446642 dd mbr

By chillipep

OK, that should be a good workout. Do two 5 minute segments on the treadmill at 4, two more at 6 to get you aerobic activity up, then cool down with 5 minutes at 4 and 5 minutes at 2. So its 446642.

Or you can divide the numbers like this, 446, 64, 2. Add them up and you get 512. That must be some power of two (9, I suppose), so maybe this is really a computer thread. I guess it is really the number of bytes in a sector on a hard disk. :)

So here is what you could do with those numbers. Start out with a hard disk, as set aside a portion to dedicate to getting code running on it. IE, Boot It Up! Set aside some space to tell the computer where stuff lives on the hard drive (the partition table). And add a marker signifying the end of all this. So we would call the the Master Boot Record, or MBR. We could do this:

# bytes use

446 bootloader

64 partition table, tells us where partitions are on the hard disk

2 magic number to signify the end of this section, 55aa

The 64 bytes for the partition table is nice! By convention, there are only 4 entries allowed in the Master Boot Record to designate locations of drive partitions. So we need space for 4 descriptions. We have 64 bytes, so each entry gets to use 16 bytes to describe it.

But those numbers are not typical computer geek numbers. They are too simple. To be talking computereze, we have to learn to start counting at zero. So doing that, we can define the memory byte address of these things:

bootloader … | … partition table … |… signature (55aa)

(446 bytes) … |…… (64 bytes) ……. |.. .. (2 bytes) …..

start .. end … | … start …… end … | .. start … end

0 …. 445 ….. | …. 446 ……. 509 … | .. 510 ….. 511

So, armed with this knowledge, we could make a backup of the Master Boot Record of our hard drive, so we could reconstruct it in case it gets wiped out. It is important to realize that when people say a virus ‘destroys everything on your hard drive’, this is physically impossible to do with any speed at all. That would take many minutes, or maybe even an hour. What really is more likely is that it deletes the MBR, and you just have no way to boot. And you have lost track of where it is.

It is really easy to make a copy of the MBR on a floppy disk, using the dd command in Linux. You just put a spare floppy in the floppy drive, and use the dd command like this from the command prompt:

sudo dd if=/dev/hda of=/dev/fd0 bs=512 count=1 and hit enter. Give it your password to allow it to do this as root. Watch the little LED on the floppy, and you should see it come on as the MBR is written to the floppy.

Here is how to interpret this:

sudo -> super user do, means do this as the system administrator. Unix/Linux will not let a normal user issue the dd command that follows.

dd -> copy something somewhere using the instructions that follow

if -> what to copy, the input file. Here we copy starting at the beginning of the first hard drive device, /dev/hda.

of -> where to copy it to. Here we put it at the beginning of the first floppy drive, /dev/fd0. Note that is a zero, not the letter O. Also note we count the hard drives a, b, c etc, but we count the floppy drives 0, 1, 2 etc. So if you count your toes like this, you will likely have either ‘j’ toes, or ‘9′ toes.

bs=512 -> When you copy, do it using a block size of 512 bytes.

count=1 -> Copy only one block

But this should be all be put in persective. There is the old tale of the Berkeley/Stanford/your choice professor that told his engineering students that the person who knows how will always have a good job working for the person that knows why. So maybe we should know why, and by implication, why not.

First, the easiest way to lose all the data on your hard disk is to lose either the boot loader or the partition table. It is normally fairly easy to reinstall the boot loader, it is not easy to reconstruct a damaged partition table. It is a record of where things are on your hard drive. And they could be almost anywhere, depending on how your drive was configured. So by doing the dd thing above, we make ourselves a backup copy in case we get wiped out by a virus, or more likely in my case, I do it to myself somehow. :(

To put the MBR back, all we have to do is boot the computer with a bootable CD with minimal Linux tools, and issue the command again, only this time sending the data back. It would look like this:

sudo dd if=/dev/fd0 of=/dev/hda bs=512 count = 1

So in one easy stroke, we have taken our backup information and put it in the MBR, wiping out what was there, and presumably bad. Why else would we have done it?

So all this power should give you a warm fuzzy feeling; or give you a panic attack. If you are a normal user, spending most of your time on Google and YouTube, then feel warm and fuzzy.

If you are like me, and spend one days a week “updating” and adding new operating systems to your computer, and six days trying to fix how you just screwed it up, you will more than likely realize that you just overwrote your hard drive partition table with data from a week, or a month, or a year ago! Who knows how many times you have moved the partitions around since then? So unless you have been religiously making this backup, it is sure to wrong data in the MBR. Take gun, point at foot, pull trigger.

So you should think about what you are trying to do. If you are backing up the partition table, then go ahead and do all 512 bytes. But if you only want to backup the boot loader portion, then only do the first 446 bytes, using bs=446.

For many tons more information just Google ‘dd mbr’.

Or look here: http://www.dewassoc.com/kbase/hard_drives/master_boot_record.htm

Leave a Reply