LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Software
User Name
Password
Linux - Software This forum is for Software issues.
Having a problem installing a new program? Want to know which application is best for the job? Post your question in this forum.

Notices


Reply
  Search this Thread
Old 01-12-2006, 09:39 AM   #1
JerryP
Member
 
Registered: May 2005
Location: Hells Kitchen, New York
Distribution: PCLinuxOS 2007
Posts: 72

Rep: Reputation: 15
How di I competely replace the MBR?


How does one replace the MBR – completely? Say with a blank MBR. Even after deleting all files of the root partition the computer thinks that it is still booting to the same OS, until it finds there is nothing there. What makes it “remember” an earlier time? I'd like the computer to think that it's a virgin.

Jerry
 
Old 01-12-2006, 10:27 AM   #2
oneandoneis2
Senior Member
 
Registered: Nov 2003
Location: London, England
Distribution: Ubuntu
Posts: 1,460

Rep: Reputation: 48
Use 'dd' to overwrite it: http://www.linuxquestions.org/questi...d.php?t=399144
 
Old 01-12-2006, 10:49 AM   #3
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,499
Blog Entries: 2

Rep: Reputation: 68
dd if=/dev/zero of=/dev/hda bs=512 count=1
 
Old 01-12-2006, 12:05 PM   #4
JerryP
Member
 
Registered: May 2005
Location: Hells Kitchen, New York
Distribution: PCLinuxOS 2007
Posts: 72

Original Poster
Rep: Reputation: 15
Sorry to expose my newbiness but can I just do this from a live CD terminal? Then, I assume (with typical results of assumption) that I should be able to put in a CD of the distro of my choice and it will see the partitions that are still there OR does cleaning the MBR wipe out all partitions too?
 
Old 01-12-2006, 12:15 PM   #5
michaelk
Moderator
 
Registered: Aug 2002
Posts: 25,592

Rep: Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880Reputation: 5880
The MBR is the first 512 bytes of the drive and is independent of any other partition. The MBR contains the bootloader and the partition table.

FYI
dd if=/dev/zero of=/dev/hda bs=512 count=1
Will erase the bootloader and the partition table.

dd if=/dev/zero of=/dev/hda bs=446 count=1
Will erase the bootloader but leave the existing partition table.

You can do this from from a live CD terminal.

Last edited by michaelk; 01-12-2006 at 12:16 PM.
 
Old 01-12-2006, 12:45 PM   #6
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Mint
Posts: 17,809

Rep: Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743
Quote:
Originally Posted by michaelk
The MBR is the first 512 bytes of the drive and is independent of any other partition. The MBR contains the bootloader and the partition table.
The mbr contains the FIRST partition table....If there are more than 4 partitions, one of the entries in the first table will be an extended partition. Then, in sector 1 (mbr being sector 0), you will find the first four logical partitions.
In sector 2, you might find more logical partitions
Etc. Etc.

On my drives, it seems that the default is for sectors 0-63 to be all boot stuff and partition tables.

Do this to see the whole ugly picture:

dd if=/dev/xxx bs=512 count=65|hexdump -C >sectors
where xxx = your drive id (eg hda, sda, whatever)
This writes 65 sectors in hex format to a new file named "sectors". You can browse this with a text editor to see every nuance of what is happening. I used 65 just to go a bit past the end to be sure I see the whole thing...)
At the end of the first sector (address 1FE) you will see a "signature"--05AA hex. This appears after every partition table. Thus if sector 1 and beyond, have partition tables, this signature will show up.

Last edited by pixellany; 01-12-2006 at 12:47 PM.
 
Old 01-12-2006, 12:59 PM   #7
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD, Raspbian, Arch
Posts: 2,331

Rep: Reputation: 357Reputation: 357Reputation: 357Reputation: 357
Quote:
Originally Posted by JerryP
...that I should be able to put in a CD of the distro of my choice and it will see the partitions that are still there...
No - absolutely not. You wipe out the MBR, you wipe out your partitions!

You were talking "virgin disk" before. A virgin disk does not have partitions on it. Wiping out your MBR will take care of that, but still won't give you a virgin disk necessarily (not that it usually matters). If you had previously "installed grub to the MBR", then you would still have leftovers in track 0 even after wiping the MBR. You would need to wipe all of track 0 to clean it up. Again, there's normally no functional reason to do this. But one example comes to mind. A few years back Intuit's TurboTax thought it would install some copy protection software to track 0. Users could reformat their disk, wipe their MBR, but the stupid copy protection stuff would STILL be there waiting for you the next time you reinstalled Windows!

Your MBR contains a couple of things, one of them being your partition table. You can replace part of your MBR, not including the partition table, if you'd like. If you remember some DOS stuff, this is exactly what "fdisk /fixmbr" did. This replaced the bootcode but not the partition table. As just mentioned, another part of your MBR is the bootcode. The bootcode installed by Linux is not exactly the same as that installed by Windows, but they both do similar things. Different versions of Windows may install different bootcode as well (but all are functionally equivalent). Bootcode reads the partition table and transfers processing to a new location based on what is in the table. With Linux, you have things like grub or lilo getting into the mix as well. The bootcode will transfer control to the bootloader (grub or lilo) and the bootloader will read your partition table. That's if you said "install grub to the MBR". If you installed grub elsewhere - up on a partition - things are a little different in the bootcode.

Grub is too big to actually fit in the bootcode area of the MBR, so saying "install to MBR" is a little bit of a white lie. A stub will be installed to the MBR bootcode area, but the meat of grub will actually be stored elsewhere on track 0 (this is technically not the MBR, which is only the first 512 bytes of track 0).
 
Old 01-12-2006, 02:25 PM   #8
JerryP
Member
 
Registered: May 2005
Location: Hells Kitchen, New York
Distribution: PCLinuxOS 2007
Posts: 72

Original Poster
Rep: Reputation: 15
OK and thank you.

So "dd if=/dev/zero of=/dev/hda bs=446 count=1"
this will erase the bootloader but leave the existing partition table.

What I am trying to do is remove all traces of my current OS. I have tried this by deleating everything from the root partition and even deleating and recreating the partition but I'm always left with the bootloader. I don't want to hurt my /home partition.
 
Old 01-12-2006, 03:03 PM   #9
pixellany
LQ Veteran
 
Registered: Nov 2005
Location: Annapolis, MD
Distribution: Mint
Posts: 17,809

Rep: Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743Reputation: 743
Quote:
Originally Posted by JerryP
OK and thank you.

So "dd if=/dev/zero of=/dev/hda bs=446 count=1"
this will erase the bootloader but leave the existing partition table.

What I am trying to do is remove all traces of my current OS. I have tried this by deleating everything from the root partition and even deleating and recreating the partition but I'm always left with the bootloader. I don't want to hurt my /home partition.
When you remove files, you are nowhere near "remove all traces". Removing a file only removes the link to it in the filesystem. The data is still there.
Remove all traces = a disk wipe utility
 
Old 01-12-2006, 04:00 PM   #10
haertig
Senior Member
 
Registered: Nov 2004
Distribution: Debian, Ubuntu, LinuxMint, Slackware, SysrescueCD, Raspbian, Arch
Posts: 2,331

Rep: Reputation: 357Reputation: 357Reputation: 357Reputation: 357
Quote:
Originally Posted by JerryP
So "dd if=/dev/zero of=/dev/hda bs=446 count=1" this will erase the bootloader but leave the existing partition table.
Yes. Technically this will erase the "bootcode", not the "bootloader", but will do what you want functionally.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
MBR zeroed. Can I verify backup MBR? TomF Linux - General 7 06-20-2005 05:28 PM
Something like SNORT but competely FREE small_boy22 Linux - Security 6 06-03-2005 10:18 AM
GRUB MBR overwritten by WIN98 MBR TOuseef Linux - General 7 11-14-2004 04:25 PM
Should I "Replace code in MBR?" rootking Linux - Hardware 1 11-02-2004 05:17 PM
problem in perl replace command with slash (/) in search/replace string ramesh_ps1 Red Hat 4 09-10-2003 01:04 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Software

All times are GMT -5. The time now is 05:10 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration