Comments on: Easy way to read MBR? http://www.miljan.org/main/2007/09/05/easy-way-to-read-mbr/ Wisdom is the key Thu, 28 Aug 2008 23:34:45 +0000 http://wordpress.org/?v=2.5 By: miljan http://www.miljan.org/main/2007/09/05/easy-way-to-read-mbr/#comment-714 miljan Wed, 05 Sep 2007 16:25:27 +0000 http://www.miljan.org/main/2007/09/05/easy-way-to-read-mbr/#comment-714 As we found out during our Jabber conversation, the problem seems to be in bad magic file your file command is using. <p class="code"># file vrzambr vrzambr: x86 boot sector, Microsoft Windows XP MBR, Serial 0x83988398; <br />partition 1: ID=0x7, active, starthead 1, startsector 63, 83971692 sectors; <br />partition 2: ID=0x83, starthead 254, startsector 83971755, 144585 sectors; <br />partition 3: ID=0x5, starthead 254, startsector 84116340, 541021005 sectors The weird thing here is that your file package is newer than mine. :) It skips NTFS partition and moves straight to the first Linux partition. I am not a big conspiracy fan, but this makes you think. :) BTW, I invite you to, as a guest author on this blog, write a small howto about reconstructing the MBR without having the backup. It could be very useful. :)</p> As we found out during our Jabber conversation, the problem seems to be in bad magic file your file command is using.

# file vrzambr
vrzambr: x86 boot sector, Microsoft Windows XP MBR, Serial 0×83988398;
partition 1: ID=0×7, active, starthead 1, startsector 63, 83971692 sectors;
partition 2: ID=0×83, starthead 254, startsector 83971755, 144585 sectors;
partition 3: ID=0×5, starthead 254, startsector 84116340, 541021005 sectors

The weird thing here is that your file package is newer than mine. :) It skips NTFS partition and moves straight to the first Linux partition. I am not a big conspiracy fan, but this makes you think. :)

BTW, I invite you to, as a guest author on this blog, write a small howto about reconstructing the MBR without having the backup. It could be very useful. :)

]]> By: random http://www.miljan.org/main/2007/09/05/easy-way-to-read-mbr/#comment-712 random Wed, 05 Sep 2007 15:22:11 +0000 http://www.miljan.org/main/2007/09/05/easy-way-to-read-mbr/#comment-712 <p class="code">$ hexdump -C -s 446 mbr 000001be 80 01 01 00 07 fe ff ff 3f 00 00 00 6c 4e 01 05 |........?...lN..| 000001ce 00 fe ff ff 83 fe ff ff ab 4e 01 05 c9 34 02 00 |.........N...4..| 000001de 00 fe ff ff 05 fe ff ff 74 83 03 05 4d 53 3f 20 |........t...MS? | 000001ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................| 000001fe 55 aa |U.| 00000200 $ file mbr mbr: x86 boot sector, Microsoft Windows XP MBR, Serial 0x83988398; <br />partition 2: ID=0x83, starthead 254, startsector 83971755, 144585 sectors; <br />partition 3: ID=0x5, starthead 254, startsector 84116340, 541021005 sectors Hmmm, why did it skip the info on partition 1 here? Also of interest would be a HOWTO on reconstructiong the MBR without a MBR backup (done that a couple of times), and to note that MBR backup won't save your logical partitions from oblivion.</p> $ hexdump -C -s 446 mbr
000001be 80 01 01 00 07 fe ff ff 3f 00 00 00 6c 4e 01 05 |……..?…lN..|
000001ce 00 fe ff ff 83 fe ff ff ab 4e 01 05 c9 34 02 00 |………N…4..|
000001de 00 fe ff ff 05 fe ff ff 74 83 03 05 4d 53 3f 20 |……..t…MS? |
000001ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |…………….|
000001fe 55 aa |U.|
00000200
$ file mbr
mbr: x86 boot sector, Microsoft Windows XP MBR, Serial 0×83988398;
partition 2: ID=0×83, starthead 254, startsector 83971755, 144585 sectors;
partition 3: ID=0×5, starthead 254, startsector 84116340, 541021005 sectors

Hmmm, why did it skip the info on partition 1 here?

Also of interest would be a HOWTO on reconstructiong the MBR without a MBR backup (done that a couple of times), and to note that MBR backup won’t save your logical partitions from oblivion.

]]>