Jump to content

Macrium clone of XP drive assigns letter to boot (MBR?) partition - no longer hidden


glnz

Recommended Posts

Nice to see there's still life in this XP part of the forum.

Using Macrium Reflect Free version 7.2 in a bootable USB stick, I finally cloned my XP drive from my Momentus XT hybrid drive that seemed to stutter (the source) to a plain vanilla WD hard drive.(the destination).  This was a direct clone - I had both drives inside my machine (an Optiplex 755 Desktop with 4GB RAM) when I ran the clone.

Immediately after the clone, I shut down, removed the Momentus XT, moved the WD to the SATA cables that used to go to the Momentus XT, rebooted using the Macrium USB stick into the Macrium PE environment and used the Macrium to "Fix Windows Boot Problem".  (I did this because a prior effort to clone the Momentus XT onto this WD failed with BSOD screens when I tried to boot up the WD.)

Well, with one exception, the clone seems to be working fine 12 hours later.  Still keeping an eye on it.

Here's the issue -- and, remember, I now have only the clone WD hard drive in the machine.

In Explorer, in addition to the C:\ drive (good), I am also seeing a D:\ drive that seems to be the bootup (MBR?) partition.  I would NOT normally expect it to have a drive letter or be visible in Explorer.  If it's visible, I might screw it up someday.

  1. What should I do?  Just eliminate its drive letter in Disk Management?  Should I go into Safe Mode first to do that?
  2. Will the machine still find it to re-boot next time?
  3. If the machine can't find it and won't re-boot next time, what would I be able to do to re-assign it as D:\ and so at least be able to re-boot?

By the way, I'm a lawyer, not a tech person, and I don't know what I'm talking about.  (We lawyers never do - we just make it up as we go along, which is why you can't understand us.  And then we send you a bill)  I don't know what MBR means. I can tie my shoelaces and boil water, but that's about it.

I don't seem to be able to insert any graphics here, but here is a link to a png of a screenshot of what this D drive looks like.

https://my.pcloud.com/publink/show?code=XZ2dJJkZwAFz8nML7LkBhJcYaUFWTVvhGkw7

Looks like the bootup - MBR partition, yes?

Now, here's a link that shows what my Disk Management looks like:

https://my.pcloud.com/publink/show?code=XZltJJkZXktXYt3NRQHOEz3yFnTGaJaiYDLV

(Those two partitions on the left surrounded by a green border are deeply hidden partitions that were on the Momentus XT when I removed it from my wife's laptop ages ago.  I wanted to use the Momentus XT in my XP machine but also wanted to preserve those partitions.  They are not active and the XP machine has never noticed them (good). 
The two partitions that count are the two on the right.  I can't do a screenshot, but if I right-click the D: partition, I see an option to "Mark partition as active", which I suppose means it is not active yet.  If I right-click the C: partition, that option is greyed out, which I suppose means the C: partition is already active, which makes sense.)

So - should I just use Disk Management to remove the D: drive letter from that partition?  But please see my questions 2 and 3 above.

Thanks.

Edited by glnz
Link to comment
Share on other sites


Actually, the more I think about the files in this D: partition, the less sure I am that it is boot-up (MBR).  Maybe it's just the Dell utility partition?  I can't tell.

But it didn't have a drive letter before.

What does your boot-up - MBR partition look like?

Link to comment
Share on other sites

That is a DELL utility partition.

Your (only) system and boot volume is seemingly the C:\.

Anyway you have (why) an extended partition (before the D: and C: volumes) containing two logical volumes with an unknown tag.

Maybe after all Macrium didn't do very good work (or maybe the source hybrid drive was a mess to begin with?).

The MBR is a Master Boot Record, and it is stored on the first absolute sector of the disk (or LBA 0).

It is made of four relevant parts:
1) boot code (that is executed by the BIOS when you boot)
2) Disk Signature (on NT based systems which is what Macrium fixed under the generic "Fix Windows Boot Problem")
3) the Partition Table, consisting of 4 entries, 16 bytes each, each one being able to contain the addresses of up to 4 primary partitions or up to 3 primary partitions and 1 Extended partition (this latter can contain more than one logical volumes)
4) the "Magic Bytes" 0xAA55

Now, entering the details of item #3 above, each partition entry is composed of 4 fields:

f1) Partition ID (this indicates to the OS which type of partition is the entry relative to, an extended is either 0x05 or 0x0F, Primary volumes have an ID that usually corresponds to the filesystem applied to the volume
f2) CHS start adrress values (in Cylinder/Head/Sectors)
f3)CHS end address values (in Cylinder/Head/Sectors)
f4) LBA start address value (in sectors)
f5) LBA extension value (in sectors)  

Now, normally a DELL Utility partition like the one you have is a small FAT 16 volume, and such a a FAT 16 volume has normally a partition ID of either 0x06 or 0x0E, BUT many OEM change the partition ID for their recover/utility volumes to an ID that the OS would consider "hidden" and thus refrain from assigning a drive letter to it (i.e. the volume is not mounted/visible in Explorer).

DELL uses normally for these partitions the 0xDE partition ID.

It is entirely possible that Macrium, while doing what it calls "cloning" or while doing what it calls "Fix Windows Boot Problem", decided that the volume after all was a plain FAT 16 one and changed the ID back to either 0x06 or 0x0E.

Fixing this is simple and can be done in no time,

What is perplexing is the extended partition containing:

1) a 78 MB FAT volume
2) a 80 GB NTFS volume

without any drive letter assigned to them

Only you can say if this is "normal" (it is entirely possible that the 80 GB .

In theory you should:

1) switch off the PC
2) remove the new hard disk
3) re-attach the old hybrid hard disk
4) boot the PC from it
5) take a screenshot of disk manager corresponding to the one you just posted

Since views on the disk manager are not "exact" data, you should make a direct copy of the MBR when booted from the old hard disk, then reverse the procedure, detaching the old hard disk and re-attaching the new one, etc.

IT IS VITAL THAT THE TWO CLONED HARD DISKS ARE NEVER CONNECTED AT THE SAME TIME TO A PC RUNNING A NT BASED SYSTEM as this will create a Disk SIgnature conflict and the NT OS will silently change the Disk Signature of one of the two devices.

To make the copy of the MBR use this simple tool, HdHacker:

http://dimio.altervista.org/eng/

You want to choose "Physycal Drive (MBR)" (and 0 in the dropdown on the right, should appear automatically) and below "First sector (MBR)". leave "number of contiguous number of sectors to read" set to 1

then "Read sector from disk"

then "Save sector to file"

Save them as oldhd.mbr and newhd.mbr to a USB stick (so that you can connect it to the PB both when the old hard disk is in and later when the new hard disk is in the PC), then compress them together in a .zip file and attach the archive file to your next post or upload it *somewhere and provide a link to it.

jaclaz

 

 

 

Edited by jaclaz
Link to comment
Share on other sites

Jaclaz - wow - very informative.  Thank you!

Your description confirmed my guess that the D partition was only the Dell Utility partition, and so just now I was successful in removing the D drive letter and rebooting.  It no longer shows up in Explorer - good - just like before the clone.  (That Dell utility partition still shows in Disk Management, but now (again) without a drive letter.)

As to the two mystery partitions that you saw - they are a historical artifact.  Originally, the Momentus XT drive was purchased as a replacement drive for my wife's Dell Win xp laptop.  But that laptop had a meltdown shortly afterwards, and she moved to Apple, never to return to MS.

I saved that Momentus XT drive, which had her laptop C; and Dell utility partitions on it.

A little bit later, when I needed to replace the original hard drive in my Dell Optiplex 755 (on which I am writing now), I used that Momentus XT.  But the first thing I did was to hide those two existing partitions very thoroughly, rather than delete them, just in case she needed a missing file.  I moved my XP Dell Optilex onto the remainder of that Momentus XT, where it functioned in my Dell Optiplex 755 for a few years.

Recently, the Momentus XT seemed to hiccup, causing network interruptions and re-downloads of my current aol email.  So. yesterday, I finally cloned it to a plain vanilla WD hard drive but keeping those deeply hidden old partitions in place (also on yesterday's clone),  Here we are. 

So far so good.

Thanks also for pointing me to that tool HDHacker.  I did not go to the trouble of saving the MBR info from the now-removed Momentus XT but did just now save the info from my new WD.  In case you're interested, here is the link to my two dat files - one from the logical drive and one from the physical drive:

https://my.pcloud.com/publink/show?code=VZLjHJkZeUTX4PBaO4urWUsVN9pDfYOBfvN7

Of these two dat files.  When I "Compare with loaded", the dat from "Logical Drive (Boot Sector)" is the same as loaded, and the dat from "Physical Drive (MBR)" has many differences from as loaded.  Don't know what that means.

What do you think?

 

 

Link to comment
Share on other sites

Good :), so the "hidden" volumes inside Extended are (let's say conventionally) "normal", no, wait :dubbio:, let's call them completely abnormal but expected.

Back to the MBR.

I don't know what you are doing/did but the two files you posted are EXACTLY the SAME and BOTH are NOT the MBR (they are both the bootsector of volume C:\).

Very likely you made some confusion either in reading them or saving them.

I need the MBR, that is 1st sector of PhysicalDrive 0.

Even in the (I know, confusing) view that HdHacker provides, in BOTH the files you posted you can easily read at  the begining ".R|NTFS" and then "NTLDR" a couple of times and near the end "Press Ctrl+Alt+Del to restart", the file I need is likely (if it is the standard XP MBR) to begin with "3." and have near the end "Invalid Partition Table.Error loading operating system,Missing operating system,"

If you follow EXACTLY my previous instructions you cannot get the bootsector of drive C: 

Anyway, if you are OK with the current status, let it be.

Normally (but it depends on the model, and the way the good DELL guys configured it) having the partition ID set to 0xDE is needed to use its contents the way they are intended, but it is entirely possible in your specific case that the current partition ID (either 0x06 or 0x0E) is fine and even originally it was simply removed from the drive letter assignment pool.

The question (to answer wich the "old" disk MBR is also needed to make a comparison) is if what Macrium calls "Fix Windows Boot Problem" actually does, as three things are possible:

1) it simply deletes the MountedDevices key in the Registry (this way the hive will be re-populated by Windows at next boot, taking into consideration the new Disk Signature) [1]
2) it restores the original Disk Signature [2] and doesn't touch the Registry
3) does - additionally to either 1 or 2 above - some automagic changes on the MBR partition ID's [1] 

jaclaz

[1] and then the disk is not anymore a "clone"
[2] and then the disk may be a "clone"

Edited by jaclaz
Link to comment
Share on other sites

Jaclaz - For some reason, the second file-link I saved from HDHacker is wrong.  The Physical Drive (MBR) is NOT the same as the Logical Drive (Boot Sector).

Physical Drive (MBR) is here:

https://my.pcloud.com/publink/show?code=XZKsRJkZxC2C0P2DmczG1FsuPxhfH8kvIncV

Logical Drive (Boot Sector) is here:

https://my.pcloud.com/publink/show?code=XZNsRJkZCNpTxvRh6iF3RTd8iRyqoJYPqxg7

Please confirm they are now different.

When I "Compare with loaded", then "Logical Drive (Boot Sector)" is the same as loaded, but "Physical Drive (MBR)" has many differences from as loaded.

New thoughts?

Thanks.

 

 

 

 

is NOT the same as the Logical Drive (Boot Sector)

Link to comment
Share on other sites

Yep, now the MBR is the right file :) , here is the partition table:


Entry	Type	Boot bCyl 	bHead	bSect 	eCyl 	eHead	eSec  StartSector  NumSectors 
#0	05	00	0	1	2	1023	254	63 	64		167927381
#1	06	00	1023	47	49	1023	254	63 	167927808	176652
#2	07	80	1023	59	61	1023	254	63	168105984	808662079
#3	00	00	0	0	0	0	0	0 	0		0

As said the only possible issue is the type of the partition #1 which is now 0x06 but that could be either 0x06 (with the drive letter not assigned to it in Disk Manager) or 0x0DE (or other "hidden" type of partition).  

But as said if you actually need to access that DELL partition and it doesn't work you can always try to change the ID at the time you will actually need to use it (if you will ever need to use it).

The partition offsets (StartSector) are a bit "queer", but nothing to actually worry about, the only thing that I would NOT dare to do (but that you have not ANY reason to ever do it, so it is only a hypothetical problem in theory) would be to change the active (Boot) status of the partition with XP Disk Management, as it is known to do "queer" things to the Extended partition (and volumes in it) when it finds "queer" values, but nothing to worry about in normal operation of the PC.

All in all I would leave everything "as is".

jaclaz

 

 

 

Edited by jaclaz
Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...