 0E 16 00 75 BC 07 1F 66 61 C3 A0  ........u...fa..  
0000160: F8 01 E8 08 00 A0 FB 01 E8 02 00 EB FE B4 01 8B  ................  
0000170: F0 AC 3C 00 74 09 B4 0E BB 07 00 CD 10 EB F2 C3  ..<.t...........  
0000180: 0D 0A 41 20 64 69 73 6B 20 72 65 61 64 20 65 72  ..A disk read er  
0000190: 72 6F 72 20 6F 63 63 75 72 72 65 64 00 0D 0A 42  ror occurred...B  
00001a0: 4F 4F 54 4D 47 52 20 69 73 20 6D 69 73 73 69 6E  OOTMGR is missin  
00001b0: 67 00 0D 0A 42 4F 4F 54 4D 47 52 20 69 73 20 63  g...BOOTMGR is c  
00001c0: 6F 6D 70 72 65 73 73 65 64 00 0D 0A 50 72 65 73  ompressed...Pres  
00001d0: 73 20 43 74 72 6C 2B 41 6C 74 2B 44 65 6C 20 74  s Ctrl+Alt+Del t  
00001e0: 6F 20 72 65 73 74 61 72 74 0D 0A 00 00 00 00 00  o restart.......  
00001f0: 00 00 00 00 00 00 00 00 80 9D B2 CA 00 00 55 AA  ..............U.  
ngonzalvez
  • 101
  • 3
  • There are various MBR formats, wikipedia has a good overview: [Master boot record](http://en.wikipedia.org/wiki/Master_boot_record). – Brian Jan 15 '15 at 16:42
  • All those formats reserve the same bytes for the partition table. My question is: why doesn't my MBR match any of the formats in Wikipedia? – ngonzalvez Jan 15 '15 at 17:27

2 Answers2

4

That's not the MBR.

Nor does the command you posted print the MBR. It asked for the boot sector of the first disk partition, not the MBR.

Try inspecting the first 512 bytes of /dev/sda if you want to see the MBR.

Michael Hampton
  • 244,070
  • 43
  • 506
  • 972
0

The answer provided by Michael Hampton is correct. The first 512 bytes of /dev/sda is not the same disk location as the first 512 of /dev/sda1. You can see this for yourself by using dd to extract each and cmp -l to compare them. The disk has a MBR; each partition has its own PBR; they are different. you have extracted the PBR of the partition, not the MBR of the disk.

Michael Martinez
  • 2,645
  • 3
  • 24
  • 35