Unix / Linux: Backup Restore Partition Table (MBR, EBR)

The partition table are most commonly associated with the Master Boot Record (MBR) and Extended Boot Record (EBR) on x86 systems. They are both 512 bytes long.

A master boot record (MBR) is a 512-byte boot sector found at the very beginning of a partitioned storage device or hard disk on x86 systems. The first 446 bytes of the MBR contains the bootstrap code area. Following that, there are partition table entries that are 64 bytes long. The last 2 bytes contain the boot signature.

The MBR record is designed to keep 4 partition table entries. Each partition table entry is 16 bytes long (16 x 4 = 64 bytes) and keeps track of the partition boundaries – by storing the first and last sectors of the partition. If one of the partitions is listed as an extended partition, all the logical partitions within the extended partition are described by EBR records located within the extended partition.

Backup Partition Table using dd

This method does not handle extended or logical partitions. Only primary partitions are supported.

To extract the MBR from the hard disk referenced by the /dev/sda device, use the dd command syntax shown below.

# dd if=/dev/sda of=sda_mbr.bin bs=512 count=1

1	# dd if=/dev/sda of=sda_mbr.bin bs=512 count=1

The above command will read the first 512 bytes from the hard disk and write it to the file “sda_mbr.bin” file. This will not backup EBR records.

To restore the MBR image on another disk (e.g. /dev/sdb) with a different partition layout, write only the bootstrap code or the first 446 bytes of that image.

# dd if=sda_mbr.bin of=/dev/sdb bs=446 count=1

1	# dd if=sda_mbr.bin of=/dev/sdb bs=446 count=1

To restore both the bootstrap code and the partition tables entries, write the full 512 byte image.

# dd if=sda_mbr.bin of=/dev/sdb bs=512 count=1

1	# dd if=sda_mbr.bin of=/dev/sdb bs=512 count=1

Backup Partition Table using sfdisk

With sfdisk, it is possible to extract both the MBR and EBR records. To list the partition tables of /dev/sda, use the following syntax.

# sfdisk -l /dev/sda

1	# sfdisk -l /dev/sda

To backup the MBR and EBR partition table entries, use the following syntax.

# sfdisk -d /dev/sda > sda_mbr_ebr.bin

1	# sfdisk -d /dev/sda > sda_mbr_ebr.bin

To restore the MBR and EBR partition table records to another disk (e.g. /dev/sdb) use the following syntax.

# sfdisk /dev/sdb < sda_mbr_ebr.bin

1	# sfdisk /dev/sdb < sda_mbr_ebr.bin

To copy a partition table from /dev/sda to /dev/sdb, you can use the following syntax.

# sfdisk -d /dev/sda | sfdisk /dev/sdb

1	# sfdisk -d /dev/sda \| sfdisk /dev/sdb

MBR Restrictions

The MBR record uses 32-bit pointers to represent the number of logical sectors. Since one sector is 512 bytes in size, the MBR can address 4,294,967,295 (2³² sectors – 1 sector for MBR) sectors. This gives a maximum capacity of about 2.2 TB. Beyond that, GUID Partition Table (GPT) has to be used. GPT allocates 64 bits for logical sectors, therefore allowing a maximum disk size of 9.4 ZB based on 512-byte sectors.

Mohamed Ibrahim

ibrahim = { interested_in(unix, linux, android, open_source, reverse_engineering); coding(c, shell, php, python, java, javascript, nodejs, react); plays_on(xbox, ps4); linux_desktop_user(true); }