write mbr and table of partition in a file,need help

Hi
i need help
i have 2 questions

1)
i need to write mbr and table of partition in a file

i boot with the cd recory disk director 10
select the hard disk -> edit ->View as Hex

what i have to select to export mbr and master table of partition to save in a file (to back up) ?
where are stored the partitition data? i mean all the data , information about my partitions without make change on my partitions? so i can recover if i will do an error?




2)can a program like paragon or partition magic change my partitions setting/data? i mean not change the size of my partition or change the table of partitition ? if yes how can i detect it?


thanks
have a nice day

 

You should select all 512 bytes in absolute sector 0 and save it to a file (bytes 000 to 1ff). This sector contains the boot code and the partition table. Take a look at this picture of sector 0. The portion outlined in yellow is the partition table (64 bytes). The partition table contains all of the information about your partitions. Most of the rest of sector 0 contains the boot code needed to find and boot the partition marked as "Active" in the partition table.

Be very careful in making use of this backup file. You should only restore it if you have not made any changes to the locations of partitions. Keep in mind that the partition table is like an index - it only stores the location of the partitions. If you move one of them to a new location, and then restore an old partition table, the index will be pointing to the wrong location and you may lose your data.

If your question is about backing up the data in your partitions then you should use imaging software like Acronis True Image to back up your disk.

I'm not sure what you're asking here. Programs like Paragon or Partition Magic are capable of making changes to the partition table, but they don't do this on their own. You have to initiate a change by running the program and deliberately making a change.

 

thanks for the answer

i run the recovery cd
acronis full (not safe version)
edit->view as Hex
but i selected the (bytes 000 to 1fa) and not 1ff like you wrote

but in a hard disk of 320gb the only data respect the number and type and size of the partitions are only in these few bytes,i can't believe

by the way i guess there is a bug in acronis disk director 10 last build
because i save it , and without making change i load many times this file and the partitions did disapear
i mean i lost them



If your question is about backing up the data in your partitions then you should use imaging software like Acronis True Image to back up your disk.
some malware destroy the partition table and so with a back up i should restore easy

 

i tried paragon Hard Disk Manager boot cd , and on the partition c: i select Check file system integrety and hard disk manager after pop up with a "rebuilding partition info" so maybe i did change my partition


and if i remember good , acronis disk director keeps 2 or 4 mb between the partition , i guess to store data or?

 

That's probably because part of the partition table (the entry for the fourth slot in the table) is contained in the bytes 1fa - 1fd, so if you didn't save these bytes then you didn't back up the entire partition table.

The easiest thing to do is to back up all of the first sector, bytes 000 - 1ff. When restoring of course, be sure to put it back in the same place, 000 - 1ff.

 

but i can't see 1ff ...

 

Can you post a picture? Byte 1ff is highlighted in this picture:

 

sorry i used the boot cd because i have not installed in this pc acronis
what's wrong with my pc?
again sorry for my poor screenshots and thank you

 

There's nothing wrong with your PC - byte 1ff is there. The byte in the leftmost column is 1fa (circled in blue). The byte circled in red is 1ff.



You should resize your window so that there are 16 columns showing; this will make it easier to interpret (see my screenshot). You can resize the window from the boot disk also if you don't maximize it.

 

but why do you have on the left 01f0 and me 1FA
i mean the number on the left of your screenshots are different by mine,do you know why?

maybe is the recovery cd that doesn't work perfectly

 

The byte number shown in the left column is for the first byte in that row. As you resize the window, you'll notice that these values change. That's why Mark said to resize to 16 bytes wide. That lets you see them in even rows for hex (base-16).

Byte 1FF is the last byte of the sector. If you want to backup the complete sector, you need all 512 bytes: 000 - 1FF hex

 

yes!
thanks!
sorry for my ignorance

 

but i have only few question

i remember that acronis disk director uses some mb (don't know 2mb or 4mb) between the partitions or some mb at the end of the hard disk
is true?
i mean all the data about the partition is store 512 bytes
i sure in the hardisk there are sensitive data about partitions

 

Most of the information about a partition is stored inside the partition. The 64-byte partition table in the MBR is only an index - it contains the partition's starting and ending sectors, for example. The partition itself has most of the information; - type of filesystem; Master File Table (MFT) for NTFS or File Allocation Table (FAT) for FAT12, FAT16, FAT32; mirror copies of the MFT or FAT; etc.

Any gaps between partitions are unused; there's nothing hidden in there. Depending on the software used to create the partition there may or may not be gaps between partitions. Most existing partitioning software creates a 63-sector gap between the start of the disk and the start of the first partition. Windows Vista and later creates a 2048-sector gap.

You may find this interesting...

 

thank you so much

but to restore the master table i have to go -> edit ->View as Hex
under the menu edit
1) load the file (i saved with mbr and master table)
2)save sector
that's it , or i should do other operation?

it's more safe work with the recovery cd or with disk director windows version?

could have sense restore the mbr or mastertable if xp doesn't start maybe after an malware activity or there is a better strategy outside the image



and ps i see you use ti10 and disk director 10,do you think it's the best combo? better then ti9 and dd10?
i use ti9 and dd10

 

That should work. When you load the file on top of the current contents of the sector, DD will display any changed bytes in color so you can see if there are any changes before you save the sector.

It doesn't matter. Sector 0 is outside of the Windows partition so you can work on it while Windows is running.

TI 10 added better support for Linux; you can view the contents of Linux partitions in backup archives while running the Windows version of the program. All in all, most forum regulars seem to think that TI10 was the best version of TI to date.

 

no i mean resize , move (comon operation )paritions

 

You can use the Windows version of DD to make changes to non-system partitions. For example, if you have a data partition you can safely change that in Windows. DD will prompt for a reboot if you attempt to make a change that affects the Windows partition from the Windows version of the program. I avoid making any partition changes to the Windows partition from the Windows version of DD. I always do these from the Boot CD.

If you read some of the posts in this forum you will find many, many users who tried to initiate a change in Windows and found that DD would reboot and then nothing would get changed. If one of the operations fails during the reboot phase there is no feedback to the user; it just simply fails. This is the major reason that I prefer the boot CD - you can watch the progress and you are given feedback while operations are completing. If something doesn't work you will know about it and can take corrective action.

 

thank you so much for kindness
i will use the boot cd
i have ti9 , there is not way to update to 10 or 11 , isn't it? i can update only to ti12 2009 ,but i guess it's buggy and i did not find great new feature
i would like a home version with the ability to restore an image to a different pc with different hardware


in short , outside the partition table , all the data(info every thing about a partition in xp are stored in MFT ,right?