The Master Boot Record (MBR) contains two things:
- Boot code -- The first 440 bytes of the MBR hold the boot loader code. This can be Microsoft's boot loader, GRUB's first-stage code, or something else. On a non-boot disk or if the computer boots using the newer EFI system, this space can be empty (that is, all 0s).
- Partition table -- The final 72 bytes of the sector hold the partition table. (Note that the first six bytes of this area hold a disk signature/serial number. Some boot loaders push into this area, but most don't.)
These parts of the MBR are typically written by different tools. Under Linux,
lilo, and similar tools write the boot code, whereas
parted, GParted, and other partitioning programs write the partition table. In terms of system calls, though, sectors are written in an all-or-none fashion, so the relevant tools may read, store, and write back out the part of the sector that they don't officially touch. This usually works fine, but it can result in corruption if there's a bug in the program or some sort of system error.
For more information on the MBR, see the Wikipedia page on the subject.
Some tools may modify both types of data. For instance, GRUB can alter the partition table data as it runs. It does this to "hide" certain partitions on a boot-by-boot basis.
You can back up the complete MBR (both boot code and partition table) in Linux using the
dd command, as in:
dd if=/dev/sda of=sda.mbr bs=512 count=1
This example backs up the MBR of the first disk (
/dev/sda) to a file called
sda.mbr. Be very careful when using
dd, though; reversing the
of= options, omitting or changing other options, or making other mistakes can result in a trashed disk!