Best Way To Protect Your MBR?

What is the best way to protect your MBR? I've heard about that program nprotect. Any other suggestions?

 

AppGuard protects writes to the MBR,I highly recommend it.

 

FYI... the AppGuard element that protects the MBR is the nProtect element.

 

Ah! I was not aware of that.Then may be Nprotect would suffice along with a clean image backup including the MBR just in case.

 

DS, I consider a "clean image backup including the MBR" a requirement rather than a "just in case."

The only problem with nProtect is the non-English translation. But, it only has two CHECKable functions... one being on/off and the other I think is automatic System Startup.

I use it in conjunction with both Rollback-enabled systems and Shadow Defended systems... it appears to work well but I've not attached it with known rootkits, etc.

 

I thought so as well - until it wasn't worth anything to me!

Cruise

 

Hi, ShadowDefender will

 

Shadow Defender does do that with out a doubt.

 

Run as a Standard user and don't install rootkits. That's about all it takes

 

All good suggestions posted already but my preferred choice is DefenseWall + Shadow Defender.
Nothing wrong with covering my butt with double the protection on the mbr.

 

MBR Guard from BlueRidge is nProtect?

 

Either AppGuard or an athletic cup depending on the mbr you want to protect.

 

It's nice to have a backup of the MBR but it's not essential. If your MBR is completely wiped you can create a new one and within 2 to 3 minutes you can boot back into your OS with all data intact.

 

Ditto!

 

I personally use a little CLI program called MBRwizard to backup the MBR. I also backup more than just MBR, as I began to backup 0-103 sectors just in case type of thing, but that is not necessary if grub, etc., is not installed, I learned that from Brian I believe he mentioned grub places itself to sector 103, but I do not use grub. Typically, MBR full back up would be 0-63 or as some apps backup 1 - 63.

If MBR goes corrupt, I can boot to DOS command prompt and use the app to restore whatever sectors I backed up. I also have a backup via IFL but not sure if it backs up the entire track 0 - 63.

Another app to backup that appears to work well is MBRfix or also bootice.

Just my thoughts, in addition to the other valuable comments.

 

Jim,

The TeraByte apps backup LBA-0 to LBA-127.

 

Oh, thank you Brian! Now that is covering it LOL

Is this 'standard' or common with most imaging apps, or is this mainly Terabyte? I know many backup track 0 or 0-63 I believe.

Appreciate the info my friend. Have a good night!

Jim

 

Jim,

I don't know. I thought imaging apps only saved the first 63 sectors and I was surprised to find the TeraByte apps backed up more than just the 63 sectors of the First Track.

 

You could take a look at MBR Backup. It's pretty simple - pretty straight forward: http://www.trojanhunter.com/products/mbr-backup/

 

TomAZ,

How does one restore the MBR using that app if the MBR has been wiped and you can't get into Windows? The web page doesn't mention how to restore.

 

You can run this from a BartPE environment.

 

why not just restore from image or use windows USB to repair boot sequence?

 

andyman35,

Have you tried to do it? I tried it from a WinPE CD and a WinPE USB flash drive. As a test I'd already zeroed the MBR on HD0. MBR Backup 2.0 not only can't find HD0, it can't find the MBR backup of HD0 on the flash drive.

So on my hardware the app is a failure from WinPE. It can't restore the backup.

 

Hi Brian

Please can you clarify for my own knowledge:
I was told that Performing a back-up image of drive C is also making a back-up of the MRB?
and thus when the MRB is corrupted, restoring the "full" image of the C drive will also restore the MRB.
Is it correct?

Thanks

 

samy,

I think most imaging apps do that. Ghost 2003 doesn't do it. I know the TeraByte apps backup the First Track (LBA-0 to LBA-62) whenever a partition image is created. Any partition image. C: drive, D: drive, etc. You can choose to restore the First Track if you desire. But by design, the partition table is not backed up.

If you create an Entire Drive image with the TeraByte apps the First Track is restored automatically. You can't choose not to restore it if you restore the entire drive. The partition table is backed up and restored.

But as I mentioned above, if your MBR is wiped amd you don't have a MBR backup you can create bootstrap code, a Disk Signature and undelete your partitions. All done in a few minutes and you are back to normal.