MBR Backup

I was thinking of the following possible future situation: A PC is infected with a Rootkit/Bootkit and won't boot. I want to save/backup the infected MBR for later Malware analysis.

If a person wanted to backup only the MBR using a Live CD or bootable media, what would be the best way and preferred Software/OS for backing up the MBR?

Thanks in Advance.

 

With OS off you can use e.g. MbrFix - a command line interface (CLI) app..
With OS on you can use MBRBackup - a TrojanHunter tool.

Both allows to backup and restore MBR.

 

MBRWork from TeraByte Unlimited. You can also create a new MBR with this tool if you didn't have your infected MBR previously backed up.

 

Not compatible with Windows 7 x64.

 

I have just confirm...

 

Guys,

I have Win8 64-bit. MBRWork works fine. Why do you say it doesn't work with Win7?

 

I just tested it with Win7 64-bit. It works fine.

 

Can do it from any Linux live CD/USB, from the command-line using dd.

You simply need to grab the first bit of the disk:

dd if=/dev/sda of=/mbr.bak bs=446 count=1

Cheers, Nick

 

I get an error message: "The version of this file is not compatible with the Windows version you are using..." (translated).

 

OK. MBRWork is a DOS app. You run it from a DOS USB flash drive. When Windows won't boot because of a "damaged" MBR you want an environment that will work.

Remember, in DOS the flash drive will be Drive 0. Your primary drive will be Drive 1.

You can make a DOS flash drive with this...

http://www.softpedia.com/get/System/Hard-Disk-Utils/HP-USB-Disk-Storage-Format-Tool.shtml

http://www.softpedia.com/progDownload/HP-USB-Disk-Storage-Format-Tool-Download-123786.html

 

Even easier. You can put it on a TBOSDT UFD.

 

How do you set up/use a TBOSDT UFD?

 

Sure.

http://www.terabyteunlimited.com/tbosdt.htm#download

In the DOS_TBOS folder double click maketbos.exe
In the optional components select TeraByte Command Script Processor
Leave the defaults for the flash drive

Copy mbrwork.exe to the flash drive

Boot from the flash drive and you will see this prompt

>

Type mbrwork.exe and press Enter

HD0 will be the flash drive but this is BIOS dependent. Use Option 7 (Change active hard drive) to find your relevant HD. If you are uncertain, disconnect the non boot HDs and try again.

Option 1 (Backup First Track) This backs up LBA 0 to LBA 63. The MBR is LBA 0. (Some apps call the First Track the MBR)
Exit

Have a look at the flash drive in Windows and you will see BACKUP1.BIN with a file size of 32 KB.

To restore the backup, boot from the flash drive, start mbrwork.exe, find your HD.
Because you now have a backup on the flash drive you will have Option 2 (Restore First Track)
Option 2
You will see a Warning and be asked if you want to continue
Y
Exit

It's easy. Just make sure you are working on the correct HD.

 

Thank you.