LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   information in partition table with dd (https://www.linuxquestions.org/questions/linux-newbie-8/information-in-partition-table-with-dd-662897/)

ufmale 08-14-2008 10:37 PM

information in partition table with dd
 
I use dd to view MBR partition table on my computer that has 3 partitions. I can see all the information such as beginning blocks and size of each partition, where each of the partition has 16 bytes.
The cmd I use was
$ dd if=/dev/sda bs=512 count=1 | od -x

Now, I am try to use dd on each partition: sda1, sda2, and sda3.
$ dd if=/dev/sda1 bs=512 count=1 | od -x

What information is the partition table? Is it useful?

I am trying to fix a problem with one of my partition disappear, but I want to understand what information is available first.

Thank you in advance

syg00 08-15-2008 12:38 AM

For primary partitions, all the relevant data is in the partition table in the first sector on the disk. Which you've already found.
There is no other pertinent (size) info in the partition itself.

Logical partitions are a linked list, and a (pseudo) partition table does exist at the start of each (logical) partition. There are several references on the web, but are probably only of educational benefit if you are dealing with primary partitions.

pixellany 08-15-2008 05:28 AM

Here is a portion of the output from fdisk for my system (u option to display in sectors):
Code:

Device Boot      Start        End      Blocks  Id  System
/dev/sda1  *          63    30716279    15358108+  7  HPFS/NTFS
/dev/sda2        30716280    32756534    1020127+  82  Linux swap / Solaris
/dev/sda3        32756535    49142834    8193150  83  Linux
/dev/sda4        49142835  197503109    74180137+  5  Extended
/dev/sda5        49142898    71569574    11213338+  83  Linux
/dev/sda6        71569638    91104614    9767488+  83  Linux
/dev/sda7        91104678  110639654    9767488+  83  Linux

Note that partitions 1-5 are contiguous. Beginning with #6, there is a 63-sector gap before each partition. This is directly analogous to the 63 sectors at the beginning of the disk. These gaps hold the "linked list" for logical partitions mentioned by syg00.

Here is the dd command and output showing the partition table entry for sda6:
Code:

[root@localhost mherring]# dd if=/dev/sda bs=512 skip=71569575 count=1|hexdump -C
1+0 records in
1+0 records out
512 bytes (512 B) copied, 6.7882e-05 seconds, 7.5 MB/s
00000000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001b0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 fe  |................|
000001c0  ff ff 83 fe ff ff 3f 00  00 00 81 14 2a 01 00 fe  |......?.....*...|
000001d0  ff ff 05 fe ff ff 34 49  80 02 c0 14 2a 01 00 00  |......4I....*...|
000001e0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
000001f0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 55 aa  |..............U.|
00000200

Every logical partition has a structure which looks like a disk---63 sectors at the beginning, with a partition table in sector 1. For logicals, each partition table has only 2 entries:
The offset to the start of the partition
The offset to the partition table for the next partition.

An extended partition is nothing more than an entry in a partition table pointing to the next logical partition. Thus there are actually multiple extended partitions in the example.

Aren't you glad you asked?....;)

ufmale 08-15-2008 12:21 PM

pixellany ... Thank you so much.. This is very good information...

Howeve, I am a litte confused about what you did

Quote:

dd if=/dev/sda bs=512 skip=71569575 count=1|hexdump -C
When you skip blocks with skip=71569575,is the table partition table you shown belong to /dev/sda6?

Then I believe the information in the table will tell me where the /dev/sda7 is, right? if so, does the information is described with 16 bytes data as well? From the table it looks like it starts at 000001be, correct?

In addition, from your example, the extended partition /dev/sda4 starts at 49142835 and end at 197503109,
but the partition /dev/sda7 end at 110639654. Does it mean you still have some space left on your drive?
Usually I would guess that the /dev/sda4 and /dev/sda7 will have the same end bytes.

pixellany 08-16-2008 08:20 AM

Quote:

When you skip blocks with skip=71569575,is the table partition table you shown belong to /dev/sda6?
Correct--each logical partition is preceded by 63 sectors, with a partition table at the end of the 1st sector. For a logical, there are only two entries--pointer to the actual partition, and pointer to the NEXT partition.

Quote:

Then I believe the information in the table will tell me where the /dev/sda7 is, right?
Correct, see above.

Quote:

if so, does the information is described with 16 bytes data as well? From the table it looks like it starts at 000001be, correct?
Partition table entries are always 16 bytes. In the MBR / boot sector, the last 2 bytes are always the "signature"--55 aa. These are at 1fe and 1ff. Partition table entries are at 1be, 1ce, 1de, and 1ee.

Quote:

In addition, from your example, the extended partition /dev/sda4 starts at 49142835 and end at 197503109,
but the partition /dev/sda7 end at 110639654. Does it mean you still have some space left on your drive?
Usually I would guess that the /dev/sda4 and /dev/sda7 will have the same end bytes.
I did not show all of the fdisk output. But the end of the last logical will equal the end of the extended only when the disk is fully partitioned.

AwesomeMachine 08-16-2008 08:29 AM

Try this post. It's a little long, but it's worth it.

http://www.linuxquestions.org/questi...ommand-362506/


All times are GMT -5. The time now is 08:05 AM.