Hard Disk Partition Table backup in Linux

In Linux, back up partition tables:

Use the DD command

1. Back up the MBR Master Boot Record without backing up the master Partition Table:

# Dd If =/dev/SDA of = MBR. Backup BS = 446 COUNT = 1

2. View in hexadecimal format:
# HD-v mbr. Backup
00000000 EB 63 90 D0 BC 00 7C 8e C0 8e D8 be 00 7C BF 00 |. C ...... |
00000010 06 B9 00 02 FC F3 A4 50 68 1C 06 cb fb B9 04 00 | ...... pH ...... |
00000020 BD be 07 80 7E 00 00 7C 0b 0f 85 0e 01 83 C5 10 | ....~.. | ...... |
00000030 E2 F1 CD 18 88 56 00 55 C6 46 11 05 C6 46 10 00 |... v. U. F... |
00000040 B4 41 bb aa 55 CD 13 5d 72 0f 81 FB 55 AA 75 09 |. A... u...] r... U. U. |
00000050 F7 C1 01 00 74 03 Fe 46 10 66 00 80 01 00 00 |... t... F. F... |
00000060 00 00 00 00 FF fa 90 F6 C2 80 75 02 B2 80 EA | ...... |
00000070 74 7C 00 00 31 C0 8e D8 8e D0 BC 00 20 FB A0 64 | T |... 1 ...... d |
00000080 7C 3C FF 74 02 88 C2 52 BB 17 04 80 27 03 74 06 | <. T... r... '. T. |
00000090 be 88 7d E8 1C 01 be 05 7C F6 C2 80 74 48 B4 41 |...} ...... |... Th. A |
201700a0 bb aa 55 CD 13 5A 52 72 3D 81 FB 55 AA 75 37 83 |... u... zrr =... U. u7. |
201700b0 E1 01 74 32 31 C0 89 44 04 40 88 44 ff 89 44 02 |... t21.. D. @. D... D. |
201700c0 C7 04 10 00 66 8B 1E 5C 7C 66 89 5C 08 66 8B 1E |... F... \ | f. \. F... |
201700d0 60 7C 66 89 5C 0C C7 44 06 00 70 B4 42 CD 13 72 | '| f. \. D.. P. B. R |
201700e0 05 BB 00 70 EB 76 B4 08 CD 13 73 0d F6 C2 80 0f | ...... P. v ...... S ...... |
201700f0 84 D0 00 be 93 7d E9 82 00 66 0f B6 C6 88 64 FF | ......} ...... f ...... D. |
00000100 40 66 89 44 04 0f B6 D1 C1 E2 02 88 E8 88 F4 40 | @ F. D ...... @ |
00000110 89 44 08 0f B6 C2 C0 E8 02 66 89 04 66 A1 60 7C |. d ...... F. '|
00000120 66 09 C0 75 4E 66 A1 5C 7C 66 31 D2 66 F7 34 88 | f... UNF. \ | f1.f. 4. |
00000130 D1 31 D2 66 F7 74 04 3B 44 08 7d 37 Fe C1 88 C5 |. 1. F. T.; D.} 7... |
00000140 30 C0 C1 E8 02 08 C1 88 D0 5A 88 C6 BB 00 70 8e | 0 ...... Z ...... P. |
00000150 C3 31 db B8 01 02 CD 13 72 1E 8C C3 60 1E B9 00 |. 1... r... '... |
00000160 01 8e dB 31 F6 BF 00 80 8e C6 FC F3 A5 1f 61 ff | ...... 1 ...... |
00000170 26 5A 7C be 8e 7d EB 03 be 9d 7d E8 34 00 be A2 | & Z |...} ...... |
00000180 7d E8 2E 00 CD 18 EB Fe 47 52 55 42 20 00 47 65 |} ...... grub. ge |
00000190 6f 6D 00 48 61 72 64 20 44 69 73 6B 00 52 65 61 | om. Hard Disk. REA |
000001a0 64 00 20 45 72 72 6f 72 0d 0a 00 BB 01 00 B4 0e | D. Error ...... |
000001b0 CD 10 AC 3C 00 75 F4 C3 77 2a 5B 21 00 00 |... <. U... w *[!.. |
000001be

3. Back up Master Boot records and primary partition tables:

# Dd If =/dev/SDA of = mbr_dpt.backup BS = 512 COUNT = 1

4. View the first sector in hexadecimal notation

# HD-V mbr_dpt.backup
00000000 EB 63 90 D0 BC 00 7C 8e C0 8e D8 be 00 7C BF 00 |. C ...... |
00000010 06 B9 00 02 FC F3 A4 50 68 1C 06 cb fb B9 04 00 | ...... pH ...... |
00000020 BD be 07 80 7E 00 00 7C 0b 0f 85 0e 01 83 C5 10 | ....~.. | ...... |
00000030 E2 F1 CD 18 88 56 00 55 C6 46 11 05 C6 46 10 00 |... v. U. F... |
00000040 B4 41 bb aa 55 CD 13 5d 72 0f 81 FB 55 AA 75 09 |. A... u...] r... U. U. |
00000050 F7 C1 01 00 74 03 Fe 46 10 66 00 80 01 00 00 |... t... F. F... |
00000060 00 00 00 00 FF fa 90 F6 C2 80 75 02 B2 80 EA | ...... |
00000070 74 7C 00 00 31 C0 8e D8 8e D0 BC 00 20 FB A0 64 | T |... 1 ...... d |
00000080 7C 3C FF 74 02 88 C2 52 BB 17 04 80 27 03 74 06 | <. T... r... '. T. |
00000090 be 88 7d E8 1C 01 be 05 7C F6 C2 80 74 48 B4 41 |...} ...... |... Th. A |
201700a0 bb aa 55 CD 13 5A 52 72 3D 81 FB 55 AA 75 37 83 |... u... zrr =... U. u7. |
201700b0 E1 01 74 32 31 C0 89 44 04 40 88 44 ff 89 44 02 |... t21.. D. @. D... D. |
201700c0 C7 04 10 00 66 8B 1E 5C 7C 66 89 5C 08 66 8B 1E |... F... \ | f. \. F... |
201700d0 60 7C 66 89 5C 0C C7 44 06 00 70 B4 42 CD 13 72 | '| f. \. D.. P. B. R |
201700e0 05 BB 00 70 EB 76 B4 08 CD 13 73 0d F6 C2 80 0f | ...... P. v ...... S ...... |
201700f0 84 D0 00 be 93 7d E9 82 00 66 0f B6 C6 88 64 FF | ......} ...... f ...... D. |
00000100 40 66 89 44 04 0f B6 D1 C1 E2 02 88 E8 88 F4 40 | @ F. D ...... @ |
00000110 89 44 08 0f B6 C2 C0 E8 02 66 89 04 66 A1 60 7C |. d ...... F. '|
00000120 66 09 C0 75 4E 66 A1 5C 7C 66 31 D2 66 F7 34 88 | f... UNF. \ | f1.f. 4. |
00000130 D1 31 D2 66 F7 74 04 3B 44 08 7d 37 Fe C1 88 C5 |. 1. F. T.; D.} 7... |
00000140 30 C0 C1 E8 02 08 C1 88 D0 5A 88 C6 BB 00 70 8e | 0 ...... Z ...... P. |
00000150 C3 31 db B8 01 02 CD 13 72 1E 8C C3 60 1E B9 00 |. 1... r... '... |
00000160 01 8e dB 31 F6 BF 00 80 8e C6 FC F3 A5 1f 61 ff | ...... 1 ...... |
00000170 26 5A 7C be 8e 7d EB 03 be 9d 7d E8 34 00 be A2 | & Z |...} ...... |
00000180 7d E8 2E 00 CD 18 EB Fe 47 52 55 42 20 00 47 65 |} ...... grub. ge |
00000190 6f 6D 00 48 61 72 64 20 44 69 73 6B 00 52 65 61 | om. Hard Disk. REA |
000001a0 64 00 20 45 72 72 6f 72 0d 0a 00 BB 01 00 B4 0e | D. Error ...... |
000001b0 CD 10 AC 3C 00 75 F4 C3 77 2a 5B 21 00 00
00 01 |... <. U... w *[!.... |
000001c0 01 00 07 Fe 3f 0C 3f 00 00 00 8e 2f 03 00 00 00 | ....?.?.... /... |
000001d0 01 0d 07 Fe ff cd 2f 03 00 C0 38 FD 09 00 Fe | ....../...... 8 ...... |
000001e0 FF 0f Fe FF Fe 6f 00 0a 02 E8 37 30 00 | ...... o ...... 70 ...... |
000001f0 00 00 00 00 00 00 00 00 00 00 00 00 55 AA | ...... U. |
00000200

5. Backup (View) Partition Table

# Dd If =/dev/SDA of = dpt bs = 1 skip = 446 COUNT = 64

6. View partition tables in hexadecimal format

# HD-V DPT
00000000 00 01 01 00 07 Fe 3f 0C 3f 00 00 00 8e 2f 03 00 | ......?.?.... /... |
00000010 00 00 01 0d 07 Fe ff cd 2f 03 00 C0 38 FD 09 | ........../...... 8 |
00000020 00 Fe FF 0f Fe FF Fe 6f 00 0a 02 E8 37 30 | ...... o ...... 70 |
00000030 00 00 00 00 00 00 00 00 00 00 00 00 | ...... |
00000040

Hard drive primary Boot Sector = hard drive primary Boot Record (MBR) + Hard Disk Partition Table (DPT)
------------------------------
Physical location: 0, 0, and 1 sectors (clindyer 0, side 0, Sector 1)
Size: 512 bytes
Among them: MBR 446 bytes (BD), DPT 64 bytes (01be--01fd), ending mark 2 bytes (55 aa)
Function: the MBR directs the system to DBR by checking the DPT partition information;
Read: Use Norton diskedit and choose drive --> physical disk--hard disk from the object menu,
Then, select disk partition table in the object menu to read the data, and use the write object to option in the Tools menu to save the data to the specified file for backup;
Write: Use Norton diskedit, select drive --> Floopy disk from the object menu, and select the DPT
File, and then use the write object to --> physical sector option in the Tools menu to write to 001
(Clindyer 0, side 0, Sector 1 );
　　
Details:
000h--08ah MBR Startup Program (search for boot partition)
08bh--0d9h MBR startup string
0dah--1bch ("0 ")
1beh--1fdh Hard Disk Partition Table
1feh--1ffh end sign (55aa)
　　
Active partition primary Boot Sector (DBR)
--------------------------
Physical location: 1 side, 0 channels, 1 Sector (clindyer 0, side 1, Sector 1)
Size: fat16 1 slice, 512 bytes
FAT32 3 sector 1536 bytes
Function: includes information such as machine CMOS (ipv--0059), checks the information, and directs the specified system file, such as ntldr;
Read: Use Norton diskedit and choose drive --> Logical Disk--disk C from the object menu,
Then, select Boot Record from the object menu to read the data and use
The write object to option is saved to the specified file for backup;
Write: Use Norton diskedit, select drive --> Floopy disk from the object menu, and select the backup DBR.
File, and then use the write object to --> physical sector option in the Tools menu to write to 011
(Clindyer 0, side 1, Sector 1 );
　　
Details:
　　
000h--002h 3 byte jump command (to start the program and jump to 03eh)
003h--03dh BIOS parameter Area
03eh--19dh DOS Startup Program
19eh--1e5h boot string
1e6h--1fdh file name (Io. sys, msdos. sys)
1feh--1ffh end mark (55aa)
　　
Hard Disk Partition Table (DPT)
---------------------
Meaning analysis of the number of bytes of the Offset address
　　
01be 1 partition type: 00 indicates inactive partition: 80 indicates active partition; others are invalid partitions.
　　
01bf ~ The start address of the 01c1 3 * partition (surface/sector/track). Generally, the start address of the first partition starts from one side, 0 channels, and 1 sector. Therefore, the three bytes must be 010100 bytes.
　　
01c2 1 # partition operating system type.

　　
01c3 ~ 01c5 3 * end address of the partition (surface/Fan/channel)
　　
01c6 ~ 01c9 4 start logical sector of the partition
　　
01ca ~ 01cd 4 Total number of sectors occupied by the partition
　　
Note: * Note the distribution of bytes in the Start address (surface/sector/track) and end address (surface/Fan/track) of the partition:
　　
00000000 01000001 00010101
~~~~~~~~ = ^ =
　　
~ Face (head) 8 bits
^ 6-digit sector
= 10 bits
　　
# Partition operating system type (File Format flag)
　　
4---dos fat16 <32 m
5--extend
6--dos fat16> 32 m
7---ntfs (OS/2)
83---linux> 64 m
　　
DPT has a total of 64 bytes (01be--01fd). As shown above, each partition occupies 16 bytes, so it can represent four partitions, this is why the sum of the primary and extended partitions of a disk can only be four.

　　
Logical drive
-----------
The extended partition information is located in the hard disk partition table (DPT) shown above, while the logic drive information is located in the Start sector of the extended partition, that is, the slice corresponding to the start address (surface/sector/track) of the partition. The difference between the information in this slice and the primary boot slice of the hard disk does not include MBR, the 16-byte partition information indicates the start and end addresses of the logical drive.

　　
Therefore, when the disk contains only one primary partition and one extended partition (including multiple logical drives, even if data in the primary Boot Sector of the hard disk is lost (including DPT) due to viruses or other causes, the entire hard disk can be recovered through the data on the logical drive.

　　
For example, the following is a hard disk partition.
　　
Total sectors of the Start fan (logical) end fan
MBR 0 0 1 ------
C 0 1 1 276 239 63 4,188,239 4,188,177
Expansion 277 0 1 554 239 63 4,188,240 8,391,599 4,203,360
D 277 1 554 239 63 4,188,303 8,391,599 4,203,297
　　
　　
If the primary Partition Table is corrupted, You can manually search for the logical drive data contained in the extended partition table. In this example, the data corresponding to the D disk is used, and then the start fan (logical) is used) 63 is the start fan (logical) of the corresponding extended partition. Changing the start address (surface/sector/track) to 0 is the start address of the extended partition. then, you can use the extended partition to obtain the information of primary partition C, and then you can use the fdisk/MBR command and manually enter the partition table to restore the entire hard disk.

　　
It is troublesome to use this method. If you know the size of each partition, you can use PQ magic 5 to repartition the disk to the original size (Note: never apply it, we only use it to obtain data), view info to obtain the above data, record the data, cancel the partition operation, and then use Norton disk2000 to manually modify the DPT table to restore the entire hard disk.

　　
Partition Table data corresponding to this example:
　　
80 01
01 00 06 EF 7f 14 3f 00 00 00 11 E8 3f 00 00 00
41 15 05 ef bf 2a 50 E8 3f 00 60 23 40 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA
　　
Extended partition table data:
00 01
41 15 07 ef bf 2a 8f E8 3f 00 21 23 40 00
　　
Note: The start sector of the logic and the total number of partitions are low on the left. For example, if the start address of the extended partition in this example is 50 E8 3f 00, it must be changed to 00 3f E8 50 before decimal conversion, the total number of partitions occupied 60 23 40 00 must be changed to 00 40 23 60. Similarly, when you manually enter this value, the high/low conversion is required.