MBR partitioning, and content after partition table but before first partition
On 03/08/2017 03:02 AM, Thomas Schmitt wrote:
David Christensen wrote:
AFAIK when using MBR partitioning, the partition table (blocks 0-62)
The MBR partition table resides in the first 512-bytes block.
It may be extended by a chain of partitions starting at the Extended
Partition of the MBR partition table.
The EBRs of the logical partitions are stored at the start of those
partitions. I.e. scattered over the storage medium.
Okay.
Examining a Windows XP disk, the first partition (C:\) starts at block
63 (track 1):
$ cat windows-xp-parted-u-s-p.out
Model: ATA WDC WD800JB-00FM (scsi)
Disk /dev/sdb: 156301488s
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Number Start End Size Type File system Flags
1 63s 156296384s 156296322s primary ntfs boot
$ cat windows-xp-parted-u-chs-p.out
Model: ATA WDC WD800JB-00FM (scsi)
Disk /dev/sdb: 9729,80,62
Sector size (logical/physical): 512B/512B
BIOS cylinder,head,sector geometry: 9729,255,63. Each cylinder is 8225kB.
Partition Table: msdos
Number Start End Type File system Flags
1 0,1,0 9728,254,62 primary ntfs boot
Blocks 1-62 should probably be zeros, but it appears Norton Ghost 2003
marked this drive:
$ dd if=windows-xp-blocks-0-62.img 2>/dev/null | hexdump -C | tail -n 12
000001f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 aa
|..............U.|
00000200 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|................|
*
00007c00 12 91 f2 60 90 a0 2f 19 01 00 00 00 85 00 67 68
|...`../.......gh|
00007c10 46 44 23 cc 22 52 1d ac 22 52 32 4e 6f 72 74 6f
|FD#."R.."R2Norto|
00007c20 6e 20 47 68 6f 73 74 20 32 30 30 33 00 00 00 00 |n Ghost
2003....|
00007c30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|................|
*
00007c90 00 00 00 00 00 00 00 04 00 94 2d d0 80 00 00 00
|..........-.....|
00007ca0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|................|
*
00007e00
Examining a Jesse system drive, the first partition starts at block 2048
(1 MB = 2**20 bytes):
2017-03-08 21:30:04 root@jesse ~
# parted /dev/sda u s p
Model: ATA SAMSUNG SSD UM41 (scsi)
Disk /dev/sda: 31277232s
Sector size (logical/physical): 512B/512B
Partition Table: msdos
Disk Flags:
Number Start End Size Type File system Flags
1 2048s 976895s 974848s primary ext4 boot
2 976896s 1953791s 976896s primary
3 1953792s 28125183s 26171392s primary
There is content in the first 101 blocks (1 MBR plus 100 other):
2017-03-08 21:30:06 root@jesse ~
# dd if=/dev/sda count=2048 2>/dev/null | hexdump -C | tail
0000c990 b0 b3 2c fa a4 38 f1 f8 77 f0 2d dd c2 4a a4 a9
|..,..8..w.-..J..|
0000c9a0 cd 43 15 5a b7 43 1e 6b 8b 01 ad 6f a0 b9 63 fd
|.C.Z.C.k...o..c.|
0000c9b0 b8 59 4d 69 f4 33 d4 f4 0a c1 d0 61 df 84 a9 74
|.YMi.3.....a...t|
0000c9c0 64 44 ae 2d de bc c5 de 73 90 d8 94 ef b2 5a 7c
|dD.-....s.....Z||
0000c9d0 fe 4c ee d8 a0 d7 ce ae 28 72 cc 5b 7e 05 23 ee
|.L......(r.[~.#.|
0000c9e0 39 d0 44 7a 1c 0a 10 ab e4 f6 3b 6f 43 d1 e6 92
|9.Dz......;oC...|
0000c9f0 11 0b 3f ec c4 cf b1 ab 81 b9 5b 77 d8 be 90 c6
|..?.......[w....|
0000ca00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
|................|
*
00100000
What is in blocks 1-101?
David
Reply to: