write mbr and table of partition in a file,need help

Discussion in 'Acronis Disk Director Suite' started by mantra, Jan 24, 2009.

Thread Status:
Not open for further replies.
  1. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    5,149
    Hi
    i need help
    i have 2 questions

    1)
    i need to write mbr and table of partition in a file

    i boot with the cd recory disk director 10
    select the hard disk -> edit ->View as Hex

    what i have to select to export mbr and master table of partition to save in a file (to back up) ?
    where are stored the partitition data? i mean all the data , information about my partitions without make change on my partitions? so i can recover if i will do an error?




    2)can a program like paragon or partition magic change my partitions setting/data? i mean not change the size of my partition or change the table of partitition ? if yes how can i detect it?


    thanks
    have a nice day
     
  2. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    You should select all 512 bytes in absolute sector 0 and save it to a file (bytes 000 to 1ff). This sector contains the boot code and the partition table. Take a look at this picture of sector 0. The portion outlined in yellow is the partition table (64 bytes). The partition table contains all of the information about your partitions. Most of the rest of sector 0 contains the boot code needed to find and boot the partition marked as "Active" in the partition table.

    Be very careful in making use of this backup file. You should only restore it if you have not made any changes to the locations of partitions. Keep in mind that the partition table is like an index - it only stores the location of the partitions. If you move one of them to a new location, and then restore an old partition table, the index will be pointing to the wrong location and you may lose your data.

    If your question is about backing up the data in your partitions then you should use imaging software like Acronis True Image to back up your disk.

    I'm not sure what you're asking here. Programs like Paragon or Partition Magic are capable of making changes to the partition table, but they don't do this on their own. You have to initiate a change by running the program and deliberately making a change.
     
  3. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    5,149
    thanks for the answer

    i run the recovery cd
    acronis full (not safe version)
    edit->view as Hex
    but i selected the (bytes 000 to 1fa) and not 1ff like you wrote

    but in a hard disk of 320gb the only data respect the number and type and size of the partitions are only in these few bytes,i can't believe

    by the way i guess there is a bug in acronis disk director 10 last build
    because i save it , and without making change i load many times this file and the partitions did disapear
    i mean i lost them:thumbd:



    If your question is about backing up the data in your partitions then you should use imaging software like Acronis True Image to back up your disk.

    some malware destroy the partition table and so with a back up i should restore easy
     
    Last edited: Jan 24, 2009
  4. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    5,149
    i tried paragon Hard Disk Manager boot cd , and on the partition c: i select Check file system integrety and hard disk manager after pop up with a "rebuilding partition info" so maybe i did change my partition


    and if i remember good , acronis disk director keeps 2 or 4 mb between the partition , i guess to store data or?
     
  5. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    That's probably because part of the partition table (the entry for the fourth slot in the table) is contained in the bytes 1fa - 1fd, so if you didn't save these bytes then you didn't back up the entire partition table.

    The easiest thing to do is to back up all of the first sector, bytes 000 - 1ff. When restoring of course, be sure to put it back in the same place, 000 - 1ff.
     
  6. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    5,149
    but i can't see 1ff ...
     
  7. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    Can you post a picture? Byte 1ff is highlighted in this picture:

    MBR.PNG
     
  8. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    5,149
    sorry i used the boot cd because i have not installed in this pc acronis
    what's wrong with my pc?
    again sorry for my poor screenshots and thank you
     

    Attached Files:

    • 1.jpg
      1.jpg
      File size:
      111 KB
      Views:
      126
    • 2.jpg
      2.jpg
      File size:
      191.3 KB
      Views:
      1
    Last edited: Jan 24, 2009
  9. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    There's nothing wrong with your PC - byte 1ff is there. The byte in the leftmost column is 1fa (circled in blue). The byte circled in red is 1ff.

    Sector 0.png

    You should resize your window so that there are 16 columns showing; this will make it easier to interpret (see my screenshot). You can resize the window from the boot disk also if you don't maximize it.
     
  10. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    5,149
    but why do you have on the left 01f0 and me 1FA
    i mean the number on the left of your screenshots are different by mine,do you know why?

    maybe is the recovery cd that doesn't work perfectly
     
    Last edited: Jan 24, 2009
  11. MudCrab

    MudCrab Imaging Specialist

    Joined:
    Nov 3, 2006
    Posts:
    6,483
    Location:
    California
    The byte number shown in the left column is for the first byte in that row. As you resize the window, you'll notice that these values change. That's why Mark said to resize to 16 bytes wide. That lets you see them in even rows for hex (base-16).

    Byte 1FF is the last byte of the sector. If you want to backup the complete sector, you need all 512 bytes: 000 - 1FF hex
     
  12. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    5,149
    yes!
    thanks!
    sorry for my ignorance
     
  13. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    5,149

    but i have only few question

    i remember that acronis disk director uses some mb (don't know 2mb or 4mb) between the partitions or some mb at the end of the hard disk
    is true?
    i mean all the data about the partition is store 512 bytes
    i sure in the hardisk there are sensitive data about partitions
     
  14. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    Most of the information about a partition is stored inside the partition. The 64-byte partition table in the MBR is only an index - it contains the partition's starting and ending sectors, for example. The partition itself has most of the information; - type of filesystem; Master File Table (MFT) for NTFS or File Allocation Table (FAT) for FAT12, FAT16, FAT32; mirror copies of the MFT or FAT; etc.

    Any gaps between partitions are unused; there's nothing hidden in there. Depending on the software used to create the partition there may or may not be gaps between partitions. Most existing partitioning software creates a 63-sector gap between the start of the disk and the start of the first partition. Windows Vista and later creates a 2048-sector gap.

    You may find this interesting...
     
  15. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    5,149
    thank you so much

    but to restore the master table i have to go -> edit ->View as Hex
    under the menu edit
    1) load the file (i saved with mbr and master table)
    2)save sector
    that's it , or i should do other operation?

    it's more safe work with the recovery cd or with disk director windows version?

    could have sense restore the mbr or mastertable if xp doesn't start maybe after an malware activity or there is a better strategy outside the image



    and ps i see you use ti10 and disk director 10,do you think it's the best combo? better then ti9 and dd10?
    i use ti9 and dd10
     
  16. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    That should work. When you load the file on top of the current contents of the sector, DD will display any changed bytes in color so you can see if there are any changes before you save the sector.
    It doesn't matter. Sector 0 is outside of the Windows partition so you can work on it while Windows is running.
    TI 10 added better support for Linux; you can view the contents of Linux partitions in backup archives while running the Windows version of the program. All in all, most forum regulars seem to think that TI10 was the best version of TI to date.
     
  17. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    5,149
    no i mean resize , move (comon operation )paritions
     
  18. K0LO

    K0LO Registered Member

    Joined:
    Mar 9, 2006
    Posts:
    2,591
    Location:
    State College, Pennsylvania
    You can use the Windows version of DD to make changes to non-system partitions. For example, if you have a data partition you can safely change that in Windows. DD will prompt for a reboot if you attempt to make a change that affects the Windows partition from the Windows version of the program. I avoid making any partition changes to the Windows partition from the Windows version of DD. I always do these from the Boot CD.

    If you read some of the posts in this forum you will find many, many users who tried to initiate a change in Windows and found that DD would reboot and then nothing would get changed. If one of the operations fails during the reboot phase there is no feedback to the user; it just simply fails. This is the major reason that I prefer the boot CD - you can watch the progress and you are given feedback while operations are completing. If something doesn't work you will know about it and can take corrective action.
     
  19. mantra

    mantra Registered Member

    Joined:
    Jan 25, 2005
    Posts:
    5,149
    thank you so much for kindness
    i will use the boot cd
    i have ti9 , there is not way to update to 10 or 11 , isn't it? i can update only to ti12 2009 ,but i guess it's buggy and i did not find great new feature
    i would like a home version with the ability to restore an image to a different pc with different hardware


    in short , outside the partition table , all the data(info every thing about a partition in xp are stored in MFT ,right?
     
Thread Status:
Not open for further replies.