Recreate MBR without losing data

[Juddog]

Situation: MBR gets wiped out from boot loader program. Is there a way to recreate this without wiping out all of my data?

 

[Aberforth]

Partition Table Doc:http://www.ptdd.com/index.htm *

*- use it at your own risk.

 

[Smilin]

short answer, yes. Let us know what OS's. Assuming a Windows Simple volume..

Your sector 0 basically looks like:

MBR code
leftover space for larger MBRs
4 line partition table.
End of sector marker.

There is no actual data in sector 0. Anything there can be reconstructed. MBR can be loaded (for windows) by running FIXMBR.

Note that fixmbr writes that blank space between mbr and parition table by writing blanks until it gets some calculated distance away from the end of sector marker. If the marker is missing it will zero the partition table.

Partition table can always be reconstructed by hand with diskprobe (some utility automates it I'm sure) simply by finding the start & stop sectors of your partitions. These are found by searching for the partion boot sectors as well as the end of partition backup of the same.

 

[Nothinman]

Partition table can always be reconstructed by hand with diskprobe (some utility automates it I'm sure) simply by finding the start & stop sectors of your partitions. These are found by searching for the partion boot sectors as well as the end of partition backup of the same.

Sadly, anything that scans your disk looking for partitions by looking for filesystem signatures will quickly get confused if you have any VM disk images on there too.

 

[Tennoh]

Sadly, anything that scans your disk looking for partitions by looking for filesystem signatures will quickly get confused if you have any VM disk images on there too.

How so? Assuming its just the MBR that's fubar, then your boot sector, usually at sector 63, should contain valid hex geometry of the partition. With that you can confirm the end sector by sector mapping. Once that's done you can input the valid geometry back into your MBR and voila, viewable partitions. Done it tons of times while in Microsoft ESS team.

 

[Nothinman]

How so? Assuming its just the MBR that's fubar, then your boot sector, usually at sector 63, should contain valid hex geometry of the partition. With that you can confirm the end sector by sector mapping. Once that's done you can input the valid geometry back into your MBR and voila, viewable partitions. Done it tons of times while in Microsoft ESS team.

Because I was talking about automated software like gpart.

 

[C1]

Essential disk maintenance tools have moved to the Recovery Console,
which is available when you boot from the original XP CD. You cannot
actually change the MBR while XP is running.

Here's the Microsoft support article which describes how to access the
Recovery Console:

http://support.microsoft.com/?kbid=314058

Once you're in the RC, use the command FIXMBR, which is the equivalent
of fdisk /mbr (it writes a fresh copy of the MBR).

 

[Smilin]

Originally posted by: Nothinman

How so? Assuming its just the MBR that's fubar, then your boot sector, usually at sector 63, should contain valid hex geometry of the partition. With that you can confirm the end sector by sector mapping. Once that's done you can input the valid geometry back into your MBR and voila, viewable partitions. Done it tons of times while in Microsoft ESS team.

Because I was talking about automated software like gpart.

There is some stuff out there that can automate it. Who's that big data recovery place? ..been to long., they had some utilities CD that did some of this. I haven't actually done digging but I would be surprised to hear that nobody has written a good one.

VM disk images shouldn't freak it out too bad. The boot sector wouldn't necessarily be on a sector boundary if inside a file and you would have a lacking or mismatching backup boot sector at the end of the partition plus a missing boot back to back boot sector marking the start of the next. You might also end up with over 4 partitions without an EBR which would trigger software to question the sector scan result.

Your best bet is always diskprobe and some kung-fu though.



edit: Ontrack is the name of that company.

 

[Smilin]

Originally posted by: C1
You cannot actually change the MBR while XP is running.

If Microsoft said this, and I'm not saying they didn't, it would be a bit of a white lie.

It's kindof like "you can't change a dynamic disk back to basic"...it takes changing one byte in the partition table often times. It's those other more complicated times that makes it best to tell folks it can't be done.

 

[Juddog]

Originally posted by: C1
Essential disk maintenance tools have moved to the Recovery Console,
which is available when you boot from the original XP CD. You cannot
actually change the MBR while XP is running.

Here's the Microsoft support article which describes how to access the
Recovery Console:

http://support.microsoft.com/?kbid=314058

Once you're in the RC, use the command FIXMBR, which is the equivalent
of fdisk /mbr (it writes a fresh copy of the MBR).

I had heard rumors that running this would cause damage to the data on the drive itself. Will running the fdisk /mbr from the command console affect the data in any way other than the MBR?

 

[Smilin]

No, this is all sector 0 stuff. Partition boot sectors, MFTs and data are unrelated.

The worst that could happen is if the end of sector marker was damaged. It would cause the partition table to get wiped. This can be recovered either with some utilities out there or if push comes to shove I'd help you do it with diskprobe*



*would require you to mount the drive in a working box, install diskprobe, and then we'd setup a livemeeting (remote desktop) session.