How to use the MBR Floppy

Earlier I loaded a drive image of a fresh windows install and tried rollbackrx. after several hours, i wanted to bring back my working drive image (which had fdisr on it), i didnt uninstall rollback. I just booted Image for dos and then did a recovery.

after recovery, rollbackrx boot menu still showed (i didnt press anything). after that menu showed up, then fdisr boot menu showed up. after that it was BSOD.happened about 3 consecutive times. yes i was scared. anyway, i got it fixed. rollback had an uninstall option. after several reboots and restores with ifd, it was ok.

im not sure if what i did was right. first i inserted mbr floppy and booted from it. i dont think it booted, or maybe im wrong. i cant remmber all the messages in dos, im not good with dos.

then i tried a floppy created through windows, format a:\, create ms dos start up disk. it booted, i got the command prompt, removed the ms dos startup floppy. then i inserted the mbr floppy and went to the mbr tool directory, and then typed mbrtool - reset. lol, im not sure if thats the right one to do, im not good with this. please advise on what is the right way.

thanks

dina

 

Dina,
When you recovered your image with FDISR on it, did you include the MBR in the recovery ?
If you didn't include the MBR and you recovered only the partition, then you are in trouble.
If you did include the MBR, then you would have everything back without troubles.

 

Erik,
I took the image of the c: partition using Image for windows. my backup image is located in the d: partition. i think mbr is included when imaging, im back on line right now.

i was just alarmed bcoz even after i made a full image recovery of c:, rollback was still there during boot time, after rollback's boot menu would appear, fdisr's boot menu would appear. then bsod. i went through several bsods and recoverys before i got back.


thnx Peter2150 and ErikAlbert for the replies

 

If you included the MBR and your RollbackRx boot menu was still there, then your image backup software doesn't work properly.
An image backup file (MBR + partition) has to put your system back as it was before and if it doesn't do that, your backup software doesn't work properly.

 

One thing I know for sure, ATI does recover backup file (MBR + patition) completely.
What is the point of restoration, if you don't get what you expected ? That's unacceptable.

 

I wasn't talking about you Peter, I was talking about Dina.
I know your combination is working fine from other posts.

 

Dina


Can you please tell us when you restored your image of C drive from the partition and tried to boot the RollbackRx showed up first(Thats how i understand) then FDISR preboot screen and then BSOD......Thats quite natural....


Would you please tell if you press the home key when rollback was showing you were able to access the minos of Rollback and you tried to uninstall or did you try to see any of the snapshots showing which were created by rollbackrx.....Secondly where were you able to uninstal rollback rx from the miniOS...... and then everything was normal or it is that you had to cleanly restore your MBR.......... from a any of MBR floppies.......?


One thing is clear if your MBR is screwed then your imaging apps who cant restore MBR then you are in a bit of bother...nothing life threatening incident however still a pain

Knight


PS I agree with Erik

 

i was able to uninstall rollback that way. or at least remove what it had on the mbr as by this time, i already had a new image in the c drive.

so btw, nobody knows how to use the mbr floppy

i4windows doesnt backup mbr right? or does it?

 

What you or I think of IFW/IFD's MBR backup policy or lack thereof is irrelevant. Dina asked for help. What's the point of rubbing a person's nose in what they do or don't know ? I find THAT unacceptable.

IFD/IFW does NOT backup or "restore" the MBR. IFD will check whether an MBR is present. If an MBR is present, IFD leaves it alone. If an MBR is NOT present, IFD will write a standard MBR to the drive. That works fine for me but that's, again, irrelevant.

If you find yourself without a standard MBR in any event, you always have the option of booting into Windows' Recovery Console and using the FIXMBR command.

You will find in the folder "C:\$ISR\$MBR", the RAXCO file Readme.txt, which reads as follows:

Raxco does not point out, even in the FD-ISR Help screens, that the floppy will not be bootable. In the help screens, they only advise you to use a formatted floppy to create the MBR floppy.

If you were to create a BOOTABLE formatted floppy, as you can in Windows Explorer by checking the box labeled "Create and MS-DOS startup disk" in the "Format" dialogue, and insert that during the MBR Backup Wizard dialogue, THEN you would have a floppy that you can boot from and use to restore the backed up MBR to your C: drive.

Here is some further instruction from Raxco's knowledge base: http://www.raxco.com/support/windows/kb_details.cfm?kbid=417

 

i agree with all points of crofttk. i do have ati too, registered but not installed, used it for a long time without failin me.but i didnt ask about that.

i4w i4d is a personal preference. it works best based on my personal computing habits and noone can tel me otherwise. i like i4w i4d beter. period.

back to topic.

thanks peter and crofttk for the replies.

good day to all.

 

Upto now, I assumed that FDISR & IFW/IFD were working fine together and recovered the system partition and MBR.
Now, I read in this thread, that IFW/IFD doesn't recover the MBR from the backup file.
IFW/IFD makes its own decisions regarding the MBR instead of the user and that's why the user has to recover the MBR himself by enabling the Pre-boot in FDISR after a restoration with IFW/IFD, which is for me a workaround to fix it, because IFW/IFD doesn't do it.

Restoring an image backup file means : put everything back as it was before
Anything else is unacceptable and other opinions don't matter because this is a BASIC rule without exceptions.
Member "twhk000" seems to be the only one in this thread, who knows the true meaning of restoration, while the rest of you consider this as normal (make it work, whatever it takes).

Upto now, I thought IFW/IFD was just not userfriendly, but now I have a better reason not to use IFW/IFD.
For me, FDISR & IFW/IFD is a no go, because it doesn't restore the image completely.

I don't have to do anything special after restoring a backup file with Acronis True Image, because ATI knows how to do it right and does what average users expect.

Let me know, if ShadowProtect recovers an image backup file COMPLETELY, just like ATI.
If it does, I have another image backup software in the background, that works properly with FDISR.

 

You cannot conclude that from what Pete said and its not true unless your MBR has been altogether deleted.

Please refrain from the insults about and characterizations of what I know and don't know. I don't say everything I think and most civilized and normal people also don't say everything they think, but it's not for you to loudly and publicly fill in the gaps of what they don't say with information and OPINIONS of your own choosing.

 

Thanks for the reply mates....


Here is some valuable information perhaps it will provide an tech insight as to what exactly happens when press the power button....



Power supply switched on.

The power supply performs a self-test. When all voltages and current levels are acceptable, the supply indicates that the power is stable and sends the Power Good signal to the processor. The time from switch-on to Power Good is usually between .1 and .5 seconds.



The microprocessor timer chip receives the Power Good signal.


With the arrival of the Power Good signal the timer chip stops sending reset signals to the processor allowing the CPU to begin operations.



The CPU starts executing the ROM BIOS code.


The CPU loads the ROM BIOS starting at ROM memory address FFFF:0000 which is only 16 bytes from the top of ROM memory. As such it contains only a JMP (jump) instruction that points to the actual address of the ROM BIOS code.



The ROM BIOS performs a basic test of central hardware to verify basic functionality.


Any errors that occur at this point in the boot process will be reported by means of 'beep-codes' because the video subsystem has not yet been initialized.



The BIOS searches for adapters that may need to load their own ROM BIOS routines.


Video adapters provide the most common source of adapter ROM BIOS. The start-up BIOS routines scan memory addresses C000:0000 through C780:0000 to find video ROM. An error loading any adapter ROM generates an error such as:

XXXX ROM Error

where XXXX represents the segment address of the failed module.



The ROM BIOS checks to see if this is a 'cold-start' or a 'warm-start'


To determine whether this is a warm-start or a cold start the ROM BIOS startup routines check the value of two bytes located at memory location 0000:0472. Any value other than 1234h indicates that this is a cold-start.



If this is a cold-start the ROM BIOS executes a full POST (Power On Self Test). If this is a warm-start the memory test portion of the POST is switched off.


The POST can be broken down into three components:
The Video Test initializes the video adapter, tests the video card and video memory, and displays configuration information or any errors.
The BIOS Identification displays the BIOS version, manufacturer, and date.
The Memory Test tests the memory chips and displays a running sum of installed memory.


Errors the occur during the POST can be classified as either 'fatal' or 'non-fatal'. A non-fatal error will typically display an error message on screen and allow the system to continue the boot process. A fatal error, on the other hand, stops the process of booting the computer and is generally signaled by a series of beep-codes.


The BIOS locates and reads the configuration information stored in CMOS.


CMOS (which stands for Complementary Metal-Oxide Semiconductor) is a small area of memory (64 bytes) which is maintained by the current of a small battery attached to the motherboard. Most importantly for the ROM BIOS startup routines CMOS indicates the order in which drives should be examined for an operating systems - floppy first, CD-Rom first, or fixed disk first.


Fixed Disk

If the first bootable disk is a fixed disk the BIOS examines the very first sector of the disk for a Master Boot Record (MBR). For a floppy the BIOS looks for a Boot Record in the very first sector.


On a fixed disk the Master Boot Record occupies the very first sector at cylinder 0, head 0, sector 1. It is 512 bytes in size. If this sector is found it is loaded into memory at address 0000:7C00 and tested for a valid signature. A valid signature would be the value 55AAh in the last two bytes. Lacking an MBR or a valid signature the boot process halts with an error message which might read:


NO ROM BASIC - SYSTEM HALTED

A Master Boot Record is made up of two parts - the partition table which describes the layout of the fixed disk and the partition loader code which includes instructions for continuing the boot process.


MBR


With a valid MBR loaded into memory the BIOS transfers control of the boot process to the partition loader code that takes up most of the 512 bytes of the MBR.


The process of installing multiple operating systems on a single PC usually involves replacing the original partition loader code with a Boot Loader program that allows the user to select the specific fixed disk to load in the next step of the process

Partition Table


The partition loader (or Boot Loader) examines the partition table for a partition marked as active. The partition loader then searches the very first sector of that partition for a Boot Record.


The Boot Record is also 512 bytes and contains a table that describes the characteristics of the partition (number of bytes per sectors, number of sectors per cluster, etc.) and also the jump code that locates the first of the operating system files ( IO.SYS in DOS).

Operating System

Boot Record

The active partition's boot record is checked for a valid boot signature and if found the boot sector code is executed as a program.


The loading of Windows XP is controlled by the file NTLDR which is a hidden, system file that resides in the root directory of the system partition. NTLDR will load XP in four stages:

1) Initial Boot Loader Phase
2) Operating System selection
3) Hardware Detection
4) Configuration Selection


NTLDR
Initial Phase


During the initial phase NTLDR switches the processor from real-mode to protected mode which places the processor in 32-bit memory mode and turns memory paging on. It then loads the appropriate mini-file system drivers to allow NTLDR to load files from a partition formatted with any of the files systems supported by XP.


Windows XP supports partitions formatted with either the FAT-16, FAT-32, or NTFS file system.

NTLDR
OS Selection
BOOT.INI


If the file BOOT.INI is located in the root directory NTLDR will read it's contents into memory. If BOOT.INI contains entries for more than one operating system NTLDR will stop the boot sequence at this point, display a menu of choices, and wait for a specified period of time for the user to make a selection.


If the file BOOT.INI is not found in the root directory NTLDR will continue the boot sequence and attempt to load XP from the first partition of the first disk, typically C:\.


F8

Assuming that the operating system being loaded is Windows NT, 2000, or XP pressing F8 at this stage of the boot sequence to display various boot options including "Safe Mode" and "Last Known Good Configuration"


After each successful boot sequence XP makes a copy of the current combination of driver and system settings and stores it as the Last Known Good Configuration. This collection of settings can be used to boot the system subsequently if the installation of some new device has caused a boot failure.

NTLDR
Hardware Detection


If the selected operating system is XP, NTLDR will continue the boot process by locating and loading the DOS based NTDETECT.COM program to perform hardware detection.


NTDETECT.COM collects a list of currently installed hardware components and returns this list for later inclusion in the registry under the HKEY_LOCAL_MACHINE\
HARDWARE key.

NTLDR
Configuration Selection


If this computer has more than one defined Hardware Profile the NTLDR program will stop at this point and display the Hardware Profiles/Configuration Recovery menu.


Lacking more than one Hardware Profile NTLDR will skip this step and not display this menu.


Kernel Load


After selecting a hardware configuration (if necessary) NTLDR begins loading the XP kernel ( NTOSKRNL.EXE).


During the loading of the kernel (but before it is initialized) NTLDR remains in control of the computer. The screen is cleared and a series of white rectangles progress across the bottom of the screen. NTLDR also loads the Hardware Abstraction Layer ( HAL.DLL) at this time which will insulate the kernel from hardware. Both files are located in the \system32 directory.

NTLDR
Boot
Device Drivers


NTLDR now loads device drivers that are marked as boot devices. With the loading of these drivers NTLDR relinquishes control of the computer.


Every driver has a registry subkey entry under HKEY_LOCAL_MACHINE
\SYSTEM\Services. Any driver that has a Start value of
SERVICE_BOOT_START is considered a device to start at boot up. A period is printed to the screen for each loaded file (unless the /SOS switch is used in which case file names are printed.


Kernel Initialization


NTOSKRNL goes through two phases in its boot process - phase 0 and phase 1. Phase 0 initializes just enough of the microkernel and Executive subsystems so that basic services required for the completion of initialization become available.. At this point, the system display a graphical screen with a status bar indicating load status.



XP disables interrupts during phase 0 and enables them before phase 1. The HAL is called to prepare the interrupt controller; the Memory Manager, Object Manager, Security Reference Monitor, and Process Manager are initialized.

Phase 1 begins when the HAL is called to prepare the system to accept interrupts from devices. If more than one processor is present the additional processors are initialized at this point. All Executive subsystems are reinitialized in the following order:

1) Object Manager
2) Executive
3) Microkernel
4) Security Reference Monitor
5) Memory Manager
6) Cache Manager
7) LPCS
I/O Manager
9) Process Manager


I/O Manager


The initialization of I/O Manager begins the process of loading all the systems driver files. Picking up where NTLDR left off, it first finishes the loading of boot devices. Next it assembles a prioritized list of drivers and attempts to load each in turn.


The failure of a driver to load may prompt NT to reboot and try to start the system using the values stored in the Last Known Good Configuration.


SMSS


The last task for phase 1 initialization of the kernel is to launch the Session Manager Subsystem (SMSS). SMSS is responsible for creating the user-mode environment that provides the visible interface to NT.


SMSS runs in user-mode but unlike other user-mode applications SMSS is considered a trusted part of the operating system and is also a native application (it uses only core Executive functions). These two features allow SMSS to start the graphics subsystem and login processes.


win32k.sys


SMSS loads the win32k.sys device driver which implements the Win32 graphics subsystem.


Shortly after win32k.sys starts it switches the screen into graphics mode. The Services Subsystem now starts all services mark as Auto Start. Once all devices and services are started the boot is deemed successful and this configuration is saved as the Last Known Good Configuration.


Logon


The XP boot process is not considered complete until a user has successfully logged onto the system. The process is begun by the WINLOGON.EXE file which is loaded as a service by the kernel and continued by the Local Security Authority ( LSASS.EXE) which displays the logon dialog box.


This dialog box appears at approximately the time that the Services Subsystem starts the network service



***i hope i didnt trouble with some mundane information....As diana wanted to know about MBR Floppy if we understand how the computer boots up it would help us to make more intelligent decision..... shall research some more and provide more details as to what a MBR floppy does shortly...at the moment i m on job....


Knight

 

Wow ! Now that is some detailed information !

Thanks, Knight.

 

I hope folks this might shed some light as to how MBR Floppy diskettes work and what they are meant to do...and what we need to do with them...


Master Boot Record (MBR) and its role in hard drive recovery
Master Boot Record is that part of the hard drive which tells the operating system (like Windows) what to boot and from where to boot. Master Boot Record is created by the file system (read FAT 16/32, NTFS, etc.) in the first sector of the hard drive and can get corrupted due to several factors.

Some of the easy and common ways in which a master boot record gets corrupted are improper shut downs due to power failures or system crashes and attacks by viruses or worms that mess around with the master boot record and the boot sector of the hard disk with the intent of paralyzing the whole system.

How to fix the MBR for a successful and quick hard drive recovery?
As the first step of your hard drive recovery attempt, get a clean, uninfected bootable floppy. If you haven't already made a bootable floppy, get any of you friend to do it for you. Most of the Windows operating systems (OS) have standard procedures for making a boot floppy. Use your OS's manual instructions if you have any doubts.

After you make a boot floppy, set the first boot device in your BIOS boot parameters as floppy disk drive. Now the system will automatically use the floppy to boot into the command prompt of the good old disk operating system (DOS). Use the chkdsk (check disk) DOS command to do a read only scan of the boot partition. Do not give any additional parameters or switches to fix the errors found on the disk, because the process of fixing errors involves writing data on to the disk and this could jeopardize future hard drive recovery operations.

After the read only scan, check disk will tell you if the master boot record is corrupted. If the master boot record is corrupted and the there are no bad sectors, then you can safely go ahead and do a normal scan with the fix errors automatically switch.



Knight

 

I'm accustomed to a "bad" MBR having no symptom other than boot failures of some type, EARLY in the process. I can only scratch my head about how an MBR could be corrupted in a way to cause the behavior you describe. However, I don't blame you, of course, for asking since your initial efforts to remedy things with FD-ISR failed.

Here's the thing though: you installed Clear Cache and uninstalled it, after giving it a try. Is this a program that messes with the memory cache or with the disk cache or both ? Any way to rule out it wasn't clear cache that messed things up ?

Another thought: I have had this problem with installation programs starting up inappropriately before but don't recall the specific causes but it had nothing to do with FD-ISR. In one case I remember specifically only that it was a bug in Quicken or else a corruption of the Quicken install that caused it. The sequence of events makes me suspicious of:

- the Clear Cache install and unistall procedures themselves and
- is Clear Cache simply a single executable install or does it involve installation of any dll's or auxiliary drivers ? Is it possible the install replaced an exisitng dll or other file with an older version and then didn't deinstall or deinstalled and then that dll didn't exist at all ?

That's all I can think of at the moment, Pete. I'd hate for you to have to do it all over again and try variations of the sequence to try and reproduce and diagnose the problem even though I wouldn't put it past myself to do such a thing.

 

Well, FD-ISR has the location of $ISRBIN hardcoded in the MBR code.
Did you restore image including MBR or just partition? I know that ATI doesn't restore an image in exactly the same sectors, so the restore might have been successful, but shifted one or more sectors.
So, would it be possible that the MBR found a $ISRBIN that was outdated? And did the $ISRBIN it's magical work with snapshots/file references based on outdated information?

Maybe the secure way to go is disable preboot before image OR always include MBR in disk imaging/restore.