1

I take copy bytes dump using my Ubuntu os(MBR sector) following command.

dc3dd if=/dev/sda of=x cnt=1 ssz=512 hash=sha256 mlog=hashes

And I convert it to hexdump using following command.

hexdump x > hex_x

I receive out put like this .

enter image description here

I have some experts hep to analysis this hex_dump. I need to know what are the benefit of getting MBR hex dump and what kind of thing can be do using it ? (Eg: can I tell my system os like information analyzing this ? )

Need to know ,are there any commands or tools to more deep analyzing and convert this hexdump to human readable way ?

Community
  • 1
  • 1
uma
  • 1,477
  • 3
  • 32
  • 63

1 Answers1

2

Q. what are the benefit of getting MBR hex dump and what kind of thing can be done using it?

A. Microsoft says:

The MBR contains a small amount of executable code called the master boot code, the disk signature, and the partition table for the disk.

The master boot code and disk signatures aren't very useful for someone (investigator). However the partition table gives a lot of information, and it can be used to extract information, in scenarios, where OS is corrupted or not booting and MBR can be used to investigate disk drive and operating system.

Sample Partition Table Record: (taken from an MBR, using HEX editor)

80 20 21 00 07 7E 25 19 00 08 00 00 00 38 06 00

Each hexadecimal value has some specific meaning, for instance:

80 => Partition type, Active 

20 21 00 => Partition’s starting sector, Cylinder-Head-Sector (CHS)

07 => File System, NTFS

7E 25 19 => Partition’s ending sector, CHS

00 08 00 00 => Starting sector

00 38 06 00 => Size of the partition, 199 MiB

You can read them in detail in Table 1.2 Partition Table Fields, at official site.

Q. are there any commands or tools to more deep analyzing and convert this hexdump to human readable way?

A. You can use any HEX editor, like Hex Editor Neo or Active Disk Editor. These editors will help you in understanding MBR, but there is no magic tool available to to convert hexdump into human readable format (based on my knowledge).

PS: The question is pretty old, I wasn't available earlier so please accept late answer... :)

Atlas_Gondal
  • 2,512
  • 2
  • 15
  • 25