C Y B E R I N S I G H T

Master Boot Record is the information stored in the first sector (cylinder 0, head 0) of a disk, which contains primary bootloader, which is a 512 byte image. It contains both program and a partition table. 446 bytes out of 512 bytes contains executable codes and error messages text. Next 64 bytes are partition table. Each table of 16 bytes. That is the reason why in MBR labled disks, maximum 4 partitions can be created (16 * 4 = 64 bytes). Last 2 bytes is for validation check for MBR. The job of the primary boot loader is to find stage-2 or secondary bootloader from the partition table. Then it loads boot record from the device into RAM. MBR content can be extracted by running dd command as a root user. [ dd if=/dev/sda of=/tmp/mbr bs=512 count=1 ] where /dev/sda is our HDD, /tmp/mbr is the destination file where MBR will be extracted to. As MBR is of size 512 byte,  512 block size is mentioned. As it is in binary format, to view this file in ASCII format enter [ od -xa /tmp/mbr