When Debian updated to GRUB 2 (package grub-pc), it didn't automatically upgrade the MBR. Instead it configured the old GRUB 1 installation so that it will chainload GRUB 2; that way administrators can test the new GRUB 2 configuration. If GRUB 2 failed for some reason, you still were able to boot the system with one of the old GRUB 1 entries. After testing GRUB 2 you were supposed to run upgrade-from-grub-legacy to replace the MBR, and then manually delete /boot/grub/menu.lst*.

Unfortunately, we didn't really do that on a lot of our servers, so now we have a mix of GRUB 1 and GRUB 2 MBRs, and we don't know which server is using which version. Is there any way to detect the GRUB MBR version?


The German Ubuntu wiki (don't worry, the information should be understandable even for people who don't speak German) seems to show an even better way:


sudo hexdump -v -s 0x80 -n  2 -e '2/1 "%x" "\n"'  /dev/sdXY

The result can be translated with the following table:

5272    GRUB (Legacy)
aa75    GRUB (Legacy)
48b4    GRUB 2 (version 1.96)
7c3c    GRUB 2 (version 1.97 or 1.98)
020     GRUB 2 (version 1.99)
488     Grub 2 core.img
31d2    Grub 2 core.img
8053    LILO

The original wiki article contains even more IDs that can be used to identify a lot of other MBRs from other operating systems.


I have found that the third 512 byte block of a device contains the following strings when the server is still using a GRUB 1 MBR:

some-server ~ # dd if=/dev/sda bs=512 count=1 skip=2 2>/dev/null | strings
/boot/grub/stage2 /boot/grub/menu.lst

If the server is using a GRUB 2 MBR, the block won't contain any readable strings:

some-other-server ~ % dd if=/dev/sda bs=512 count=1 skip=2 2>/dev/null | strings
  • This method can check if GRUB-legacy is installed, but a wiped MBR will give the same result as GRUB2. – Skippy le Grand Gourou Nov 9 '18 at 22:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.