cannie

Clone easily Windows 98 and XP in the same computer.

179 posts in this topic

First, I'm glad to see some users are still benefiting from my work on the MSWIN4.1 Boot Record, etc., which BTW, you can find at these mirror sites:

http://thestarman.narod.ru/asm/mbr/

http://vertcomp.com/starman/asm/mbr/

http://mirror.href.com/asm/mbr/

http://thestarman.pcministry.com/asm/mbr/ [may soon go offline permanently]

I dumped my own personal site at dan123.com long ago. My original site at GEOCITIES is still there, but is often blocked due to overuse (its highest in many Google searches); not to mention all the ads there as well.

(NOTE: I reserve the right to use any of this post in my own copyrighted works, and only give MSFN.COM the right to display my words on this web site; Daniel B. Sedory, 6 OCT 2008.)

Someone asked me to stop by here, and I've decided to say a few words about this topic.

I'll discuss the use of FINDPART's Getsect and Putsect programs in this post. Charlotte was quite correct in stating that Putsect, unfortunately, can only write 1 (one) sector to a disk at a time; I'll have more to say about that later on.

Although the following is an important step in using Svend Mikkelsen's FINDPART program to write a sector to disk:

Firstly, I just noticed that FindPart PutSect fails to return the commandline options that FindPart GetSect does. You need to first do this: set findpart=edit. The presence of that environment string 'unlocks' the more dangerous features of FindPart.

You still need to provide all of the information between the "<" and ">" markers shown below, or else Putsect will not write anything to your hard disk(s)! The only optional switches are those between the brackets ("[" and "]"):

Usage: Findpart Putsect <disknumber> <cylinder> <head> <sector> <filename>

<cylinders> <hash> [checkfile <checkfilename>] [force]

This means that even the easiest way to use Putsect; i.e., using the "force" switch, you must still include the total number of cylinders in your disk and even a dummy hash value! Here's an example of the only way you can save a copy of your Master Boot Record (MBR) sector, and then restore it using Putsect:

1. Save the MBR contents using:

findpart getsect 1 0 0 1 1 mbr.bin noheader

2. Use any other utility, or Svend's FINDPART itself, to determine the number of cylinders in your disk. For example, I used Svend's FPART495.BIN file (from inside his "fp495dos.zip" download) as a floppy boot diskette (it uses FREEDOS and HXLdr32 V1.9.1) on a 299 MiB disk running DOS 5.0 (under BOCHS; http://bochs.sourceforge.net/ ) and this command:

findpart tables

Returned the following:

A:\>findpart tables

Findpart, version 4.95 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2008.

OS: Windows 92.2337203685478.0.2222 Partition tables:

Disk: 1 Cylinders: 609 Heads: 16 Sectors: 63 MB: 299

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS
0 1*06 63 306369 149 0 1 1 303 15 63 OK OK
0 2 05 306432 306432 149 304 0 1 607 15 63 OK

304 1 06 63 306369 149 304 1 1 607 15 63 OK OK

The only piece of data you need to focus on above is the "Cylinders: 609" which tells you the total number of cylinders for this particular disk.

2. b. Don't forget to enter: "set findpart=edit"

3. Now in order to write the file "mbr.bin" (which must also be exactly 512 bytes) to the first sector of your first hard disk (which, in this case, has 609 cylinders), you must enter:

findpart putsect 1 0 0 1 mbr.bin 609 00000000 force

Note: The 'dummy hash' value is eight (8) zeros in length; it must be 8 digits.

From all of the above, you can see that Svend takes writing to a disk as something VERY serious; only for experts! One of the reasons he did this is to ensure that when he sent a repaired sector to a client, he could know absolutely for sure that the data would only be written to the correct disk exactly as he intended; thus the reason for the hashing of the file and a predetermined cylinder value. So, putsect is far from being user friendly. :unsure:

This is all very unfortunate, since it would have been a great complement to what many have found a very useful program; that is Getsect. By giving someone a Getsect command, or even putting it inside a Batch file for them and telling them to just run it, I can get any reasonable number of sectors from anywhere on a hard disk sent back to me in an email, knowing I'll usually be able to see their raw disk sectors as if I were there with a disk editor myself. :thumbup

One other item Charlotte mentioned may be very important to some users:

NB: I believe it is possible for BIOS or Windows based AntiVirus Boot Sector protection to interfere with this operation. But lets not cross this bridge unless we have to.

If you do have an AV program or enabled control over your hard disks' MBR sector via the BIOS, you need to remember that after you allow findpart to write to the MBR sector, those AV programs must be updated with a copy of the newly written MBR -- if you purposely changed its contents! Anytime you add or delete partitions to or from a hard disk, you need to update that data. Countless users of Norton AV have messed up their brand new install of a second OS by forgetting this, and when they reboot their computer, NAV complained about a possible virus in the MBR sector and without thinking, they allowed NAV to overwrite their new MBR with an old copy, then found out they could no longer boot into the new OS next time!!! :w00t:

PS: If you ever accidentally delete one of your disk's partitions, you can easily get it back by using TESTDISK ( http://www.cgsecurity.org/wiki/TestDisk ) :thumbup

La8r, Daniel (TheStarman).

0

Share this post


Link to post
Share on other sites

Daniel, thanks for stopping by and welcome to MSFN. I really appreciate those MBR details on your site! That is some collection of information. Must be a labor of love.

3. Now in order to write the file "mbr.bin" (which must also be exactly 512 bytes) to the first sector of your first hard disk (which, in this case, has 609 cylinders), you must enter:

findpart putsect 1 0 0 1 mbr.bin 609 00000000 force

Note: The 'dummy hash' value is eight (8) zeros in length; it must be 8 digits.

Thanks for this. My bad on the original incorrect commandline. I will edit that earlier post from myself ASAP. Alzheimers must be setting in! I cannot for the life of me remember what I used to write multiple saved sectors back to a FAT32 HDD. Maybe it was DISKEDIT, does that have a facility to import a block of sectors and write them out to disk?

P.S. please feel free to correct anything else. For example, back in Post #25 where I diagrammed the MBS for my Seagate 120 it looks like the 'NT Drive Serial Number' may be misaligned by one byte. The listed bytes are correct from the actual Absolute Sector 0. Just wondering if it looks strange.

0

Share this post


Link to post
Share on other sites

After your excellent explanation, if you allow me it, I suggest it would be very good to summarize in a few lines the sequence of the command lines, first to save the mbr and afterwards to restore it.

I think it would help a lot.

Thank you very much.

0

Share this post


Link to post
Share on other sites

Although the PUTSECT command can only write a 512 byte file -

(a) the program MBRutilD.exe can save and restore the entire TRACK 0 (CHS 0-0-1 to 0-0-63), but ONLY for Disk 1, and

(b) the program SRCFAT.COM can (as pointed out) save and restore an entire FAT.

More details are given in my posts at Routine to BACKUP and RESTORE key sectors of a FAT32 Hard Disk

That post outlines a strategy (a BATCH file strategy) for making effective use of PUTSECT to create the necessary backups of the key sectors in a FAT32 partition, bearing in mind that usually only a handful of sectors are involved (as most of the 63 sectors in Track 0 are blank in a standard FDISK partition structure).

As for the FAT, for a given size of partition the size of the FAT and of the backup FAT will always be constant. The FAT is allocated a fixed size on the creation of the partition, and does not vary in size as files or directories are added or deleted.

Backing up the first FAT or second FAT for a particular partition will therefore always give a file of the same size, regardless of whether the files on that partition occupy 80 KB or 80 GB, making it straightforward to identify which sectors are used by the FAT.

In practice this is fairly unimportant, as SRCFAT.COM determines the sector values for itself and does not need any user input to save the FAT (and/or the backup FAT) successfully.

Edited by Ed999
0

Share this post


Link to post
Share on other sites

From all the programs which I have known thanks to mentions made in the precedent posts, many of which are excellent, I would do an special mention of MBRUTILD.EXE.

I have downloaded it from here:

http://mirror.href.com/thestarman/asm/mbr/BootToolsRefs.htm

It is an authentic jewel!

Simple and fast, makes MBR backup and restore extremely easy, even for newbies! I don't know why those excellent works are so much ignored.

HTH

0

Share this post


Link to post
Share on other sites
That post outlines a strategy (a BATCH file strategy) for making effective use of PUTSECT to create the necessary backups of the key sectors in a FAT32 partition, bearing in mind that usually only a handful of sectors are involved (as most of the 63 sectors in Track 0 are blank in a standard FDISK partition structure).

That is a great link with lots of useful information in one place. Excellent implementation as well.

I use a slightly different strategy for a slightly different purpose. Rather than picking only the commonly written areas containing structural information, instead I grab the big continuous chunk from Absolute Sector 0 to the first FAT, 95 sectors in all, the sum total is a tiny file of only 48,640 bytes. This is done in data collection snapshots, which also include registry and system files and log information. Snapshots are compared often, especially after running suspect apps and installers.

Previously I grabbed only those key sectors described in the link. That lasted until I figured out that some programs were writing information outside of the proper file system, into those supposedly empty areas. PowerQuest was one. The infamous C_Dilla protection schemes another. Some burn-in programs and computer makers tattoo information in here. I find it real interesting to track these changes, hence I make these snapshots often and diff the files and then crosscheck logs to nail down the culprit when a change is detected.

I formerly used a batch file myself but switched over to InnoSetup to be able to compile a single portable EXE that includes within itself all necessary files. The EXE executes programs like FindPart and RegEdit, collects the output of these programs and then uses RAR or WinRar to roll them up into a nice dated snapshot package.

As for the FAT, for a given size of partition the size of the FAT and of the backup FAT will always be constant. The FAT is allocated a fixed size on the creation of the partition, and does not vary in size as files or directories are added or deleted.

Right you are, I stand corrected! I just verified by comparing the FATs of three Seagate 120 GB drives as dumped by SrcFat. Each were in fact 14,650,880 in size, but were filled to different levels reflecting the different amount of files per disk. So the FAT size is clearly related to the size of the drive, not the contents of the drive. Thanks.

0

Share this post


Link to post
Share on other sites

I would have been happy to save the first 95 sectors as a single backup file, if there was a utility which could restore it. But both FINDPART.EXE and its earlier incarnation PUTSECT.EXE can only write a single sector to disk.

Even MBRutilD.exe will only restore the first track, i.e. the first 63 sectors; and that only for the Primary Master disk. Although it is theoretically possible to swap disks around on the IDE cables in order to use the program to restore the first 63 sectors of any disk (by making each in turn the Primary Master), it is not a convenient solution. And opening the computer's case is not something to be recommended to inexperienced users!

What's needed is a software solution: hence my Batch file, which saves and restores the six key sectors individually (more if the disk has more than a single partition).

You seem to recollect using another program in the past, one that could write a single 95 sector backup file back to disk. However, I've not come across such a program for FAT32. There used to be utilities for old-style FAT12 disks which could save and restore all the first 63 sectors (which was where the FAT was stored) - just as MBRutilD.exe now does for FAT32 disks.

The function of saving the FAT as a single backup file has now become SRCFAT.EXE, which saves and restores millions of sectors at once, but which only starts at sector 96.

Someone who knows what they are doing (i.e. not me!) could probably re-engineer SRCFAT.EXE to save sectors 1 to 95 instead of sectors 96 to 14 million. But even Svend thinks that such a tool is too dangerous, judging by the precautions he has woven around PUTSECT and FINDPART - which limit the PUTSECT function to a single sector - which is presumably why no one has so far created one.

Edited by Ed999
0

Share this post


Link to post
Share on other sites
and that only for the Primary Master disk.

Have you tried switching the active main partition consecutively from one disk to the other using PARTITION MANAGER?

Edited by cannie
0

Share this post


Link to post
Share on other sites

You can switch the disks around physically, changing them over on the IDE cables and resetting the jumpers appropriately, but there is no way to fool the program into working on any disk other than the Primary Master.

The program can't be made to believe a disk is the Primary Master by reassigning the active partition to the Primary Slave or Secondary Master.

0

Share this post


Link to post
Share on other sites
You can switch the disks around physically

The only problem in this is that you must open the box to unplug/plug every new HD.

I wonder if there is any procedure to keep the master HD out of the box while using it, so that the change may be done easily, or if it is possible to use any existing device to switch from outside the connection of two main HD into the motherboard, as it happens in many other fields, i.e. in Sat-tv to switch between external parabole antennas.

Edited by cannie
0

Share this post


Link to post
Share on other sites
You can switch the disks around physically

The only problem in this is that you must open the box to unplug/plug every new HD.

I wonder if there is any procedure to keep the master HD out of the box while using it, so that the change may be done easily, or if it is possible to use any existing device to switch from outside the connection of two main HD into the motherboard, as it happens in many other fields, i.e. in Sat-tv to switch between external parabole antennas.

Could you not use a Hard Drive Caddy ?

Ok - cloning Windows - I don't know if the following will be of any use to anyone, but I've been cloning Win9X on a regular basis for some years now.

The reason I've been doing this is that I run my systems 'without a condom' - that is, without any form of virus protection in place. I found that continuous-scanning anti-viral software would slow my machines down to a pathetic crawl. So I unloaded 'em, and resorted to daily scanning with 'Antidote' (which is unfortunately no longer available) instead.

What quickly became clear was that the same viruses were getting through: specifically, 'Kernel32', 'Natal', 'Brasil', 'Marco', 'Scrsvr', 'Svr32', 'Instit', 'Speedy', 'Puta!!', and 'Alevir'.

The way I dealt with these was to create several short (2 byte) .txt files and give each file the same name as each of these viruses - then simply changed the attributes of each .txt file to Archive and Read-Only. This technique has sucessfully prevented any further attacks from these viruses.

Some malware attacks place a start-up link in the win.ini file, so to target this problem I've found it useful to have a 'clean' copy of win.ini (re-named to win.xxx) with which I over-write the existing (and possibly corrupted) win.ini using a simple "copy c:\windows\win.xxx c:windows\win.ini" line in the autoexec.bat file.

I've still had problems with the 'Dupator' and 'Spaces' viruses which corrupt any .exe files they find, which is why I don't clone Win98 using the methods being proposed in this thread. Instead, I use Symantec's Ghost to create a primary partition image file, which I incrementally update with each new program added, and store on a secondary partition or secondary hard drive. Then, when I have sufficient Ghost image files, these get burned onto a CD.

It's a system I've been using for several years now, with no problems thus far ....

0

Share this post


Link to post
Share on other sites

@'SAE140' Could you not use a Hard Drive Caddy ?

I have two caddies and two external HD, but they connect using USB2, and what I would like to know is the way to keep out of the box the main drive, if ever exists a way to do it. In fact I've never seen it until now.

Concerning viruses, I never had such a virus invasion. In fact I've never been affected by any virus at all for years. In any case, I have a .rar file of C:\Windows on a CD and when anything goes wrong I boot D:\Windows, format C: and rebuild the whole C:\Windows from scratch in less than 2 minutes.

All other folders (Program Files and My Documents) are in other drives, so I never loose any information at all.

Edited by cannie
0

Share this post


Link to post
Share on other sites
@'SAE140' Could you not use a Hard Drive Caddy ?

I have two caddies and two external HD, but they connect using USB2, and what I would like to know is the way to keep out of the box the main drive, if ever exists a way to do it. In fact I've never seen it until now.

I actually meant an IDE hard-drive caddy, the kind which fit internally and connect onto the standard IDE cable - not a USB caddy - I should have been more explicit. I've also seen these described as "Removable Frame Mobile Racks".

http://www.acme-technology.co.uk/mobile_rack.htm

These older-style IDE caddies have a frame which fits into a standard 5.25" bay, with a swappable caddy containing a 3.5" hard drive which slides into the frame. With a few caddy trays, it then becomes possible to swap drives around and if the caddy is set as primary boot, then it's possible to change complete systems instantly, without opening-up the case. I don't know if this is what you have in mind ?

Of course you can boot from a USB-HDD caddy, but only if your motherboard supports booting from a USB device.

0

Share this post


Link to post
Share on other sites

Hi SAE 140!

I didn't understand you. This could be a good solution, I'll try to find the parts.

Thank you!

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now

  • Recently Browsing   0 members

    No registered users viewing this page.