5

I found lot of examples of MBR records on various systems, and they all have same structure, for example - as here.

So - first 512 bytes must have a Code area, Disc signature and Table of partitions.

My disk layout is:

$ lsblk                                                                                                                                                                                                    
NAME                       MAJ:MIN RM   SIZE RO TYPE MOUNTPOINT
sda                          8:0    0 596,2G  0 disk 
├─sda1                       8:1    0     2G  0 part /boot
├─sda2                       8:2    0    16G  0 part [SWAP]
├─sda3                       8:3    0   500G  0 part 
│ ├─kubuntu_vg-root (dm-0) 252:0    0    30G  0 lvm  /
│ └─kubuntu_vg-home (dm-1) 252:1    0   470G  0 lvm  /home
└─sda4                       8:4    0  78,2G  0 part /media/setevoy/4A50CF6C50CF5D77
sr0                         11:0    1  1024M  0 rom

Bootable device is sda4 here:

/dev/sda4   *  1086326784  1250260991    81967104    7  HPFS/NTFS/exFAT  

And

 sda1 = /boot
 sda2 = swap
 sda3 = LVM physical volume with /home

Now, if I make:

$ sudo dd if=/dev/sda of=/tmp/mymbr bs=512 count=1

and run file on it - I can't see any similar to another MBR's googled:

$ file /tmp/mymbr 
/tmp/mymbr: x86 boot sector

While an "correct" (aka - googled) example display partitions, disks's IDs etc:

# file mbr.bin
mbr.bin: x86 boot sector;
partition 1: ID=0×83, active, starthead 1, startsector 63, 40949622 sectors;
partition 2: ID=0×82, starthead 254, startsector 40949685, 2088450 sectors;
partition 3: ID=0x8e, starthead 254, startsector 43038135, 74172105 sectors, code offset 0×48

Size is correct:

$ ls -lh /tmp/mymbr
-rw-r--r-- 1 root root 512 жов  6 11:18 /tmp/mymbr

using hexdump - I can see some data in file, including partitions (466 + 16 bytes):

$ hexdump -C -s 446 /tmp/mymbr 
000001be  00 20 21 00 83 35 70 05  00 08 00 00 00 00 40 00  |. !..5p.......@.|
000001ce  00 35 71 05 82 df 72 2d  00 08 40 00 00 00 00 02  |.5q...r-..@.....|
000001de  00 df 73 2d 83 b6 12 24  00 08 40 02 00 00 80 3e  |..s-...$..@....>|
000001ee  80 fe ff ff 07 fe ff ff  00 08 c0 40 00 70 c5 09  |...........@.p..|
000001fe  55 aa  

But what's wrong with file?

Maybe version?

$ file --version
file-5.14
magic file from /etc/magic:/usr/share/misc/magic

UPD 1

$ sudo fdisk -ls /dev/sda

Disk /dev/sda: 640.1 GB, 640135028736 bytes
255 heads, 63 sectors/track, 77825 cylinders, total 1250263728 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x6fa60981

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1            2048     4196351     2097152   83  Linux
/dev/sda2         4196352    37750783    16777216   82  Linux swap / Solaris
/dev/sda3        37750784  1086326783   524288000   83  Linux
/dev/sda4   *  1086326784  1250260991    81967104    7  HPFS/NTFS/exFAT
  • What does fdisk -l /dev/sda say? In particular, does it mention a disklabel type? – Stephen Kitt Oct 6 '16 at 9:05
  • Yes - fdisk display all my partitions with types (Lin/Lix-swap/Lix/NTFS) and sda4 marked as bootable (output added to this Q). – setevoy Oct 6 '16 at 9:11
  • @rudimeier -k (Don't stop at the first match, keep going.) made it! Thanks. Could you add it as answer? – setevoy Oct 6 '16 at 9:20
3

You may have luck to see more information including partitions using

file -k # Don't stop at the first match, keep going.

Though on my systems it also does not show the partition table. (file 5.15 and 5.19).

But I wonder why file should print the partition table at all. IMO file is supposed to show what kind of data is it, not the the whole content. Better trust fdisk -l or other well known disk tools.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.