Fortunately in Win9x critical maintenance is easy to do. I usually run a compiled INNO exe that performs a complete data collection: CMOS dump, MBR/MBS/VBR and more, Registry export, Registry DATs, complete Filelist, and critical OS and log files. Winrar is nicely suited for most of this, CMOSSAVE, REGEDIT, and FINDPART are other useful tools.
There are many ways to save/restore the Master Boot Sector (the first 512 bytes of disk 0 which contains the MBR). In my experience it is better to grab more than the first sector's 512 bytes, and since it takes no more time or effort why not just grab the first 95 sectors (absolute sectors 0 to 94). This is everything up to but NOT including the first FAT. The output is a mere 48,640 bytes and contains lots of important information needed to reconstruct a HDD. Sometimes I do grab at least one of the two FATs also.
FINDPART is one of those great uber-hacker utilities and it is free. Last seen on this page (I highly recommend that technically skilled users download everything on those webpages). The FINDPART utility combines in one EXE many other tools, I quote the author:
The Findpart Windows version includes the functionality of the utilities FindNTFS, GB32, Chsdir, Editpart, EditGUID, Findfat, Getsect, Putsect, Cyldir, Finddir, Findext2, Findbad, Pqrp, FindJPG, FindDoc, Readext2 and Readfat.
Using the GetSect component of FindPart returns this information:
Getsect, version FP 4.91. Copyright Svend Olaf Mikkelsen, 2007. Usage: Findpart Getsect <disknumber> <cylinder> <head> <sector> <no of sectors> [+]<filename> [noheader] [backwards] [bad00 | badf6] Writes the sectors to <filename>. Use +<filename> for append. Returns 0 if the sectors are read without errors. Option 'bad00' or 'badf6' writes ascii 0 or hex F6 for sectors that cannot be read. The output file can be viewed with the Windows 95/98 'edit /64 <filename>' command. Disks are numbered from 1.
For my example, this command saves the aforementioned 48,640 bytes:
FindPart.exe GetSect 1 0 0 1 95 MBRPLUS.BIN noheader | | | | | | | | | +-----> total of 95 sectors | | | +------> sector 1 | | +------> head 0 | +------> cylinder 0 +------> 1st disk (disk 0 aka C:)
All the bytes contained in the first 95 sectors are saved into into a file called MBRPLUS.BIN. Note that there is a corresponding PutSect component to add such saved data back into the HDD. The NOHEADER means that only data is written to the file lending itself to be restored back to a HDD. Of course the following will give you just the 512 byte MBS that you originally asked for:
FindPart.exe GetSect 1 0 0 1 1 MBR.BIN noheader
EDIT: please see post#24 for an update. In short, FindPart PutSect apparently can only restore a single sector to a HDD. To restore multiple saved sectors something else must be used.
This post has been edited by CharlotteTheHarlot: 01 October 2008 - 04:32 PM