0

enter image description here

I am concerned that the disk image I am looking at has been corrupted or created in error some how. (more specifically the formatting of the disk that the image captured)

The highlighted section in my photo is the portion I am talking about, is this typical for an MBR of a disk? Or is something wrong here? I have been browsing around now for a while and I cannot as of yet determine whether I have a legit MBR or one that is error. Please help and provide clarification if you can.

  • 2
    I’m not sure, but I suspect that you’re looking at boot code (i.e., the binary machine-code instructions). In general, programs contain the messages that they (can) display to users. So the boot code contains the error message that it issues if there is a disk error. (It would be very rare for a truly corrupted disk to contain a clearly readable / legible sentence like “Press any key to restart”.) – Scott Oct 18 '18 at 0:49
  • so i get that, but im just trying to figure out why that message is there in that spot. according to the MBR format specs that section (0x1be) should contain partition information, not an error code – Chester_McLovin Oct 18 '18 at 1:01
  • 1
    Might be a partition image, instead of a whole disk image (or an un-partitioned disk) – Xen2050 Oct 18 '18 at 1:07
  • What is the output of file disk_image_in_question in Linux? – Kamil Maciorowski Oct 18 '18 at 4:01
  • I am on a windows machine – Chester_McLovin Oct 18 '18 at 4:43
0

Yes it is normal to have such text and it doesn't mean your image is corrupt.

The error message is part of the mbr (first sector of a disk). They need to be hard coded there as this is the only program running if you boot from a mbr disk. Wikepedia has a good description of the structure of mbr here if you would like additional background https://en.wikipedia.org/wiki/Master_boot_record

The exact text and positioning depends on the operating system and version that formatted the disk and whether the disk was internal/external when this was done.

For example, this is from Windows 95 taken from this link which gives a detailed disassembly of the mbr : http://robotics.mcmanis.com/articles/20080902_win95-mbr.html

000100 0A 40 75 01 42 80 C7 02 - E2 F7 F8 5E C3 EB 74 49  .@u.B......^..tI 
000110 6E 76 61 6C 69 64 20 70 - 61 72 74 69 74 69 6F 6E  nvalid partition 
000120 20 74 61 62 6C 65 00 45 - 72 72 6F 72 20 6C 6F 61   table.Error loa 
000130 64 69 6E 67 20 6F 70 65 - 72 61 74 69 6E 67 20 73  ding operating s 
000140 79 73 74 65 6D 00 4D 69 - 73 73 69 6E 67 20 6F 70  ystem.Missing op 
000150 65 72 61 74 69 6E 67 20 - 73 79 73 74 65 6D 00 00  erating system..

This is from my system disk formatted by Windows 10 :

0000000160  24 02 C3 49 6E 76 61 6C 69 64 20 70 61 72 74 69  $.ÃInvalid parti
0000000170  74 69 6F 6E 20 74 61 62 6C 65 00 45 72 72 6F 72  tion table.Error
0000000180  20 6C 6F 61 64 69 6E 67 20 6F 70 65 72 61 74 69   loading operati
0000000190  6E 67 20 73 79 73 74 65 6D 00 4D 69 73 73 69 6E  ng system.Missin
00000001A0  67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74  g operating syst
00000001B0  65 6D 00 00 00 63 7B 9A 59 2B 28 6D 00 00 80     em...c{šY+(m..€

This is taken from my system drive formatted by MacOS :

0000000190  FF 49 00 45 00 4D 00 65 6D 00 4D 69 73 73 69 6E  ÿI.E.M.em.Missin
00000001A0  67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74  g operating syst
00000001B0  65 6D 00 00 00 91 93 9A AE 11 D7 EB 00 00 00     em...‘“š®.×ë...

This is a bootable USB of mine created by MacOS :

000000190  00 FF 49 12 0D 0A 50 72 65 73 73 20 61 6E 79 20  .ÿI...Press any 
0000001A0  6B 65 79 20 74 6F 20 62 6F 6F 74 20 66 72 6F 6D  key to boot from
0000001B0  20 55 53 42 2E 00 00 00 86 95 1B 00 00 00 80 20   USB....†•....€ 

This is a disk with Grub bootloader installed - taken from https://thestarman.pcministry.com/asm/mbr/GRUB.htm :

0170  7D E8 2A 00 EB FE 47 52 55 42 20 00 47 65 6F 6D  }.*...GRUB .Geom
0180  00 48 61 72 64 20 44 69 73 6B 00 52 65 61 64 00  .Hard Disk.Read.
0190  20 45 72 72 6F 72 00 BB 01 00 B4 0E CD 10 AC 3C   Error.........<

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.