How to use the MBR Floppy

Discussion in 'FirstDefense-ISR Forum' started by Dina, Aug 30, 2006.

Thread Status:
Not open for further replies.
  1. crofttk

    crofttk Registered Member

    Joined:
    May 15, 2004
    Posts:
    1,979
    Location:
    Eastern PA, USA
    Doh ! Well shoot, I forgot to ask Pete what he restored with, ATI or IFD ! I did feel like I was forgetting something ! Pete?
     
  2. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Wilbertnl

    Normally IFD doesn't restore the MBR, so I've restored at least 20 or so times with the Preboot enabled with no problem. The strange situation I had persisted even after I totally uninstalled FDISR. I can't see it was an MBR problem, but I am just totally puzzled by it all.

    Pete
     
  3. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    Well, when the image restore overwrites the outdated $ISRBIN, then you get an error and it solves by itself.
    But when the outdated $ISRBIN survives the restore, what happens then? I don't think that IFD/IFW writes zero's to empty sectors. So it is possible that some sectors survive the act of doom. :D
    What if the survived $ISRBIN manipulated the MFT (file allocation table for NTFS) in a way that some file references are defect. That defect will persist when you uninstall FD-ISR.

    I'm guessing here, Todd would be able to confirm. But so far it makes sense to me. :)
     
    Last edited: Sep 14, 2006
  4. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Let me try and fill in with some either knowledgable guesses, or guessing at knowledge.

    According to the dire warning issued by IFD at restore, it wipes out the partition, so $isrbin would be replace with the one in the image. I restored an image taken before I did what I thought might have caused the issue and the problem persisted. Even went back to an earlier image with same results, so clearly(?) what ever was the problem survived the restore.

    Also I am assuming that the MFT is restored along with the image, as I have restored from a 2 snapshot FDISR situation to a no snapshot situation with no problem.

    I think(read educated guess), that FDISR's biggest interaction with the MFT comes at rollover from one snapshot to the other. I base that one what took place with the bug I found. Ergo I am problably wrong.

    It is also strange that refreshing with the archive didn't solve the problem, but when I restored the early basic system, which proved to be okay, then the archive, both created a new snapshot, and refreshed the basic system just fine.

    Unless that last restore was done when FDISR was uninstalled and out of the MBR. Who knows.

    Pete
     
  5. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    When IFD/IFW warns about wiping out the partition, it doesn't mean that it cleans the whole surface of the disk platter. It means that it will rewrite the single sector that contains the partition table. Any other sector on the surface stays as is.
    It will rewrite file allocation information when you restore the image, all references are correct according to the image.

    But the code in the MBR does not know about different file references. It doesn't know that it's own reference became incorrect.

    You asked if it would be possible that the MBR is the source of your problems. My first reaction is no.
    But there is an advice to disable preboot before imaging, we also tested many times that it doesn't hurt because in our tests we always got the $ISRBIN not found error.
    I find it conceivable that you got a rare situation that the $ISRBIN survived the restore and that the MBR found the survivor and loaded it.
    What happens after that, I don't know. But the symptoms of your problem look like a defect file system.
    MS Office 2000 is able to start a repair out of the blue, maybe your software does the same? I don't know.

    So, all I can say that the answer no to your question is probably not right.
     
  6. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Wilbert

    Short of Hob Goblins, I think you might be right on the money. In fact I think you are so right, I deleted an image that just finished, that had preboot on, and am re imaging with Preboot off.

    This is probably the biggest draw back to IFD and why I am interested in Shadow Protect. It allows restore of everything, including MBR and the other early boot tracks.

    Thanks,

    Pete
     
  7. crofttk

    crofttk Registered Member

    Joined:
    May 15, 2004
    Posts:
    1,979
    Location:
    Eastern PA, USA
    I agree with that. Although it won't drive me away from IFD/IFW, I have to admit it was a little bit disappointing to find out about IFD's MBR methodology a few weeks back.
     
  8. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Likewise. Once the driver issue is resolved with Shadow Protect I am going to put SP thru the wringer. If it holds up, it's got some neat features, and then I will probably use both.

    Pete
     
  9. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    This is what I know for sure:

    Before I create a disk image, I always defrag the partition with Perfectdisk.
    After I restore from the defragged image, I analyse with Perfectdisk and it turns out that files are not at the same place.
    When I use Acronis TrueImage, even the MFT ends up in a totally different place.

    A restore of a disk image never results in an exact sector-by-sector copy of the original.
     
  10. crofttk

    crofttk Registered Member

    Joined:
    May 15, 2004
    Posts:
    1,979
    Location:
    Eastern PA, USA
    Never? Never in the way I normally do them, and not that it's relevant to Pete's issue, but I believe there is an option to force a complete byte-by-byte image in IFD/IFW and ATI will do that if the file system is unrecognized. I've never tried these options but wouldn't you think you would get an exact sector restore in those cases ?
     
  11. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    You are probably right, I didn't use these options either.
    So I should say: By the way we use this software we won't get an exact copy.
    (We actually can restore to a partition with a different size, as long as it fits)
     
  12. twhk000

    twhk000 Registered Member

    Joined:
    Jul 27, 2006
    Posts:
    27
    Hi Pete and All


    I understand that when you boot up your system everything starts smoothly until where you need to log on to xp and after that when the desktop appears you find that insatallers starts preparing the setup screen (please tell me what softwares installers starts up) and after that you allow it do what they have to do but they provide to you error messages (thats how i understand that) and then on those programs dont work ..(Thats how i have understood) so you uninstalled those programs and tried reinstalling it and still the problem persists.... and you tried with the FDISR snapshot and you updated your primary snapshot with the secondary snapshot and tried booting up and you experienced the same problem..... (which you will)


    I certainly believe it has nothing to do with your MBR as if you refer back to my previous posts about MBR you will find that...secondly....the reason why you experienced the problem after updating your primary snapshot with the secondary snapshot is because you have certain softwares which are having conflict with themselves...are certain softwares are failing to initialize there boot drivers due to which the softwares which are enabled to auto start fail to start up and those software will try to autocorrect the problem (thats how the error correction codes would come into picture) by reinstalling itself which you would see after logging on .... So what you did was you just copied the problem to another snapshot or i would say that you have snapshots in which you all these softwares so anytime you make a snapshot you are storing the combination of your software due to which they will meet this eventuality..... so your FDISR or any imaging software will have no direct role in altering this..... it has more to do what you have been doing exactly before this software (Clearing cache program from Microsoft would have cleared the temp directory or any of the softwares setting files which store the details about software due to which they start to malfunction) ....

    Normally you need to look into control panel----administrative tools----event viewer and see what error message you have if you can report that then it will help us all to get to know whats causing the conflict....

    After wards start--Run----type in msconfig-----lookinto startup Tab...and see what programs are enabled to autostart....and then click on to services Tab see which all services of Microsoft are enabled and which other softwares run on the background.... and try disabling those particular softwares and reboot and see what happens...and then contact those software personals so that they may answer you why those softwares are behaving like that....


    This is what i would do and then after doing all that i will see what i can do later on


    Knight
     
  13. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Knight

    First the problem has been resolved, but let me restate just so you get the crazyness. And thanks for your willingness to help.

    1. I updated both snapshots and archives, and imaged with IFD
    2. Installed Clear Cache, didn't like it so uninstalled it.
    3. Booted to Secondary which was fine. Copied Secondary to Primary
    4. Booted back to Primary which now was acting up.
    5 Booted back to Secondary which now also was acting up. Note, no copy was done, just a reboot to the secondary snapshot.
    6. Restored the image taken before all this with IFD. It replaces everything but the MBR
    7. Rebooted and all was fine. Rebooted a 2nd time and Primary was messed up.
    8. Rebooted to secondary and it also was messed up.
    9. Refreshed Primary from Archive, and booted to Primary. Still bad.
    10. Tried restoring an image from a day earlier, and got the same results.

    The Fix....o_O?

    1. Deleted secondary snapshot, and then uninstalled FDISR. System was still acting messed up.
    2. Restored an early image that just had windows security software, and FDISR with no snapshot. Note this image was restored with a plain mbr.
    3. Rebooted turned on preboot and rebooted again. All was now well.
    4. Created a new secondary from the archive, and booted to it. All was well.
    5 Copied new secondary onto primary and then booted to primary. Again was well. Not problems since then.

    Very strange. Not sure I could reproduce nor do I desire to do so.:D

    Pete

    PS If you think I am nuts, you can begin to imagine how I felt in the middle of it all
     
  14. twhk000

    twhk000 Registered Member

    Joined:
    Jul 27, 2006
    Posts:
    27

    Would you define what is "Acting up" what exactly do you mean over here...pls

    You restored your image from IFD because your snapshots were acting up?

    When did you make that image? and have you previously restored your system with that image or it was the first time you restored your image with..

    Knight
     
  15. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Yes I restored because the problems. The image was made prior to installing Microsofts Clear Cache. When ever I make an image the final test of the image is restoring it, so yes that image had successfully restored.

    Acting up. Installers on installed programs wanting to run. Loosing a KAV log on notification, so I uninstalled both SSM and KAV. KAV crashed on install first time, 2nd try was fine, but certain DLL's missing. SSM installed but wouldn't run. All behavior that wasn't there before, and has been checked and is fine now.

    On the installer issue, I finally let it run, and then another program installer wanted to run.

    Didn't see these problems before, and don't see them now that this is cleared up.

    I also checked the drive's "dirty" flag and it was okay.

    This is why I think Wilbert's theory may be right.

    Pete
     
  16. twhk000

    twhk000 Registered Member

    Joined:
    Jul 27, 2006
    Posts:
    27
    Hi pete


    Thanksfor the reply..i strongly suspect it is a conflict of your startup softwares....which all have to run on the background... due to which you get that installers showing up .... lemme tell you those installers will show up with some other programs running such as launching IE and you will get the MS office setup installer showing up ..so this problem is not very unique ...because it is due to corruption of some setup files not with your MBR .... MBR only holds your booting record....not your startup programs details....that is held, maintained and initializied, closed by Windows.... and windows start up record is called as MBR(Thats how we understand as a layman)


    The reason why i am saying you this is because you Imaged that exact combination and you have had those snapshots in FDISR so obviously you just stored and secured the problem...thats why you had to go back to a previous image... where you had plan softwares along with your windows...not all those softwares... if you have archived or you have the same image try rerestoring and you willl encounter the same problem ...it means that your windows is working fine but not those software...


    Knight
     
  17. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    Well, Knight, you have thoroughly thought about what could have happened.
    As I know Peter, he is a very very procedural person, who follows strict paths to reach his goal. He has been using FD-ISR for how long.
    What I try to say is that Peter has a decent knowlegde and experience of how FD-ISR works. And how his applications work.
    If I understand correctly, he just evaluates a small cache cleaner from Microsoft and after that horror happened.

    The only thing that Peter is pretty new with is restoring images. Isn't that right, Peter?
    If the problem is in the whole setup and configuration of the snapshot that Peter is using, then he would be able to repeat the problem.
    We wait for the results of the repeat of the suspected actions! :-*
     
  18. twhk000

    twhk000 Registered Member

    Joined:
    Jul 27, 2006
    Posts:
    27
    hi all

    Yes i agree with you wilbert that we need to wait and see can we duplicate that problem again or not.....i bet we can ...if we have those images intact still....

    About Pete..yes he is indeed a very perfect procedural person which is what eases to share and learn from each other..

    Knight
     
  19. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi All

    Okay some comments. Wilbert you are right, I am relatively new to restoring images, but I've been imaging the new machine daily since I got it, and every image is restored as a final check. So i am catching up fast.:D

    I am as sure as I can be that it isn't start up or other software type conflicts. My system has been stable and fairly constant for almost a month with no issues. Last week I updated both KAV and SSM. Both updates were without incident and the system has been stable and without issues for a good week. It was in that good state that both the last image and last FDISR archives were taken.

    Clear cache by MS is a seemingly simple program. It's install and uninstall was without incident. I booted to the Secondary snapshot, that should still be the good outline above. I copied from the secondary to primary. Primary should now be good, but when booting to it, it wasn't. Now just going back to what had been a good secondary finds it bad. Hard to picture start up conflicts suddenly showing to cause this.

    Second point. During problems, I refreshed from the external Archive. Logically if the archive is good it should have fixed the problem. Since it didn't one could conclude that even though it was made from a good system, it for some reason was bad. Only problem was the archive was good, as once I restored the basic system archive without FDISR in the MBR, the archive did indeed create a good snapshot. Again startup conflicts isn't looking good as a theory.

    Lastly, as Knight suggested I restored the questionable image, and I did it with FDISR in the MBR. Restore was perfect and system was perfect.

    So what happened. Beats me.

    If I have time this weekend, I may retry the clear cache thing. But murphies law says this won't duplicate.

    cheers,

    Pete
     
  20. twhk000

    twhk000 Registered Member

    Joined:
    Jul 27, 2006
    Posts:
    27

    Based upon what you have said...i m forced to think that if you had installed Clear Cache and Updated your KAV and SSM when the system was running in the primary snapshot and later on you tried to update your primary from the secondary ...(Basically you are reverting the changes happened to your primary snapshot) and more over you imaged your system when it was in primary or in secondary snapshot


    So it seems that when FDISR updates its missing out ciritical system files which are hidden ...such as KAV drivers or other files....so it could be related to that and let me tell you when i say start up Your KAV is in your startup list and it has loadup if it has encountered any fatal errors it will try to correct it ...so either your secondary snapshot or your archives are having a problem in that case.....but the nature of the problem is nothing to do with MBR because KAV doesnt sit in your MBR it will guard it only if it is running properly otherwise it cant alter or modify or revert any changes to MBR ....


    Knight
     
  21. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    Why does this problem occur this week, I'm under the impression that Peter has a standard configuration that is working since forever.
    He just makes tiny changes when he is in the mood to play, or he updates his archives when well functioning software updates are applied.

    What is the difference this week?
     
  22. twhk000

    twhk000 Registered Member

    Joined:
    Jul 27, 2006
    Posts:
    27
    Well lemme just remind you all that the problem started as Peter updated his Primary Snapshot from the Secondary snapshot ....so it boils down to see how healthy is the snapshot you have created...

    Knight
     
  23. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Hi Knight and all

    First there is no problem with FDISR dealing with any hidden or other files. I've updated with KAV, when I've trashed the registry, when ntldr file was missing just fine. On a routine basis there hasn't been any issue.

    Secondly, there is no doubt in my mind that the secondary snapshot was fine. Knight, we all are grasping at straws, but you are ignoring the sequence of what I did to base your questions.

    Again, all snapshot and archives were fine when I started. Under the screwed up conditions, restoring the image, or refreshing with the archives didn't help. Once I did the final restore with FDISR uninstalled, then the image, and the archives proved fine, and the all came from that original primary snapshot, as did the secondary snapshot. When I restored the image last night, the secondary snapshot was fine, so it couldn't have been bad when I used it, as it was the same as when it was imaged.

    I may restore that image again, verify all is working, and duplicate what I did. Anyone care to bet if the results will be the same.

    Pete
     
  24. Peter2150

    Peter2150 Global Moderator

    Joined:
    Sep 20, 2003
    Posts:
    20,590
    Okay All

    I restored the image that started this all. Restored it with FDISR installed. Made sure both snapshots were the same, that I could boot to them, and all system were normal. They were.

    Installed clear cache. Uninstalled it and booted to secondary and updated the primary. Booted back and forth, did everything I could to break stuff, and couldn't. System was totally normal. Go Figure.

    Pete
     
  25. wilbertnl

    wilbertnl Registered Member

    Joined:
    Dec 29, 2004
    Posts:
    1,850
    Location:
    Tulsa, Oklahoma
    So disobedient! :)
     
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.