LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Home Forums Tutorials Articles Register
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 11-05-2012, 09:29 PM   #1
Linux_Kidd
Member
 
Registered: Jan 2006
Location: USA
Posts: 737

Rep: Reputation: 78
RHEL 5.x MBR


does rhel 5.x keep a copy of the MBR like windoze does? if so where?
 
Old 11-05-2012, 11:50 PM   #2
malekmustaq
Senior Member
 
Registered: Dec 2008
Location: root
Distribution: Slackware & BSD
Posts: 1,669

Rep: Reputation: 498Reputation: 498Reputation: 498Reputation: 498Reputation: 498
Quote:
Originally Posted by Linux_Kidd View Post
does rhel 5.x keep a copy of the MBR like windoze does? if so where?
If your system does not offer any backup application (this is a matter of taste and choice, so not pre-installed) you can back up your mbr in a matter of 1 second or less. Do this--

Code:
~# dd if=/dev/sda of=/root/my_mbr bs=512 count=1
(if your hard disk is identified as /dev/sdb[c] you should use that name in the command.

You can keep as many copies of that "my_mbr" backup as you want in safe place.

Hope that helps.

Goodluck.
 
Old 11-06-2012, 03:48 AM   #3
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Quote:
Originally Posted by Linux_Kidd View Post
does rhel 5.x keep a copy of the MBR
If you mean "on installation" then you mean either Anaconda, or more specifically, the bootloader. In either case the answer is "no" ;-p See comment #3 of Bugzilla Bug 177941.
 
Old 11-06-2012, 07:06 AM   #4
sundialsvcs
LQ Guru
 
Registered: Feb 2004
Location: SE Tennessee, USA
Distribution: Gentoo, LFS
Posts: 10,659
Blog Entries: 4

Rep: Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941Reputation: 3941
The MBR data-structure is used by the BIOS of the computer and therefore it is the same for all systems that have a BIOS.
 
Old 11-06-2012, 09:03 AM   #5
Linux_Kidd
Member
 
Registered: Jan 2006
Location: USA
Posts: 737

Original Poster
Rep: Reputation: 78
ok folks, i know what the MBR is, and where the 1st copy is. on some OS's the 512bytes of MBR is on disk in two locations, block 1 and another place, i believe on windoze the copy is made to the end of the boot part.
 
Old 11-06-2012, 09:35 AM   #6
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Code:
dd if=/dev/devicename of=/path/MBR bs=512 count=1
md5deep -p 512b /path/MBR > /path/MBR.md5
md5deep -p 512b -M /path/MBR.md5 /dev/devicename
 
Old 11-06-2012, 12:44 PM   #7
Linux_Kidd
Member
 
Registered: Jan 2006
Location: USA
Posts: 737

Original Poster
Rep: Reputation: 78
i am looking to dd the MBR copy, like dd if=/dev/sda of=mbr.copy bs=512 count=1 skip=210987

where block 210988 is the MBR copy on disk, etc.
 
Old 11-06-2012, 02:08 PM   #8
Noway2
Senior Member
 
Registered: Jul 2007
Distribution: Gentoo
Posts: 2,125

Rep: Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781Reputation: 781
Quote:
Originally Posted by Linux_Kidd View Post
i am looking to dd the MBR copy, like dd if=/dev/sda of=mbr.copy bs=512 count=1 skip=210987 where block 210988 is the MBR copy on disk, etc.
The problem I see with picking a particular location, such as block 210987, is ensuring that the block is marked as used or reserved and does not get reallocated for another purpose. In the examples given of copying the MBR to a file, especially coupled with the MD5 hashing as suggested by unSpawn, you get a stored copy (as a 512 byte file) that can be put anywhere, on any backup media, and then used to restore the MBR when needed.
 
Old 11-07-2012, 09:07 AM   #9
Linux_Kidd
Member
 
Registered: Jan 2006
Location: USA
Posts: 737

Original Poster
Rep: Reputation: 78
i may be mistaken on MBR. i think its that part table that is copied on disk.
 
Old 11-07-2012, 09:21 AM   #10
unSpawn
Moderator
 
Registered: May 2001
Posts: 29,415
Blog Entries: 55

Rep: Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600Reputation: 3600
Then skip 446 and get the remaining 66 bytes.
 
Old 11-07-2012, 11:11 AM   #11
Linux_Kidd
Member
 
Registered: Jan 2006
Location: USA
Posts: 737

Original Poster
Rep: Reputation: 78
thats still not what i am asking.

447-512 is duplicated to another location, etc.


ok, i think i can safely say "nevermind", but i will post back when i get confirmed info.

thanks.
LK
 
Old 11-08-2012, 06:44 AM   #12
malekmustaq
Senior Member
 
Registered: Dec 2008
Location: root
Distribution: Slackware & BSD
Posts: 1,669

Rep: Reputation: 498Reputation: 498Reputation: 498Reputation: 498Reputation: 498
Quote:
Originally Posted by Linux_Kidd View Post
i am looking to dd the MBR copy, like dd if=/dev/sda of=mbr.copy bs=512 count=1 skip=210987

where block 210988 is the MBR copy on disk, etc.
Are we here talking about the new PT not the MBR? "Skip" is not necessary unless you wanted to do-copy the end of the disk that contains the backup table under the GPT implementation --since you have already declared "count=1".

Under the GPT (GUID Partition Table) there is no more MBR considerations, no 4partition limit, no 'logical' partition --all partitions are equally both 'primary & logical'. Every partition is identified by its Globally Unique IDentifier hash, not by its cylinder location. Is this what we are talking about by the need to issue the option "skip=nnnnn" ?

The GPT resides about the first 2MB of the disk, maintains backup record at first block of later partition, and finally keeps backup record at the last 2mb of the disk. See wiki on GPT and UEFI.

Hope that helps.
 
Old 11-08-2012, 09:07 AM   #13
Linux_Kidd
Member
 
Registered: Jan 2006
Location: USA
Posts: 737

Original Poster
Rep: Reputation: 78
yeah, thats kinda the info i am looking for. thanks.
 
  


Reply



Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to fix mbr in linux or gparted, etc. (for a mbr partitioned disk) imayneed Linux - Newbie 2 08-26-2012 09:50 AM
RHEL 6.0 + OnBoard HW RAID + GRUB to MBR /dev/mapper/pdc_blah kurasoe Red Hat 5 07-13-2011 04:46 PM
Which program can boot a copy of the MBR (fake MBR) using mbr.bin Xeratul Linux - Software 6 12-03-2010 11:40 PM
RHEL 5.2 image restore ,MBR not working salimshahzad Linux - Newbie 1 08-15-2010 12:22 PM
Restoring MBR :partitions are detected only after the reboot after MBR restoration? sharathksin Linux - Newbie 2 04-14-2006 07:48 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 05:50 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration