2

The following line shows the the four partition table entries of 16 bytes each. See here for a specification of the format. 

$ sudo hd ubuntu-16.10-desktop-amd64.iso -s 446 -n 64
000001be  80 00 01 00 00 5e e0 ff  00 00 00 00 00 80 2f 00  |.....^......../.|
000001ce  00 fe ff ff ef fe ff ff  54 24 2f 00 c0 12 00 00  |........T$/.....|
000001de  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
000001fe

The latter three are all zeros, while the first entry is the interesting one. Byte 0 (counting from 0) has value 0x80 which means that it does in fact describe "an active partition". Byte 4 describes the partition type, fx 0x0B is FAT32. However 0 is an invalid value. According to this source:

00 : -- Should NOT be used in an actual table entry! It does not indicate an unknown type, but rather an empty entry; in which case, all other fields in that 16-byte entry should be zero-filled as well.

So according to what I can read, the MBR data is invalid. What is going on?

I did this with Ubuntu 16.04 (Yakkety), downloaded via this link, and the file has md5sum 3f50877c05121f7fd8544bef2d722824.

Mads Skjern
  • 1,058
  • 4
  • 13
  • 24

1 Answers1

1

I don't have much idea about partition systems, but I believe the reason is that it's not a plain MBR filesystem. Using parted:

$ parted ubuntu-16.10-desktop-amd64.iso p 
Warning: The driver descriptor says the physical block size is 2048 bytes, but Linux says it is 512 bytes.
Ignore/Cancel? Ignore                                                     
Model:  (file)
Disk /home/muru/ubuntu-16.10-desktop-amd64.iso: 6375MB
Sector size (logical/physical): 2048B/512B
Partition Table: mac
Disk Flags: 

Number  Start   End     Size    File system  Name   Flags
 1      2048B   6143B   4096B                Apple
 2      1582MB  1584MB  2458kB               EFI

Note: Partition Table: mac. And the Wikipedia article for Apple Partition Map says:

Some hybrid discs contain both an ISO 9660 primary volume descriptor and an Apple Partition Map, thus allowing the disc to work on different types of computers, including Apple systems.

I don't know why parted thinks the file is 6GB in size, though. However, file agrees that there's something involving Apple Partition Map here:

$ file ubuntu-16.10-desktop-amd64.iso -k | fold -w 80                        
ubuntu-16.10-desktop-amd64.iso: DOS/MBR boot sector ISO 9660 CD-ROM filesystem d
ata (DOS/MBR boot sector) 'Ubuntu 16.10 amd64' (bootable); partition 2 : ID=0xef
, start-CHS (0x3ff,254,63), end-CHS (0x3ff,254,63), startsector 3089492, 4800 se
ctors DOS/MBR boot sector ISO 9660 CD-ROM filesystem data (DOS/MBR boot sector) 
'Ubuntu 16.10 amd64' (bootable) Apple Driver Map, blocksize 2048, blockcount 370
08, devtype 0, devid 0, descriptors 0, contains[@0x800]: Apple Partition Map, ma
p block count 2, start block 1, block count 2, name Apple, type Apple_partition_
map ISO 9660 CD-ROM filesystem data, contains[@0x1000]: Apple Partition Map, map
 block count 2, start block 772373, block count 1200, name EFI, type Apple_HFS I
SO 9660 CD-ROM filesystem data, contains[@0x1800]: ISO 9660 CD-ROM filesystem da
ta FoxPro FPT, blocks size 37008, next free block index 1163003904\012- data
muru
  • 207,228