LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 12-13-2007, 05:27 AM   #1
uncle-c
Member
 
Registered: Oct 2006
Location: The Ether
Distribution: Ubuntu 16.04.7 LTS, Kali, MX Linux with i3WM
Posts: 299

Rep: Reputation: 30
"Using dd to zero the MBR" query.


Hi there !
Was just wondering if some kind soul could clear this up for me.
I play around with a lot of linux distros as I am always inheriting lots of old machines. My bootloader of choice is always grub, however some installations use lilo and the method I often use to remove lilo is to zero the MBR. Now I have read on LQ that if I use the following command the boot code will be zero'd but the partition table remains intact :

Code:
# dd if=/dev/zero of=/dev/hda bs=446 count=1
Whereas
Code:
# dd if=/dev/zero of=/dev/hda bs=512 count=1
will zero everything including the partition table record.

So if the latter is used, am I correct in assuming that not only will the boot code be wiped but also any record of how the disk is partitioned and formatted ( Partition Table record ?). Hence, if I accessed this drive using a live CD I would not get a readout of all the partitons and their respective formats when performing fdisk -l ? If my assumption is wrong what would be the output if I did run fdisk -l on a drive with the 512 bytes zeroed ?

Thanks,
Uncle-C
 
Old 12-13-2007, 09:02 AM   #2
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Mint
Posts: 17,809

Rep: Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743
You've got it right. The second example erases the partition table and fdisk will report that the disk has no partitions.

Why erase the MBR when installing GRUB or LILO? Whatever you put in the MBR will simply overwrite what was there.
 
Old 12-13-2007, 09:32 AM   #3
uncle-c
Member
 
Registered: Oct 2006
Location: The Ether
Distribution: Ubuntu 16.04.7 LTS, Kali, MX Linux with i3WM
Posts: 299

Original Poster
Rep: Reputation: 30
Quote:
Originally Posted by pixellany View Post
You've got it right. The second example erases the partition table and fdisk will report that the disk has no partitions.

Why erase the MBR when installing GRUB or LILO? Whatever you put in the MBR will simply overwrite what was there.
Thanks a lot for the reply Pixellany. The above is exactly what I thought
but when trying to install GRUB to re-write over LILO I was getting L99 99 99 99 99 errors on boot up. When I done a hexdump to view my MBR it showed that fragments of LILO were still installed. The way I eventually got grub to install properly was to zero 446 bytes and then re-install it. I was installing SLAX on a spare partiton and it uses LILO as the bootloader and gives you no alternative but to load it into the MBR of hda and not in any specified partition.

Thanks again for the help !

uncle-c
 
Old 12-13-2007, 11:30 AM   #4
masterclassic
Member
 
Registered: Jun 2007
Distribution: Knoppix, antiX
Posts: 252

Rep: Reputation: 73
With all 512 bytes to 0, it must show the entire disk as unallocated space. Data aren't erased, so you could perhaps restore the deleted partitions using "testdisk".
But, if you put all the MBR to 0, then the disk label is deleted too.
 
Old 12-14-2007, 03:27 PM   #5
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Mint
Posts: 17,809

Rep: Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743
Quote:
Originally Posted by masterclassic View Post
With all 512 bytes to 0, it must show the entire disk as unallocated space. Data aren't erased, so you could perhaps restore the deleted partitions using "testdisk".
But, if you put all the MBR to 0, then the disk label is deleted too.
Not understanding this.....I have always assumed that the MBR was defined as the first sector---ie the first 512 bytes.

On my system, I just made a label using "e2label". Using dd, I found this in the 3rd sector of the partition**---nowhere near the 1st sector / MBR.

**specifically, at an offset of OX478 from the start of the partition. This is in the 63-sector zone that precedes the start of the real partition data.
 
Old 12-14-2007, 04:35 PM   #6
osor
HCL Maintainer
 
Registered: Jan 2006
Distribution: (H)LFS, Gentoo
Posts: 2,450

Rep: Reputation: 78
Quote:
Originally Posted by pixellany View Post
Not understanding this.....I have always assumed that the MBR was defined as the first sector---ie the first 512 bytes.
It is.
Quote:
Originally Posted by pixellany View Post
On my system, I just made a label using "e2label". Using dd, I found this in the 3rd sector of the partition**---nowhere near the 1st sector / MBR.
That’s because labeling a partition has nothing to do with the MBR. It is filesystem-specific (in this case ext2/3) and will undoubtedly affect whatever partition in which your filesystem resides.

As for masterclassic’s suggestion of using testdisk, you might instead backup and restore the partition table (and only the partition table).
 
Old 12-14-2007, 06:48 PM   #7
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,124

Rep: Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120Reputation: 4120
Quote:
Originally Posted by pixellany View Post
On my system, I just made a label using "e2label". Using dd, I found this in the 3rd sector of the partition**---nowhere near the 1st sector / MBR.
As osor explained, masterclassic said "disk label".
Don't know what [s]he meant by that, but I can think of two candidates. The id bytes that Windoze stuffs in there (and the rest of the world ignores), or the "signature" bytes at the end (last 2 bytes) of the first sector.
Neither is a major issue any more - [c]fdisk used to abort if they couldn't find the sig bytes, but that's no longer the case.

Personally I always try to leave the part table and sig bytes intact.
 
Old 12-15-2007, 04:47 AM   #8
masterclassic
Member
 
Registered: Jun 2007
Distribution: Knoppix, antiX
Posts: 252

Rep: Reputation: 73
Quote:
As osor explained, masterclassic said "disk label".
Don't know what [s]he meant by that, but I can think of two candidates. The id bytes that Windoze stuffs in there (and the rest of the world ignores), or the "signature" bytes at the end (last 2 bytes) of the first sector.
It is this last that I mean, the last 2 bytes, that make the system to understand that the disk is formatted for an intel architecture, or for spark architecture, or for power-pc, & so on. This is the "msdos signature", usually needed for Linux/x86. This means that the partition table has this specific structure of 4 primary partition entries.

I think that most manufacturers now sale their disks with this signature already written. Obviously, if we install Linux or another system on an empty disk, it writes this signature in order to proceed to the disk partitioning and format.

Of course, I always prefer to backup the MBR before any partitioning work, rather than recovering Testdisk is a tool we can use if something goes wrong. It is contained in several live cds, as in Gparted livecd (from the terminal), and I think in the Ultimate Boot cd.
 
  


Reply

Tags
boot, dd, master, mbr, partition, record, table



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
OpenOffice install query: no such "soffice" found ic_torres Linux - Software 4 08-13-2007 05:46 AM
LXer: Hlstats "killLimit" Parameter Handling Remote SQL Query Injection ... LXer Syndicated Linux News 0 12-29-2006 07:54 PM
KPPP "Query Modem" returns empty fields ananya Linux - Hardware 2 02-21-2005 10:50 PM
KPPP "Query Modem" returns empty fields ananya Linux - Software 1 02-21-2005 10:39 PM
Will "grub-install /dev/hda" kill Windows XP MBR? Zullocrit Linux - Newbie 3 09-25-2004 09:50 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie

All times are GMT -5. The time now is 02:58 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration