[CentOS] Analyzing the MBR

Thu Jun 5 23:20:34 UTC 2014
Timothy Murphy <gayleard at eircom.net>

John R Pierce wrote:

> the rest of the space between the sector 0 MBR and the first primary
> partition is completely empty, nothing puts anything there.

You say that with supreme self-confidence,
but I have just looked at 3 disks with eg
  [tim at helen tmp]$ sudo dd if=/dev/sdb of=sdb.mbr bs=2048 count=1
and in each case there is material after the MBR,
eg "od -c" shows two have the following at the same place
0001360 376   L   o   a   d   i   n   g       s   t   a   g   e   1   .
0001400   5  \0   .  \0  \r  \n  \0   G   e   o   m  \0   R   e   a   d
0001420  \0       E   r   r   o   r  \0 273 001  \0 264 016 315 020   F
while the third has
0001420  \0 353 376   l   o   a   d   i   n   g  \0   .  \0  \r  \n  \0
0001440   G   e   o   m  \0   R   e   a   d  \0       E   r   r   o   r

I don't know if this is relevant, but the first two
were on machines running CentOS and grub,
while the third was on a machine running Fedora and grub2 .

I notice that the file command, surprisingly, seems to analyze the MBRs,
thus answering my original query,
though with slightly different outputs from grub and grub2 machines.
[tim at helen tmp]$ file sdb.mbr 
sdb.mbr: x86 boot sector; GRand Unified Bootloader, stage1 version 0x3,
stage2 address 0x2000, stage2 segment 0x200, GRUB version 0.94;
partition 1: ID ...
[tim at rose ~]$ file sda.mbr 
sda.mbr: ; partition 1: ID=0x7, active, starthead 1, startsector 63,
167774145 sectors; partition 2: ID=0x83, starthead 254, 
startsector 167774208, 8388608 sectors; 

Timothy Murphy  
e-mail: gayleard /at/ eircom.net
School of Mathematics, Trinity College, Dublin 2, Ireland