What alters MBR, and what can MBR restore fix ?

Discussion in 'Acronis True Image Product Line' started by alan_b, Jan 29, 2009.

Thread Status:
Not open for further replies.
  1. alan_b

    alan_b Registered Member

    Joined:
    Nov 13, 2008
    Posts:
    100
    Location:
    Lancashire, England
    My Laptop internal drive has several primary and logic partitions, some are NTFS and some are FAT32.

    I create independent Acronis images of each partition, possibly on different days with some alterations to partition contents.

    Is the "MBR track zero" the same for each image. ?

    Will "MBR track zero" alter if I use the Partition Manager to :-
    1. Shift a partition ?
    2. Resize a partition ?
    3. Change a Drive Letter ?
    4. Hide a partition ?
    5. Set a different partition as Active ?

    Which of the above changes :-
    will be exactly cancelled by restoring the previous MBR ?
    will be so incompatible that restoring previous MBR would destroy data ?

    If drive letters are changed and a different partition is made active, perhaps the P.C. will be unbootable.
    Can I simply use the BootCD to restore an earlier MBR so the original system partition is again Active, all drive letters restored as they were, and normal reboot available ?

    Regards
    Alan
     
  2. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    This is an area of much confusion with TI users. "MBR" generally refers to the first sector on the disk, 512 bytes. This first sector contains a simple boot loader and the partition table. "Track 0" refers to the first 63 sectors on the disk. On a plain vanilla installation of a Microsoft operating system, only the first sector (sector 0) is used; the other 62 (sector 1-62) are blank. If you install a third-party boot manager it MAY use some of these blank sectors.

    The Acronis function "Restore MBR and Track 0" will restore everything in these first 63 sectors EXCEPT the partition table. Restoring the partition table would be disastrous if the user had made a change to the disk partitioning after creating a backup.

    So to answer your 5 questions, no, restoring "MBR and Track 0" will not affect any changes made to your partitions because all of these types of changes only affect the 64-byte partition table, which is NOT restored when TI restores the MBR.

    For the vast majority of TI users who only run Windows, restoring the MBR is completely unnecessary. The only users who need to use this feature are:
    1. Those with third-party boot managers (GRUB, LILO, BING, etc.)
    2. Someone with a damaged master boot loader. The usual symptom of this is a blinking cursor when booting the PC. If a boot attempt results in an error message displayed, then the Master Boot Loader is working and the MBR does not need to be restored.

    Hope this helps.
     
  3. alan_b

    alan_b Registered Member

    Joined:
    Nov 13, 2008
    Posts:
    100
    Location:
    Lancashire, England
    Mark.

    I intend to build up courage to do "clever" things,
    such as restore to a "reserve" partition an image before a software upgrade,
    and then do a quick and dirty juggle with Drive letters and which partition is active.

    Then I can inspect operation of the software before upgrade, followed by a juggle and reboot to compare operation after the "upgrade" to decide if it is better or worse.

    Before stupidly making the computer un-bootable I will organise a recovery plan, and knowing very little about MBR etc I had a vague hope it could be a "get out of jail" card.

    Thank you Mark, you have clearly answered all my questions.

    I am now a sadder and wiser man, and I am thankful for knowledge that makes me safer.

    Regards
    Alan
     
  4. jonyjoe81

    jonyjoe81 Registered Member

    Joined:
    May 1, 2007
    Posts:
    829
    MBR is entirely different than the individual partitions, damaging the MBR won't affect each partition. Also damaging a partition usually won't affect the MBR. I have never backed up or restored a MBR, especially I wouldn't restore a MBR from drive A onto drive B.
    If there is no operating system on the hard drive, moving things around won't affect anything.

    If you have an operating system on the hard drive, then the windows registry comes into play. If partitions are rearranged etc, windows might not boot because of the inability of locating the necessary files needed due to mismatch partitions etc.

    With xp and true image, it's a "roll of the dice" where the drive letters will wind up when you restore it (especially if you made changes to partitions). And you have 2 different drive letters (mounted devices / partition ID). But one thing I have learned about windows xp is if you have the knowledge and power to control/change drive letters you can fix a restored windows that is unbootable almost everytime. I have a 100 percent success rate.

    I've run test's on my computer reslotting partitions/changing mounted devices drive letters/ fixmbr/fixboots etc. None of these changes/operations will permanently damage windows, I was always able to boot into windows following my tests once I put everything back where it belong. But I wouldn't be running any "complicated" test's without a "boot corrector" handy.
     
  5. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    No it isn't. It's completely predictable if you take the time to learn how Windows assigns drive letters. No magic involved here; it's just software following a very explicit sequence.

    I'd still like to know how you came up with this. There aren't 2 different drive letters. Each partition has only one drive letter. There is only one location where this information is stored in the registry.

    What may be causing you to come to this conclusion may be how a particular piece of software (your boot corrector or other tool) displays information. But that's not how Windows itself is organized.

    When Windows boots it starts assigning drive letters according to its pre-programmed sequence. If a partition has an existing drive letter assignment stored in the registry, then it is reassigned the same drive letter from the one location where the drive letter is stored. If not, it gets the next unused letter.
     
  6. bgoodman4

    bgoodman4 Registered Member

    Joined:
    Jan 13, 2009
    Posts:
    3,131
    Alan, I may be missing your objective here but if all you want to do is try out new software there is a very easy solution. You can download and install a program called Returnil (there is a forum on Wilders for this program by the way). Before you install the software you simply turn Returnil on and it will create a virtual PC that is exactly like your current setup. You can now do anything you want, change settings, install programs, etc. Then, when you are done, simply reboot the PC and all changes will be gone. There is a free version which works as I have described but the paid version will (I believe) allow you to keep any changes you made to the PC so if you like the upgrade you will not have to reinstall it after closing Returnil. Here is the link to Returnils home page http://www.returnilvirtualsystem.com/

    I hope this helps.
     
  7. LenC

    LenC Registered Member

    Joined:
    Jul 25, 2006
    Posts:
    846
    Location:
    CT, USA
    Great great explanation - Thank you!
     
  8. alan_b

    alan_b Registered Member

    Joined:
    Nov 13, 2008
    Posts:
    100
    Location:
    Lancashire, England
    Hi

    My primary goal is to prove bootability of an image - see :-
    https://www.wilderssecurity.com/showthread.php?t=229750

    A secondary goal is to compare software upgrades before and after,
    and I used this as a simple explanation of a desire to do unusual things to partition letters etc.

    In future I may find other benefits from juggling drive letters etc.

    Whatever the goal, after juggling with Linux Partition managers that allocate drive letters differently, I need a way to recover should the P.C. become un-bootable. I thought that restoring the MBR Track zero might be the cure.

    Instead of appending my MBR questions to the bootability thread, I started this because, regardless of my bootability issues, I wanted to know what this MBR Track 0 thing was all about, and any benefits or pitfalls. I also thought that this would be of general interest and so worthy of its own thread.

    I am delighted by the quality of the information provided, thank you.


    bgoodman4

    I believe Virtual P.C.'s and Acronis Try and Decide have similar capabilities and limitations.

    Specifically, some applications cannot be tested until they have been installed and rebooted, and after rebooting it is not possible to revert to the pre-installation phase.

    I have a very useful TCP TWEAK program which can change my Internet settings and experience. Unfortunately the changes only come into effect after rebooting the computer. Hence Try and Decide cannot give me a quick roll-back if I dislike the effects, and I assume the same applies to Returnil.

    Regards
    Alan
     
  9. bgoodman4

    bgoodman4 Registered Member

    Joined:
    Jan 13, 2009
    Posts:
    3,131
    Understood, I would suggest RollBack Rx in this case. What you would do is take a snapshot just before you do whatever it is you want to do. Then if you don't like what has been done you can rollback the PC to the state it was in before you tested whatever it was you tested. If you like the tested program and want to keep it you simply do not rollback. I have not used the program yet (I am seriously considering it though and will very likely purchase it - just waiting for a reply from tech support on one last point) but it does look to excellent and it has a lot of fans on these forums. According to what I read about it its very fast both to take a snap shot and to restore. 5 seconds to make a snapshot, and 10 seconds to do a restore (I think I have this right). There has been a lot of discussion about this program on the forum so a search using the RollBack Rx will give you lots to digest.

    I hope this helps.

    EDIT: it will only protect the main partition I think so it may in fact not be a good solution for you. If all you want to do is test software and be able to flip back and forth between the reinstalled state and installed state you can do this with RollBack Rx, just take another snapshot after you have installed the program and then do reversions to the desired state. Please confirm that this flipping forward is possible, I am pretty sure it is but I could be wrong.
     
  10. alan_b

    alan_b Registered Member

    Joined:
    Nov 13, 2008
    Posts:
    100
    Location:
    Lancashire, England
    Normally when evaluating new software,
    I choose that Try and Decide protection is limited to the system partition,
    I install/un-zipp to an external drive partition.

    After evaluation I usually decide to reject it,
    then I manually delete its folder from the External drive,
    and tell Try and Decide I wish to revert.

    Because Try and Decide is not monitoring the external drive,
    it only has to preserve the registry, and any Documents and settings profiles etc. that might be affected. After several hours less than 1% of the S.Z. is used. Previously when I installed on a partition it was monitoring, it has run out of memory within 20 minutes.

    When Try and Decide cancels, the registry is exactly as it was.
    C:\WINDOWS\system32\config\SOFTWARE was fully protected until Try and Decide was instructed to Apply Changes.

    RollBack may take protect files with sector snapshots. How about the Registry - I fear many registry changes never get out of memory and onto the disk until the computer is closing down. I have spent some time searching without getting an answer.

    I am happy to delete one folder, but do not wish to undo registry corruption.

    For now Try and Decide is adequate, and where the change has to be tested after a reboot then a few minutes creating an image is O.K.

    I would be interested in any further information you may have upon registry preservation by Rollback.

    Regards
    Alan
     
  11. Acronis Support

    Acronis Support Acronis Support Staff

    Joined:
    Apr 28, 2004
    Posts:
    25,885
    Hello alan_b,

    Thank you for your interesting in Acronis True Image

    Here is detailed description how try and decide feature works:

    Try&Decide functionality is provided by a special Acronis driver tdrpman.sys (Try&Decide Restore Points Manager) that is installed as an upper filter file system driver and the snapman.sys driver.

    After user activates Try mode, the tdrpman.sys driver detects all the system requests to the protected partitions and forwards them to a temporarily created storage area on the hard drive. If the changes are set to be saved on the partition being protected, they are stored in free sectors of the partition's file system. If the changes are saved to the non-protected partition, the dedicated hidden folder named Try and Decide is created in the root of the target partition and the changes are saved there.

    If the detected request to the partition's file system is a write request (the system intends to write a data block to the actual hard drive), the data block is forced to be written to the temporary storage area. Should the system try to read something from the protected partitions, the driver will check if the data block with the same ID is already present in the archive. If it is present, the driver forces the system to read the data from this archive instead of reading it from the physical drive. If the data block is not found in the temporary storage area, the driver allows the system to read the block from the physical drive.

    Should user decide to apply the changes to the physical drive, he/she can press the Decide button and all the backup archive contents will be transferred to the physical drive.

    If user discards changes, tdrpman.sys becomes deactivated and the system reboot is initiated automatically. The data in the temporary storage area is removed upon the operating system startup.
    If the reboot is performed without taking a decision (e.g. the installed software requires the system reboot), the program modifies the MBR boot code. If there are several hard drives installed in the system, the MBR on the system hard drive will be modified.

    After the boot code is executed during the next system startup, Acronis interrupt handler is activated for forwarding the system requests to the previously saved data. This allows the program to force the system load to continue further operations without actually applying them.

    Best regards,
    --
    Dmitry Nikolaev
     
  12. alan_b

    alan_b Registered Member

    Joined:
    Nov 13, 2008
    Posts:
    100
    Location:
    Lancashire, England
    Thank you Dmitry.

    Until today I understood that all changes were held in the Acronis Secure Zone until making a Apply or Discard decision.
    And the first time I used it I had a system crash after about 10 minutes of trying, because it ran out of space. ASZ is now much larger, and has an 8 GB image plus another 6 GB spare space - originally there was only 100 MByte of spare space.

    Please advise me - I am probably not understanding fully.

    I am running Try and Decide and only protecting the System partition C:\.
    I downloaded a 100 MByte file to D:\ which is not protected,
    and then copied the 100 MByte to C:\Documents and Settings\ etc. etc.

    Both Windows explorer and xplorer2 can see this file in both partitions as if it really exists where it will be after I make an Apply decision.

    Where are they in reality before making the decision ?
    Is Try and Decide actually fooling the file managers into seeing what has not yet been applied ?
    Since it is not monitoring/protecting D:\, am I now seeing the present reality on D:\, or does something also happen to D:\ when I make a decision.

    You stated :-
    "If the changes are saved to the non-protected partition, the dedicated hidden folder named Try and Decide is created in the root of the target partition and the changes are saved there."
    I have set both file managers to show Hidden/system files,
    but neither can detect the dedicated hidden folder named "Try and Decide",
    it is not present in either C:\ or D:\.

    Is it hidden in a super-concealed hidden mode ?
    Is this something which happens AFTER I commit to an APPLY decision ?
    Why is this applied to the partition that was not being protected/monitored ?

    p.s. Try and decide has been running for 06:01:39,
    with remaining time 54:09:23.
    Think I will have a soak in the bath before I decide ! !
     
  13. Acronis Support

    Acronis Support Acronis Support Staff

    Joined:
    Apr 28, 2004
    Posts:
    25,885
    Hello Alan,

    Thank you for using Acronis True Image

    I will try to explain. Tdrpman.sys driver places all changes that can be applied to the protected area to Acronis Secure Zone. The entire information about the changes is located in Acronis Secure Zone, but it seems that the changes have been implemented to the "live" system. Therefore, you can see and use the file placed to C drive as if it was placed there forever. When you get the access to the mentioned 100 MB file, the file system addresses to Acronis Secure Zone, where the file is physically located.

    Thank you.

    --

    Oleg Lee
     
  14. dwalby

    dwalby Registered Member

    Joined:
    Nov 20, 2007
    Posts:
    174
    Location:
    SoCal
    Mark,

    got here a little late, but this comment caught my attention. All along I have been thinking MBR/track0 restore could be used to repair any partition table damage caused either by malware, or user error. Your comment suggests that is not possible. So, if I accidentally hose my partition table, and don't have the old values stored anywhere, what's the best way to recover the state of the table? Would I just have to manually repartition with something like Disk Director?
     
  15. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    Doug:

    You are correct - you cannot recover the partition table with the Acronis "Restore MBR and Track 0" function. There are only two ways that I know of to do this with True Image. One is to have a full-disk image that includes all of the partitions and then restore the entire disk. The other is to have an image that includes all of the partitions, or multiple images that contain your partitions, and then restore each partition one at a time. TI will rebuild each entry in the partition table as it restores each partition.

    Other methods of restoring the partition table involve using other programs. For example, with Acronis Disk Director you can save a copy of the 64-byte partition table or a copy of the first sector on the disk. Restoring either of these would recover a damaged partition table. There are other programs available that also can save a copy of the partition table. All of them involve an element of danger. If you add, delete, or resize partitions on the disk and then restore an old copy of the partition table then you will lose the contents of one or more partitions, so use with care.
     
  16. dwalby

    dwalby Registered Member

    Joined:
    Nov 20, 2007
    Posts:
    174
    Location:
    SoCal
    Mark,

    Since I have a video editing partition that never gets imaged I don't have a backup of all the partitions on my drive, so that approach wouldn't work.

    I'll have to fire up DD and save the partition table to a file, then I'll be covered. And since its a small data block I could just write down all the hex values and use the DD hex editor to reconstruct it in an emergency.

    thanks again,

    doug
     
  17. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    Doug:

    The easiest way to do this with DD is to view absolute sector 0 with the disk editor set in "As Hex" view mode. Highlight all 512 bytes in sector 0 and save them to a file. Keep this file as a backup. To restore just copy the file contents back to sector 0 and choose "Save Sector" to write them to the disk.
     
Thread Status:
Not open for further replies.