TheStarman
About TheStarman
TheStarman's Achievements
0
Reputation
-
Clone easily Windows 98 and XP in the same computer.
TheStarman replied to cannie's topic in Pinned Topics regarding 9x/ME
First, I'm glad to see some users are still benefiting from my work on the MSWIN4.1 Boot Record, etc., which BTW, you can find at these mirror sites: http://thestarman.narod.ru/asm/mbr/ http://vertcomp.com/starman/asm/mbr/ http://mirror.href.com/asm/mbr/ http://thestarman.pcministry.com/asm/mbr/ [may soon go offline permanently] I dumped my own personal site at dan123.com long ago. My original site at GEOCITIES is still there, but is often blocked due to overuse (its highest in many Google searches); not to mention all the ads there as well. (NOTE: I reserve the right to use any of this post in my own copyrighted works, and only give MSFN.COM the right to display my words on this web site; Daniel B. Sedory, 6 OCT 2008.) Someone asked me to stop by here, and I've decided to say a few words about this topic. I'll discuss the use of FINDPART's Getsect and Putsect programs in this post. Charlotte was quite correct in stating that Putsect, unfortunately, can only write 1 (one) sector to a disk at a time; I'll have more to say about that later on. Although the following is an important step in using Svend Mikkelsen's FINDPART program to write a sector to disk: You still need to provide all of the information between the "<" and ">" markers shown below, or else Putsect will not write anything to your hard disk(s)! The only optional switches are those between the brackets ("[" and "]"): Usage: Findpart Putsect <disknumber> <cylinder> <head> <sector> <filename> <cylinders> <hash> [checkfile <checkfilename>] [force] This means that even the easiest way to use Putsect; i.e., using the "force" switch, you must still include the total number of cylinders in your disk and even a dummy hash value! Here's an example of the only way you can save a copy of your Master Boot Record (MBR) sector, and then restore it using Putsect: 1. Save the MBR contents using: findpart getsect 1 0 0 1 1 mbr.bin noheader 2. Use any other utility, or Svend's FINDPART itself, to determine the number of cylinders in your disk. For example, I used Svend's FPART495.BIN file (from inside his "fp495dos.zip" download) as a floppy boot diskette (it uses FREEDOS and HXLdr32 V1.9.1) on a 299 MiB disk running DOS 5.0 (under BOCHS; http://bochs.sourceforge.net/ ) and this command: findpart tables Returned the following: A:\>findpart tables Findpart, version 4.95 - for Windows 95/98/ME/NT/2000/XP. Copyright Svend Olaf Mikkelsen, 1999-2008. OS: Windows 92.2337203685478.0.2222 Partition tables: Disk: 1 Cylinders: 609 Heads: 16 Sectors: 63 MB: 299 -PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS 0 1*06 63 306369 149 0 1 1 303 15 63 OK OK 0 2 05 306432 306432 149 304 0 1 607 15 63 OK 304 1 06 63 306369 149 304 1 1 607 15 63 OK OK The only piece of data you need to focus on above is the "Cylinders: 609" which tells you the total number of cylinders for this particular disk. 2. b. Don't forget to enter: "set findpart=edit" 3. Now in order to write the file "mbr.bin" (which must also be exactly 512 bytes) to the first sector of your first hard disk (which, in this case, has 609 cylinders), you must enter: findpart putsect 1 0 0 1 mbr.bin 609 00000000 force Note: The 'dummy hash' value is eight (8) zeros in length; it must be 8 digits. From all of the above, you can see that Svend takes writing to a disk as something VERY serious; only for experts! One of the reasons he did this is to ensure that when he sent a repaired sector to a client, he could know absolutely for sure that the data would only be written to the correct disk exactly as he intended; thus the reason for the hashing of the file and a predetermined cylinder value. So, putsect is far from being user friendly. This is all very unfortunate, since it would have been a great complement to what many have found a very useful program; that is Getsect. By giving someone a Getsect command, or even putting it inside a Batch file for them and telling them to just run it, I can get any reasonable number of sectors from anywhere on a hard disk sent back to me in an email, knowing I'll usually be able to see their raw disk sectors as if I were there with a disk editor myself. One other item Charlotte mentioned may be very important to some users: If you do have an AV program or enabled control over your hard disks' MBR sector via the BIOS, you need to remember that after you allow findpart to write to the MBR sector, those AV programs must be updated with a copy of the newly written MBR -- if you purposely changed its contents! Anytime you add or delete partitions to or from a hard disk, you need to update that data. Countless users of Norton AV have messed up their brand new install of a second OS by forgetting this, and when they reboot their computer, NAV complained about a possible virus in the MBR sector and without thinking, they allowed NAV to overwrite their new MBR with an old copy, then found out they could no longer boot into the new OS next time!!! PS: If you ever accidentally delete one of your disk's partitions, you can easily get it back by using TESTDISK ( http://www.cgsecurity.org/wiki/TestDisk ) La8r, Daniel (TheStarman).