Partition TableMaster Boot Record: Location | Real World Mac Maintenance and Backups

Partition Table/Master Boot Record: Location

This section explores how to locate the Master Boot Record (MBR) and partition table for any disk.

We start with the location of the MBR on a standard Linux core drive. Core drive implies the root, or primary drive, that the operating system resides on in this example. cfdisk, fdisk with expert mode, dd, and many other tools enable us to collect the partition data. For an IDE or SCSI drive, just type cfdisk -P rst /dev/device_file where r equals RAW, s equals SECTORS, and t equals TABLE. This tool provides a look at a clean drive, as shown in the following example:

[root@localhost root]# cfdisk -P rst /dev/hde Disk Drive: /dev/hde Sector 0: 0x000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x060: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x070: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x090: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x0F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x110: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x120: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x130: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x140: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x150: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x160: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x170: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x190: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1A0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1C0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1D0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1E0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0x1F0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA Partition Table for /dev/hde             First    Last  # Type     Sector   Sector   Offset  Length   Filesystem  Type (ID) Flags -- ------- -------- --------- ------ --------- ------------------ -------    Pri/Log        0 12594959       0#12594960  Free Space None (00) Partition Table for /dev/hde          ---Starting---      ----Ending----    Start Number of  # Flags Head Sect Cyl   ID  Head Sect Cyl     Sector  Sectors -- ----- ---- ---- ---- ---- ---- ---- ---- -------- ---------  1  0x00    0    0    0 0x00    0    0    0        0       0  2  0x00    0    0    0 0x00    0    0    0        0       0  3  0x00    0    0    0 0x00    0    0    0        0       0  4  0x00    0    0    0 0x00    0    0    0        0       0

Determining the start and end addresses of the partition table on the last example is rather easy because the drive is totally zeroed out. Bytes 1FE and 1FF with value "55 AA" are defined as the signature bytes (also known as the magic cookie) or standard word. These values define the end of the partition table and MBR. In this example, we cannot determine the exact starting point of the partition table without first determining the location of the signature bytes and counting backward.

The MBR contains two critical pieces of information: bootloader and partition table. Byte 01BE defines the start point of a partition table, though byte 0 defines the starting point of the MBR. In both cases, everything ends at byte 1FF.

In addition, cfdisk, fdisk, or any other tool will fail to control the drive without the signature word, as described previously with the value of "55 AA." When new disks are discovered, cfdisk or fdisk requests a label if the magic cookie is null. After the magic cookie is established, any of the previous tools will enable a user to define partitions of any type. Note that raw data access does not follow this restriction and is not part of this chapter.