C Y B E R I N S I G H T

Initramfs is a CPIO format archive, that every Linux kernel contains, which is extracted into rootfs when the kernel boots up. It contains a complete root file system for Linux. It then helps to assemble and mount the real root file system. The initramfs or early userspace is necessary for complex setups, like network boot, LVM, raid, which needs additional user space utilities to get rootfs accessed. initramfs does not need to contain every module that a user might want to use, instead it only contains the modules which are required to access the root filesystem. Rest major modules will be loaded later by udev during init process. After extracting, kernel checks for /init file. If it finds, then it is executed as PID 1. This /init program helps in finding real root device if there is any. If kernel does not find /init in rootfs, it falls back to older code to locate and mount a root partition and then executes /sbin/init . Thanks Ayush

Master Boot Record is the information stored in the first sector (cylinder 0, head 0) of a disk, which contains primary bootloader, which is a 512 byte image. It contains both program and a partition table. 446 bytes out of 512 bytes contains executable codes and error messages text. Next 64 bytes are partition table. Each table of 16 bytes. That is the reason why in MBR labled disks, maximum 4 partitions can be created (16 * 4 = 64 bytes). Last 2 bytes is for validation check for MBR. The job of the primary boot loader is to find stage-2 or secondary bootloader from the partition table. Then it loads boot record from the device into RAM. MBR content can be extracted by running dd command as a root user. [ dd if=/dev/sda of=/tmp/mbr bs=512 count=1 ] where /dev/sda is our HDD, /tmp/mbr is the destination file where MBR will be extracted to. As MBR is of size 512 byte,  512 block size is mentioned. As it is in binary format, to view this file in ASCII format enter [ od -xa /tmp/mbr