TeraByte Product Release Thread

Quick question about BootIt Bare Metal.

I'm considering installing it to access imaging/recovery ISOs through it instead of the Windows BCD since the Windows partition must boot in order to access the BCD. Also, planning on installing Raxco Instant Recovery (resurrection of First Defense ISR).

Am I thinking correctly that my best bet is to install BIBM first (since it replaces the MBR) and then Instant Recovery (since it's based off the PBR)? Any additional suggestions/advice appreciated. Thanks

 

jelson,

Sorry, but I don't understand what you are planning to do with BIBM.

 

Thanks for the reply, Brian. Let's see if I can clarify matters a bit more. I got the idea from the "WinPE on HD" thread: https://www.wilderssecurity.com/threads/winpe-on-the-hd.302019/

Currently doing redundancy hot imaging with Drive Snapshot and cold imaging/restoring using ShadowProtect 5 via it's WinPE ISO via Easy BCD. So much faster loading than from the CD. (Also have a Macrium WinPE ISO on BCD so I can start Drive Snapshot via cmd line and restore images if need be.)

Was thinking that using BIBM would be a more reliable option for booting WinPE and other ISOs: Easy BCD is dependent upon Windows being bootable. Also, be meaning to try out IFW/IFL since I dislike the activation hoops built into ShadowProtect.

And the last leg of my plan is to install Raxco Instant Recovery.

Just trying to wrap my mind around it all and find a best practices approach.

 

jelson,

BIBM can't boot ISOs.

BIBM can boot multiple OS (over 200) from the HD and WinPEs including most recovery environments count as OS. In general, if you can make a bootable USB flash drive you can copy the flash drive partition to the HD and boot the partition.

Does this help?

 

Brian K,

Yes, that helps.

 

Note that you may need to use FAT32 or NTFS for the partition type if placing toward the end of a large drive (FAT16 won't work properly due to its size limitations). Otherwise, place the partitions at the start of the drive.

 

Image for Windows: Upgrade History

• Version 2.93 - December 17, 2014
• TBIView Unicode version fixed display of description.
• Added new option /cdf (CDCloseOptions=1) to always finalize discs when closed.
• Added support of adding partitions to MBR even when there is a GPT.
• Catch log or power off requests and report busy if operation is in progress.
• Added X-Mailer to email headers.
• Fix potential loss of partition entry when "Change Disk" button is used to convert to MBR from EMBR or GPT when there is already a mix of partitions in and out of the MBR partition table.
• Other potential changes, updates and enhancements.

Image for DOS: Upgrade History

• Version 2.93 - December 17, 2014
• Added new option /cdf (CDCloseOptions=1) to always finalize discs when closed.
• Added support of adding partitions to MBR even when there is a GPT.
• Fix potential loss of partition entry when "Change Disk" button is used to convert to MBR from EMBR or GPT when there is already a mix of partitions in and out of the MBR partition table.
• Other potential changes, updates and enhancements.

Image for Linux: Upgrade History

• Version 2.93 - December 17, 2014
• Added new option --cdf (CDCloseOptions=1) to always finalize discs when closed.
• Added support of adding partitions to MBR even when there is a GPT.
• Added X-Mailer to email headers.
• Fix potential loss of partition entry when "Change Disk" button is used to convert to MBR from EMBR or GPT when there is already a mix of partitions in and out of the MBR partition table.
• Other potential changes, updates and enhancements.

BootIt® Bare Metal: Upgrade History

• Version 1.29 - December 17, 2014
• Updated with IFD version 2.93.
• Updated with TBOSDT version 1.56.
• Fix potential loss of partition entry when "Change Disk Type" button is used to convert to MBR from EMBR or GPT when there is already a mix of partitions in and out of the MBR partition table.
• Other potential changes, updates and enhancements.

OSD Tool Suite: Upgrade History

• Version 1.56 - December 17, 2014
• Update to OSDTOOL.TBS script.
• Fix potential loss of partition entry with SET PART TYPE to MBR from EMBR or GPT when there is already a mix of partitions in and out of the MBR partition table.
• Other potential changes, updates and enhancements.

 

Image for Windows: Upgrade History

Version 2.94 - February 8, 2015
Added new /altregview option to consolidate variables and passwords.
Added new IFW Notify system tray utility.
Added new /wait option (must be first) to wait for already running copy to end.
Updated /recover option to work with latest versions.
Adjust GPT placeholder when adding a partition to the MBR on GPT drive.
Support EXT4 64bit feature.
Other potential changes, updates and enhancements.

Image for DOS: Upgrade History

Version 2.94 - February 8, 2015
Updated /recover option to work with latest versions.
Adjust GPT placeholder when adding a partition to the MBR on GPT drive.
Support EXT4 64bit feature.
Other potential changes, updates and enhancements.

Image for Linux: Upgrade History

Version 2.94 - February 8, 2015
Updated /recover option to work with latest versions.
Adjust GPT placeholder when adding a partition to the MBR on GPT drive.
Support EXT4 64bit feature.
Update Linux Boot Disk (LBD251EN)(3.18.6).
Other potential changes, updates and enhancements.

OSD Tool Suite: Upgrade History

Version 1.57 - February 8, 2015
Update to OSDTOOL.TBS, TBIDTOOL.TBS, COPYP2V.TBS, TBEXPLO.TBS, SETWINDL.TBS, MOVEUSER.TBS scripts.
Added new COPYWIN.TBS script.
Fix version checking on .INF files.
Support EXT4 64bit feature.
Other potential changes, updates and enhancements.

BootIt® Bare Metal: Upgrade History

Version 1.29a - February 8, 2015
Updated with IFD version 2.94.
Updated with TBOSDT version 1.57.
Support EXT4 64bit feature.
Other potential changes, updates and enhancements.

 

Stupid question...

I just updated my Image for Linux and I have an odd thing I cannot figure out. If I make a bootable CD or UFD from the makedisk.exe routine, and choose any custom settings, they are created with the CD or UFD and when I boot from either of them, the custom settings are active. But if I make just an ISO file for my Easy2Boot UFD, any custom settings are not retained and when I boot to that session, I have to make any changes a 2nd time.

Why is this happening? Is there something I'm missing?

 

From a TeraByte forum post on the subject:

 

MudCrab: Thanks for the info. Waaaay to much to do to just make it boot with one or two custom settings. So I won't be doing it.

At least I know it's not me!

 

Image for Windows: Upgrade History Version 2.95 - April 14, 2015

• Added multicast support via format of file given with /f option on command line.

• Added /tcpdata (TCPData) option (enabled by default).

• Added /usnrf (USNRollBackFix) option (enabled by default).

• Other potential changes, updates and enhancements.

Image for DOS: Upgrade History Version 2.95 - April 14, 2015

• Added /usnrf (USNRollBackFix) option (enabled by default).

• Other potential changes, updates and enhancements.

Image for Linux: Upgrade History Version 2.95 - April 14, 2015

• Added multicast support via format of file given with /f option on command line.

• Added --tcpdata (TCPData) option (enabled by default).

• Added --usnrf (USNRollBackFix) option (enabled by default).

• Added hardware wipe options to partwork.

• Update Linux Boot Disk (LBD253EN)(3.18.11).

• Other potential changes, updates and enhancements.

OSD Tool Suite: Upgrade History Version 1.58 - April 14, 2015

• Update to OSDTOOL.TBS, TBIDTOOL.TBS, COPYP2V.TBS, TBEXPLO.TBS, SETWINDL.TBS, MOVEUSER.TBS, COPYWIN.TBS scripts.

• Added new CHGDTYPE.TBS script.

• Other changes, updates and enhancements.

BootIt® Bare Metal: Upgrade History Version 1.30 - April 14, 2015

• Updated with IFD version 2.95.

• Updated with TBOSDT version 1.58.

• Other potential changes, updates and enhancements.

 

Image for Windows: Upgrade History Version 2.97 - June 15, 2015

• Added /vblba (VoldBPBLBA) option to force LBA of volume to BPB instead of normal LLBA offset from EBR.
• Added /geoav (GlobalGeoAlignVal) and /av (AlignVal) options for user defined custom alignment (use byte value).
• Changed message on simple restore when no backups found with more details for users who created recovery media in wrong mode.
• Other potential changes, updates and enhancements.

Image for DOS: Upgrade History Version 2.97 - June 15, 2015

• Added /vblba (VoldBPBLBA) option to force LBA of volume to BPB instead of normal LLBA offset from EBR.
• Added /geoav (GlobalGeoAlignVal) and /av (AlignVal) options for user defined custom alignment (use byte value).
• Changed message on simple restore when no backups found with more details for users who created recovery media in wrong mode.
• Other potential changes, updates and enhancements.

Image for Linux: Upgrade History Version 2.97 - June 15, 2015

• Added --vblba (VoldBPBLBA) option to force LBA of volume to BPB instead of normal LLBA offset from EBR.
• Added --geoav (GlobalGeoAlignVal) and --av (AlignVal) options for user defined custom alignment (use byte value).
• Changed message on simple restore when no backups found with more details for users who created recovery media in wrong mode.
• Update Linux Boot Disk (LBD255EN)(3.18.13) to use VeraCrypt.
• Other potential changes, updates and enhancements.

OSD Tool Suite: Upgrade History Version 1.60 - June 15, 2015

• Misc adjustments to most scripts.
• Other potential changes, updates and enhancements.

BootIt® Bare Metal: Upgrade History Version 1.31 - June 15, 2015

• Updated with IFD version 2.97.
• Updated with TBOSDT version 1.60.
• Added /geoav (GlobalGeoAlignVal) and /av (AlignVal) options for user defined custom alignment (use byte value).
• Other potential changes, updates and enhancements.

 

From Image for Windows User Manual:

I was wondering if in the case of a MBR infection using this option when restoring a full backup will eradicate a rootkit or any kind of malware related to MBR code?

 

Mister X,

I've asked this question in the past and was advised the infected boot code would be replaced by good standard code.

 

Thanks a lot Brian.
There's still another doubt though, respect this part:

Then the logical question is: if a rootkit infects that other portion of MBR the infection does persist? I guess it does.

 

In situation like this, simply run a "clean" command, followed with low level format.

 

The problem is how to know, besides it's not practical for me as I have a second DATA partition which I don't want to transfer temporarily to another drive to finally rebuild my HDD structure again.

 

Mister X,

Lets say your boot code, partition table and disk signature had been damaged by the rootkit. Then your OS wouldn't boot and you wouldn't be able to see any partitions with a boot disk. To recover you would restore a good image and choose the option of Restore First Track. (The First Track is always backed up when you create an Entire Drive or a Partition mage) The First Track used to be the first 63 sectors (legacy MBR disks) but now I think it's the first 128 sectors. Boot code, Partition table and Disk Signature are in the first sector, LBA-0. With GPT disks it's slightly different but Restore First Track will cover that as well.

So if your First Track and OS are infected, restoring a good image and First Track will fix the problem.

Just a comment on the Diskpart "clean" command. You can recover your partitions in a minute or so with BIBM "Write Standard MBR" and then "Undelete".

 

Thank you for detailed explanation. Want to note that you're talking about a rootkit which destroyed my partitions and disk structure, yet I was talking about a well-written rootkit which doesn't destroy anything but it's there to infect he OS with even more malware droppers, etc. Either way with your explanation how this things works I'm covered and it's good to know. Thanks once again.

 

@Brian K
So just be sure whenever I restore my system image, for whatever reason, is it correct to check the boxes?:

• Write Standard MBR Code
  
• Restore First Track (leaving it in AUTO?)

Spoiler

I mean, this move won't do any harm whether I'm infected or not.

 

Mister X,

For general information, the MBR is the first sector on the drive, LBA-0. It consist of three components: boot code, disk signature and partition table. The First Track (MBR disks) is the first 63 sectors on the drive, LBA-0 to LBA-62. So the First Track includes the MBR. Remember, the MBR and First Track are outside of all partitions. When you are restoring images to the same drive, the MBR and First Track are already present so restoring them is not necessary. But if you do choose Restore First Track, no issues, When restoring an image to a new, empty drive you would want to Restore First Track. But this is not essential if you knew the First Track sectors LBA-1 to LBA-62 were empty. Mostly we don't know this so choose Restore First Track.

Regarding Write Standard MBR Code, I've never needed to use it. If you restore an image to a new, empty drive (so no boot code is preset) and don't select Restore First Track then the TeraByte app will automatically Write Standard MBR Code.

 

Thank for your help.
Certainly I was telling about restoring a system image to the same drive so I think it would be fine to check those mentioned boxes for general scheduled maintenance I like to do every 45 or 60 days, again whether there's a MBR infection or not (note that I do not use signature based scanners or the like hence it's hard to tell).

Bottom line I'll check those boxes in the program interface every time from now.

 

Users with special boot code should not select Write Standard MBR. Some OEM computer manufacturers (eg Dell) use special boot code to allow access to recovery partitions. I have special boot code for multi-booting (BIBM) and replacing this boot code with Standard boot code would destroy my multi-boot. If you don't have special code then you can use this option if you desire.

 

No I don't have one. Thank you for your time and help.