Getting and Examining your Master Boot Record

The Master Boot Record of a disk is, by definition, the first 512 bytes of that disk. If you have multiple hard disks installed, each has its own MBR. But the MBR of the "first" hard disk is the most important, because the computer is wired to look to that particular MBR as part of its booting process.

Boot into linux, as user root. Then find out how many hard disks your machine appears to have:

fdisk  -l

Note the naming of hard disks. They show up with names like "hda" for the first and "hbd" for the second, or maybe "sda" "sdb" etc. (It depends on the type of disk-- traditional ATA/IDE or more recent serialATA/SATA.)  How many disks do you have and what are their names?

Grab the first 512 bytes of your first disk and put them into a file.

dd  bs=512  count=1  if=/dev/sda  >  mbrcopy

The dd command syntax says to read input from the first disk (/dev/sda), taking 512 bytes at a time as the "block size" (bs=512), and doing that just one time (count=1), then diverting ( > ) the resulting 512 bytes into a file named "mbrcopy". You now have the content of the mbr stored in a file. There are utility programs that will read each byte from a file, figure out how to represent it in hexadecimal, and print them all out that way on the screen. Try either of these commands on your file:

xxd  -g1  mbrcopy

od  -Ad  -tx1z  mbrcopy

Relate what you see to the MBR content's layout as shown here;


Locate on your screen where the 446th byte (if the bytes are numbered, use the numbers, otherwise count; if they are numbered starting from 0 then the 446th one would be numbered "445" in decimal or "1BD" in hex). Locate the 16 bytes starting with the 447th, and the 16 thereafter, and the 16 thereafter, and the 16 thereafter, and the final 2 thereafter. It might be helpful to refer to this partition record diagram.

The assignment to perform

Print out this answer sheet. With the MBR dump in hex on the screen in front of you, fill in the blanks. Turn in the sheet at the end of the lab.