How to backup the MBR?

[*Vanguard*]

I have PartitionMagic 8 but don't see anywhere within it how to make a
backup copy of the MBR (master boot record) and restore it. I also have
DriveImage 2002 and don't see it backup up the MBR, either. Both work
on partitions but do nothing to let me backup and restore the MBR. I
believe the Resource Kit for Windows NT 4.0 had the disksave utility to
save and restore the MBR. However, disksave is not one of the freebies
listed at ftp://ftp.microsoft.com/reskit/win2000. The index listing for
Windows XP Resource Kit (http://snipurl.com/6iml) doesn't list disksave.

I did a Google search. There are commercial utilities, like Active@
Uneraser, that let you backup and restore the MBR. I'd prefer free.
There are definite reasons NOT to use FIXMBR (from Windows XP) or FDISK
/MBR (from a Windows 9x boot floppy); see
http://www.cknow.com/vtutor/vtfdiskmbr.htm. I've already experience the
problem of a bad MBR and finding out both of those commands may not
work. There are other legitimate bootstrap programs that may inhabit
the MBR that these utilities know nothing about. In fact, in discussing
one person's use of some security & encryption software that protects
further than what permissions and EFS can do, running these utilities
will disable that security and make your drive unreadable.

You need to restore what was there, not what these hardcoded a limited
scenario tools will perform. So I need to figure out how to do a backup
of my MBR since saving disk images (using DriveImage) won't provide
*complete* recovery. I did some free tools through a Google search but
am unfamiliar with them.

* MBRtool 2.2 (http://snipurl.com/6imf). This is the one that
Powerquest (now Symantec) suggests at http://snipurl.com/6imf since
their own PartitionMagic doesn't do MBR backups (PT-Tool is now called
MBRtool).

* Cleanslate 1.0 (http://www.bootdisk.com/utility.htm)

* Seagate's DiscWizard for DOS (http://snipurl.com/67lc). I have a
Western Digital drive (the Seagate utility might still work. WD's Data
Lifeguard doesn't mention MBR backup/restore (http://snipurl.com/6imp).

* MBR Wizard (http://mbrwizard.securityorg.net/)

* head.zip, supposedly a .zip file of utilities from Powerquest
(http://snipurl.com/6in0) that includes an MBR utility. I know and
[mostly] trust Powerquest (and Symantec) but don't know this web site.
Through a search on "head.zip" at Symantec, I found an article that
mentions Powerquest's FTP link to the file. You have to copy the text
of the link because the reference takes you to the wrong page. I'll try
this for now but would like input on other and maybe better MBR
backup/restore utilities.

 

[I'm Dan]

I have PartitionMagic 8 but don't see anywhere within it how to
make a backup copy of the MBR (master boot record) and restore
it. I also have DriveImage 2002 and don't see it backup up the
MBR, either. Both work on partitions but do nothing to let me
backup and restore the MBR.

Correct, and for good reason. Whenever PM or DI changes, moves, or restores
a partition, it *must* confirm or rewrite the partition table parameters to
make sure they are consistent with the changes made. Backing up the
partition table is therefore moot because PM or DI (and Ghost, Acronis, et
al) will always make sure the partition table fits the restored
partition(s). And *not* backing up/restoring the partition table makes it
possible to restore the partitions on replacement disks with different
parameters, or in different locations on the disk.

PM/DI won't check the boot code in the MBR, but for most people that's
pretty much a non-issue because the mere 450-odd bytes of the boot code is
very easily restored via fixboot or fdisk /mbr. However, this is not to say
backing up track 0 isn't worthwhile for a *small* group of people. If
you're using a third-party boot manager, a bios extension overlay (e.g.,
ez-bios or disk manager), or as you mentioned, special encryption overlay,
then yes, backing up the customized track 0 may be a good idea -- as long as
you understand it has its own caveats. But it should not be rolled into PM
or DI as an automatic procedure because that has the potential of causing
problems for the majority of users. It should be a separate, deliberate
operation.

There are definite reasons NOT to use FIXMBR (from
Windows XP) or FDISK /MBR (from a Windows 9x boot
floppy); see http://www.cknow.com/vtutor/vtfdiskmbr.htm.

Boy, that guy goes overboard. Yes, there are a *few* reasons one may not
want to use fixboot or fdisk /mbr, but how many people fall into those
categories? Fixboot and fdisk /mbr are useful tools in the right
circumstances. Saying you should never use fixboot or fdisk /mbr is like
saying you should stay off the freeway because you might get killed out
there.

Third-party boot managers and bios extension overlays can be easily
restored/reinstalled. If you're using special encryption overlay (and how
many people fit this category?), then hopefully you're technically savvy
enough to know about the special requirements of the software, or else
you'll probably lock yourself out at some point anyway. And if you have the
monkey virus . . . well, let's just say that, like all viruses, you should
research how to *properly* remove the virus. Even then, a fixboot with DI
partition restorations will return you to a working system.

So I need to figure out how to do a backup of my MBR ...

Use MBRWork, a free utility from www.bootitng.com. Boot from a DOS boot
disk, run mbrwork.exe, and save track 0 to a file.

 

[Steve N.]

I have PartitionMagic 8 but don't see anywhere within it how to make a
backup copy of the MBR (master boot record) and restore it. I also have
DriveImage 2002 and don't see it backup up the MBR, either. Both work
on partitions but do nothing to let me backup and restore the MBR. I
believe the Resource Kit for Windows NT 4.0 had the disksave utility to
save and restore the MBR. However, disksave is not one of the freebies
listed at ftp://ftp.microsoft.com/reskit/win2000. The index listing for
Windows XP Resource Kit (http://snipurl.com/6iml) doesn't list disksave.

I did a Google search. There are commercial utilities, like Active@
Uneraser, that let you backup and restore the MBR. I'd prefer free.
There are definite reasons NOT to use FIXMBR (from Windows XP) or FDISK
/MBR (from a Windows 9x boot floppy); see
http://www.cknow.com/vtutor/vtfdiskmbr.htm. I've already experience the
problem of a bad MBR and finding out both of those commands may not
work. There are other legitimate bootstrap programs that may inhabit
the MBR that these utilities know nothing about. In fact, in discussing
one person's use of some security & encryption software that protects
further than what permissions and EFS can do, running these utilities
will disable that security and make your drive unreadable.

You need to restore what was there, not what these hardcoded a limited
scenario tools will perform. So I need to figure out how to do a backup
of my MBR since saving disk images (using DriveImage) won't provide
*complete* recovery. I did some free tools through a Google search but
am unfamiliar with them.

* MBRtool 2.2 (http://snipurl.com/6imf). This is the one that
Powerquest (now Symantec) suggests at http://snipurl.com/6imf since
their own PartitionMagic doesn't do MBR backups (PT-Tool is now called
MBRtool).

* Cleanslate 1.0 (http://www.bootdisk.com/utility.htm)

* Seagate's DiscWizard for DOS (http://snipurl.com/67lc). I have a
Western Digital drive (the Seagate utility might still work. WD's Data
Lifeguard doesn't mention MBR backup/restore (http://snipurl.com/6imp).

* MBR Wizard (http://mbrwizard.securityorg.net/)

* head.zip, supposedly a .zip file of utilities from Powerquest
(http://snipurl.com/6in0) that includes an MBR utility. I know and
[mostly] trust Powerquest (and Symantec) but don't know this web site.
Through a search on "head.zip" at Symantec, I found an article that
mentions Powerquest's FTP link to the file. You have to copy the text
of the link because the reference takes you to the wrong page. I'll try
this for now but would like input on other and maybe better MBR
backup/restore utilities.

There is a small free utility called boot.com that can backup the MBR to
a file and write to the MBR from a file. Do a search but be careful as
there are trojans by the same name. I don't have the url right now but
if I find it I'll post it later.

Steve

 

[Steve Nielsen]

There is a small free utility called boot.com that can backup the MBR to
a file and write to the MBR from a file. Do a search but be careful as
there are trojans by the same name. I don't have the url right now but
if I find it I'll post it later.

Steve

My mistake, it's called boot.exe and can be dl'd from here:

http://computing.net/howto/advanced/linuxnt/boot.exe

Don't let the link mislead you, although it is (or has been, there are
other, easier ways now) used for backing up MBR for setting up dual
booting it can be used simply for MBR backups/restores.

Steve

 

[Alex Nichol]

I have PartitionMagic 8 but don't see anywhere within it how to make a
backup copy of the MBR (master boot record) and restore it. I also have
DriveImage 2002 and don't see it backup up the MBR, either. Both work
on partitions but do nothing to let me backup and restore the MBR.

Look at MBRWORK in the free tools at www.bootitng.com
Runs from a DOS boot floppy, will backup and restore an MBR (and its
'EMBR' meaning the following sectors of track 1 which BING uses for its
handling of over 4 primary partitions). And will then also do a good
job of retrieving partition info and building a new partition table

 

[*Vanguard*]

I'm Dan said in news:[email protected]:

Correct, and for good reason. Whenever PM or DI changes, moves, or
restores a partition, it *must* confirm or rewrite the partition
table parameters to make sure they are consistent with the changes
made. Backing up the partition table is therefore moot because PM or
DI (and Ghost, Acronis, et al) will always make sure the partition
table fits the restored partition(s). And *not* backing up/restoring
the partition table makes it possible to restore the partitions on
replacement disks with different parameters, or in different
locations on the disk.

PM/DI won't check the boot code in the MBR, but for most people that's
pretty much a non-issue because the mere 450-odd bytes of the boot
code is very easily restored via fixboot or fdisk /mbr. However,
this is not to say backing up track 0 isn't worthwhile for a *small*
group of people. If you're using a third-party boot manager, a bios
extension overlay (e.g., ez-bios or disk manager), or as you
mentioned, special encryption overlay, then yes, backing up the
customized track 0 may be a good idea -- as long as you understand it
has its own caveats. But it should not be rolled into PM or DI as an
automatic procedure because that has the potential of causing
problems for the majority of users. It should be a separate,
deliberate operation.



Boy, that guy goes overboard. Yes, there are a *few* reasons one may
not want to use fixboot or fdisk /mbr, but how many people fall into
those categories? Fixboot and fdisk /mbr are useful tools in the
right circumstances. Saying you should never use fixboot or fdisk
/mbr is like saying you should stay off the freeway because you might
get killed out there.

Third-party boot managers and bios extension overlays can be easily
restored/reinstalled. If you're using special encryption overlay
(and how many people fit this category?), then hopefully you're
technically savvy enough to know about the special requirements of
the software, or else you'll probably lock yourself out at some point
anyway. And if you have the monkey virus . . . well, let's just say
that, like all viruses, you should research how to *properly* remove
the virus. Even then, a fixboot with DI partition restorations will
return you to a working system.



Use MBRWork, a free utility from www.bootitng.com. Boot from a DOS
boot disk, run mbrwork.exe, and save track 0 to a file.

No, I don't normally want it rolled into a drive image (i.e., I don't
want the MBR backup included in the partition image). However, it would
be handy if they at least provided a separate utility to doing the MBR
backup and restore. It should be an option to include the MBR,
especially if you only have one partitions occupying the entire physical
disk. I did find their head.zip utility file (includes mbrutil and
wipetrk) through a search for it by that filename but it's not like you
can easily go to a download page to find it. Symantec's download page
just list their demos. After first reading about head.zip on some guy's
personal web page, I then had something to search on at Symantec but had
to first check some KB articles to see if there was link to it and then
found it under
ftp.symantec.com/public/english_us_canada/tools/pq/utilities/. In other
words, well hidden.

While DriveImage works on making disk image filesets for a partition, I
had expected PartitionMagic to provide the tools to manage the MBR.
With all its capabilities in moving, deleting, resizing, converting, and
copying partitions, adding MBR support wouldv'e been a natural
extension. Even if it weren't included in their GUI as a
user-selectable menu function, a separate MBR utility would've been
appreciated (and included with the install). I could find it but not
because it was included in the product. Now that software predator
Symantec has consumed Powerquest then the separate Powerquest FTP
downloads could disappear. BTini gets installedw the PartitionMagic to
let me, for example, yank the boot.ini file off an NTFS partition so I
can fix it and replace it (see http://snipurl.com/6jyu). Why not
include the MBRutil? If you're aware enough to understand what BTini
does and how to use it then you are also probably aware enough to
understand the MBR.

Their MBRutil lets you save the 512 bytes of the MBR or the "first head"
(which I think means to save track 0 under the first head since the
saved file was 32K big, or 63 sectors and there are 63 sectors per track
or head). Why would I want to be saving all of track/head zero?

 

[I'm Dan]

Their MBRutil lets you save the 512 bytes of the MBR or the
"first head (which I think means to save track 0 under the first
head since the saved file was 32K big, or 63 sectors and there
are 63 sectors per track or head). Why would I want to be
saving all of track/head zero?

Sector 0 includes the standard MBR boot code (roughly 440 bytes, give or
take), the DiskID (4 bytes), and the master partition table (64 bytes). The
danger of backing up the entire 512 bytes of sector 0 is that it includes
the partition table. If the partition table has changed since the backup
was made, or if you are trying to restore your system onto a new hard disk
whose parameters are different from the original, this might cause problems.
Fixmbr is a convenient way to restore the standard MBR boot code, without
touching the DiskID or partition table. Fdisk /mbr is a convenient way to
restore the standard code portion and clear the DiskID, without touching the
partition table.

The rest of track 0 -- sectors 1-63 in a normal system -- are normally
unused and lie outside the boundaries of any partition. However, if you've
replaced the standard MBR with a third-party boot manager or the special
encryption software you were talking about earlier, it is possible those
utilities may use those unused sectors on track 0 to store their own code
and/or data. There are also some rogue programs that try to hide some of
their own data in those sectors, such as we saw with Turbotax's "product
activation" fiasco a yr and a half ago. In such cases you would want to
backup all of track 0 (but beware the caveat about the partition table)
because just backing up the MBR would be incomplete. (BTW, Terabyte's
mbrwork.exe, which I mentioned earlier, calls these sectors the "extended
MBR", or EMBR area.)

 

[*Vanguard*]

I'm Dan said in news:[email protected]:

Sector 0 includes the standard MBR boot code (roughly 440 bytes, give
or take), the DiskID (4 bytes), and the master partition table (64
bytes). The danger of backing up the entire 512 bytes of sector 0 is
that it includes the partition table. If the partition table has
changed since the backup was made, or if you are trying to restore
your system onto a new hard disk whose parameters are different from
the original, this might cause problems. Fixmbr is a convenient way
to restore the standard MBR boot code, without touching the DiskID or
partition table. Fdisk /mbr is a convenient way to restore the
standard code portion and clear the DiskID, without touching the
partition table.

The rest of track 0 -- sectors 1-63 in a normal system -- are normally
unused and lie outside the boundaries of any partition. However, if
you've replaced the standard MBR with a third-party boot manager or
the special encryption software you were talking about earlier, it is
possible those utilities may use those unused sectors on track 0 to
store their own code and/or data. There are also some rogue programs
that try to hide some of their own data in those sectors, such as we
saw with Turbotax's "product activation" fiasco a yr and a half ago.
In such cases you would want to backup all of track 0 (but beware the
caveat about the partition table) because just backing up the MBR
would be incomplete. (BTW, Terabyte's mbrwork.exe, which I mentioned
earlier, calls these sectors the "extended MBR", or EMBR area.)

Of the programs that I've seen use the bootstrap code area in the MBR,
they include: standard bootstrap program (but there seem to be more than
one "standard" program), boot managers, GoBack, drive overlay managers,
security products, anti-piracy software, and there's probably some that
I've forgotten about at the moment. I also found out after posting my
query that some boot managers will also use the remainder of track 0 for
running the rest of their program or to handle more than the 4
partitions allowed in the partition table. I also recall reading about
CDilla hiding in those other unused sectors in track 0.

The problem that I've seen is when a boot sector virus moves the
partition table. Using FIXMBR or FDISK /MBR will replace the bootstrap
code but does nothing to ensure the partition table is where it is
expected to be. The virus moved the partition table and knows where it
moved it to but the standard bootstrap program won't know the partition
table got moved. So you really do need to replace the partition table
along with the bootstrap code. I recall reading about a utility that
would rebuild the partition table in its standard location in the MBR by
hunting down where all the partitions were. MBRwork's readme.txt file
notes its option:

A - If no partitions exist in the MBR and no EMBR exists then this
option will allow you to recover lost FAT, HPFS, NTFS, and Extened
partitions.

That might work. The option:

1 - Backup the first track on a hard drive.

doesn't let me save just sector 0 but instead all of the first track.
But, as you mention, if the partitions have changed since the first
track save then you do not want to restore that save with its now
invalid partition table. So it seems you are forced to use the option:

C - Capture up to 64 disk sectors to a file.

which would supposedly let you save just sector 0, but that would still
include the partition table. So I still have no means of backing up and
restoring *just* the bootstrap code. If I could, then I would the
following options in the order shown:

4 - Reset the MBR are to all zeros.
3 - Reset the EMBR area to all zeros. (optional)
A - If no partitions exist ... recover lost ... partitions.
Restore only the *original* bootstrap code (unfortunately not an
option).

MBRwork does have the option to restore the standard bootstrap code but
that may not be the original bootstap code. So basically, yes, the MBR
backup will include the partition table. Option A won't work if the
partition table does exist (in its standard offset). I really don't
want to get into using a disk editor. So, for now, I'll have my disk
images for disaster recovery and be able to use the MBR backup only if
the partitions haven't change since the MBR backup was created. Or, put
another way, I'll have to remember to make another MBR backup after
every partition change. Doesn't look like I can get exactly what I want
but I can get close enough.

 

[Alex Bohner]

Vanguard,

I've seen a couple different posts from you referring to MBRWizard,
but your link points to an unfamiliar app. Check out this link and
see if it's more what you are looking for:
http://www.simtel.net/product.php[id]68928[cid]79[SiteID]simtel.net

Good luck,
Alex

I have PartitionMagic 8 but don't see anywhere within it how to make a
backup copy of the MBR (master boot record) and restore it. I also have
DriveImage 2002 and don't see it backup up the MBR, either. Both work
on partitions but do nothing to let me backup and restore the MBR. I
believe the Resource Kit for Windows NT 4.0 had the disksave utility to
save and restore the MBR. However, disksave is not one of the freebies
listed at ftp://ftp.microsoft.com/reskit/win2000. The index listing for
Windows XP Resource Kit (http://snipurl.com/6iml) doesn't list disksave.

I did a Google search. There are commercial utilities, like Active@
Uneraser, that let you backup and restore the MBR. I'd prefer free.
There are definite reasons NOT to use FIXMBR (from Windows XP) or FDISK
/MBR (from a Windows 9x boot floppy); see
http://www.cknow.com/vtutor/vtfdiskmbr.htm. I've already experience the
problem of a bad MBR and finding out both of those commands may not
work. There are other legitimate bootstrap programs that may inhabit
the MBR that these utilities know nothing about. In fact, in discussing
one person's use of some security & encryption software that protects
further than what permissions and EFS can do, running these utilities
will disable that security and make your drive unreadable.

You need to restore what was there, not what these hardcoded a limited
scenario tools will perform. So I need to figure out how to do a backup
of my MBR since saving disk images (using DriveImage) won't provide
*complete* recovery. I did some free tools through a Google search but
am unfamiliar with them.

* MBRtool 2.2 (http://snipurl.com/6imf). This is the one that
Powerquest (now Symantec) suggests at http://snipurl.com/6imf since
their own PartitionMagic doesn't do MBR backups (PT-Tool is now called
MBRtool).

* Cleanslate 1.0 (http://www.bootdisk.com/utility.htm)

* Seagate's DiscWizard for DOS (http://snipurl.com/67lc). I have a
Western Digital drive (the Seagate utility might still work. WD's Data
Lifeguard doesn't mention MBR backup/restore (http://snipurl.com/6imp).

* MBR Wizard (http://mbrwizard.securityorg.net/)

* head.zip, supposedly a .zip file of utilities from Powerquest
(http://snipurl.com/6in0) that includes an MBR utility. I know and
[mostly] trust Powerquest (and Symantec) but don't know this web site.
Through a search on "head.zip" at Symantec, I found an article that
mentions Powerquest's FTP link to the file. You have to copy the text
of the link because the reference takes you to the wrong page. I'll try
this for now but would like input on other and maybe better MBR
backup/restore utilities.