General information
Copyrights, disclaimer and distribution
Program description
How to use
Run errors
Tools used and copyrights
Known issues
Changes since previous version, and what to do with old backup-files
Contact information
The E-mail support notification

People who are already familiar with MBRtool can skip to the "Changes" part of the manual, if you like. However, please check the function descriptions for an explanation of the new functions.

MBRtool.exe - the program, version 1.10
MBRtool_user_manual.htm - this manual, formatted, in HTML
Readme.txt

For info on harddisks and recovery check the DIY DataRecovery (http://www.diydatarecovery.nl) pages. This site contains information on harddisk recovery and assorted info.

This program is conceived and coded by Tom Kuurstra.
Original concept by Tom Kuurstra and Joep van Steen.
(C) 2000/2001, DIYdatarecovery.

All the Information and/or Programs supplied by us (DIYDataRecovery) are AS IS. Use of this Information and/or Programs is at your own risk. We can not and will not be held responsible for any damage that is inflicted by the person and/or persons using the Information and/or Programs we supply.

You may not include (parts of) this program in your own code and/or programs. Please check below for redistribution notices.

You, as the user, are not permitted to:

• decompile, disassemble or change the program code in any way;
• change the documentation or any text accompanying the program;
• change the distribution in any way. No files may be removed from and no files may be added to the distribution;
• use this program for commercial reasons or in environments (i.e. companies or persons) that (make a) profit from datarecovery;
• (re)sell the program, or accept any fee for distributing or using the program

This program is distributed as Freeware. You are free to use and distribute this program, as long as you comply with the above mentioned rules.

We also ask that you supply us with feedback on what has gone right and/or wrong. Also, any suggestions for changes or improvements are welcome. Contact information can be found at the end of this document.

MBRtool allows you to do the following things:

• backup, verify and restore the MBR, using backup-sectors or files
• backup, restore and wipe the entire track 0 for a disk
• edit or blank the MBR Partition Tables
• refresh the MBR bootcode
• remove the MBR bootcode
• re-write the MBR signature bytes
• display the MBR sector
• perform above mentioned edit, bootcode and display functions on the MBR backups
• create a blank backup-file to create a MBR from scratch and restore it later
• perform attribute changes on partitions listed in the MBR Partition Table (hide, activate etc.)

MBRtool supports the first 4 harddisks it finds on the controller (any type).

Backups can be made from the MBR to sector or to file.

MBR Backups to sector: MBRtool can be left to auto-select a target sector for the backup or MBRtool can be forced to use a sector, no matter what it contains. Use /S to let the program auto-select a target-sector from the range 2 - 10 or enter /S:x (where x is the sector) to force the program to write the backup to the selected sector.
auto-select (/S) : the program uses the sectors 2 through 10, on track 0 on the disk that contains the MBR you wish to back-up, to write the backups. MBRtool uses a clever method to determine if the target sector contains anything that has to be there (like drive-overlay signatures) and if anything is found, the sector will not be used for backups. MBRtool starts with sector 10 and works it's way done to sector 2. If all sectors are used (for either backups or anything else) the program will not make a backup. You can list or clear the backups using a command described later.
select sector (/S:x) : If a backup to sector is selected using /S:x the backup will be written to the specified sector, no matter what it contains. Be careful with this. Only use this if you know the target sector is clear or contains an (old) MBR backup.
You can let the program check to see if the target sectors are clear using one of the options described later.

In practice : if you only make a backup now and then and wish to make the backup to sector, run MBRtool using the auto-select sector method. Example : MBRtool.exe /X:B /D:0 /S. Once you run out of target sectors, clear them and start over.
If you wish to make regular backups, and wish to automate this by putting MBRtool in the Autoexec.bat (or any other procedure that runs often), use the select sector method. Example : MBRtool.exe /X:B /D:0 /S:10. 

MBR Backups to file: MBRtool places the file containing the MBR backup in the current folder. If the file already exists it will be overwritten. Use /F without a filename to use the default filename (MBR_BACK) or use /F:filename to enter a filename to be used for the backup. The maximum length for the filename is 8 characters. Do not enter the extension. The extension is added by MBRtool and will consist of the physical disk number that contains the original MBR, 128 through 131.
It should be obvious that making a backup to file on the disk that contains the MBR is not wise. In case of disaster the file can not be used for recovery, because you cannot read the disk. Place MBR backups to file on a different disk then the one containing the original MBR.

If you wish to make MBR backups to file and retain a history of backups, use the following batch-file as an example to achieve this. The example will retain the last 3 backups, but can easily be expanded:

if exist mbrback3.128 deltree /y mbrback3.128
if exist mbrback2.128 ren mbrback2.128 mbrback3.128
if exist mbrback1.128 ren mbrback1.128 mbrback2.128
mbrtool.exe /x:b /d:0 /f:mbrback1

The Backups: The backups are changed so that the program recognises them as MBR backups. This means that the backups themselves are not usable, they must be restored using MBRtool.
It is, however, possible to recover a MBRtool backup sector without the use of MBRtool.
Let me explain : a conventional MBR has what we call a signature. This signature consists of 2 bytes at the end of the sector that contains the MBR. When MBRtool makes a MBR backup to a sector or a file MBRtool changes this signature and replaces it with something MBRtool recognises. The original signature is put back in place when a restore is performed. The original signature for a MBR is Hex "55 AA". MBRtool replaces this with Hex "BB BB". Therefore, if you wish to manually restore a backup sector to the original MBR sector, you must change the last 2 bytes back to Hex "55 AA". A manual restore operation, without the use of MBRtool, can be performed with a hex-editor. Explaining this procedure does not fall within the scope of this manual. Visit the DIYDataRecovery Recovery guides for information on this.
A manual recovery of a backup made to file is also possible, though somewhat more labour-intensive. If you open a backup-file you will see that it is made up as follows : the first 3 lines contain the program name, the program version and the disk number. The lines following that contain the hex-representation of the MBR. Each line contains 32 bytes, each byte being a 2 digit Hex number. There are 16 lines, making up the 512 byte MBR. Please note that the 32 bytes (each consisting of 2 digits) on each of the 16 lines also contain control values. These are placed at the end of the line after the 32 Hex-bytes. So be careful when using this restore method, use only the first 32 hex-bytes (meaning the first 64 digits) on each line and discard the rest.
Use a Hex-editor to enter the hex values you see here in the MBR. Don't forget about the signature bytes.
It should be obvious that the preferred and most logical way to restore backups, is to use MBRtool. The above examples are given to help users with recovery scenarios in which they might not have the use of MBRtool (for whatever reason).

The method: MBRtool uses int13H calls to access the harddisk through BIOS. This means that the program will NOT run from Windows NT or Windows 2000 (NT and 2000 prohibit access to hardware). If you wish to use MBRtool on a system running Windows NT or Windows 2000, you must use a real-mode DOS boot-disk. If you run into problems running the tool from Command prompts in Windows 9x or ME, use a real-mode bootdisk. It is preferred to run MBRtool from a real-mode bootdisk.
On systems running Windows 9x it is possible to add MBRtool to the autoexec.bat for automatic creation of MBR backups. Windows ME does not allow this.
On Windows 9x systems it is possible to run MBRtool from a Command prompt in protected mode. Windows ME does not allow this. If MBRtool is asked to write a backup to sector under Windows ME, it will inform you that the backup is NOT written. Windows ME does not allow write-access to sectors in protected mode. This means that making a backup to file will work okay.

MBRtool is command-line operated. The program runs in real-mode DOS or a Command prompt in Windows 9x or ME. The options that are not related to manipulation of sectors or MBR's (like editing a backup-file) can be performed from Windows NT/2000.

- The command line

MBRtool without any arguments will display the help-screen and the copyright notice.
The command-line arguments consist of the following:

/X:y - select the operation to be performed, where y is the selected operation
/P:XyXyXyXy - change partition attribute X for partition y (max 4 times in 1 command)
/D:n - select disk to perform the operation on, where n is one of: 0,1,2,3 or A for all
/S - select a sector as target, the program will auto-select a target sector.
  OR
/S:n -  select a sector as target, force the program to write the backup to sector n

/F - select a file as target or source for a backup, the program will use the default filename
  OR
/F:filename - select a file as target for a backup, using the filename entered. No extension, the filename must not exceed 8 characters in length

Note :
- selecting all disks (/D:A) is only valid for Backup, Checking target sectors and Listing/Clearing backup sectors
- when performing a Restore, Verify, Display or Edit function on a backup, you must use /S:n or /F:filename to specify the location of the backup. If /S or /F is not entered, the selected action will be performed on the original MBR.
- a filename must be entered (/F:filename) when backing up or restoring a track 0.

Please note that MBRtool assumes the first disk to be disk 0, the second disk 1 etc.

- The options for /X

The possible operations (and arguments for /X) are :

B - perform a MBR backup.
A disk must be selected (/D:0 - /D:3 or /D:A for All). If /D:A is selected a backup is made of all MBR's on the first 4 disks.
A target for the backup must be specified. Choose /S or /S:x to make a backup to a sector on the same disk as the original MBR.
Choose /F or /F:filename to make a backup to a file that will be written to the current folder or disk.

R - restore a MBR from a previously made backup.
A disk must be selected (/D:0 - /D:3). The location of the backup must be specified through /S:n or /F:filename.

V - verify a backup against the original MBR, or validate a backup.
A disk must be selected (/D:0 - /D:3). The location of the backup must be specified through /S:n or /F:filename. This option will also validate the backup and tell you if it has been corrupted, so you can use this option to simply tell if you can use the backup without it being important whether the backup is identical to the MBR.

H - check target sectors.
A disk must be selected (/D:0 - /D:3 or /D:A for All). This option will check the sectors that are used for backups to sector. The sectors 2 through 10 on track 0 are checked to see if they are free for use. If the sectors already contain data or backups, they will not be used for backups if the auto-select method is used.

L - list the sectors that contain a backup.
A disk must be selected (/D:0 - /D:3 or /D:A for All). This option will list the sectors on track 0 that have been used for backups using the backup to sector.

Z - remove the backups from the backup sectors.
A disk must be selected (/D:0 - /D:3 or /D:A for All). This option will clear all the sectors on track 0 that have been used for backups using the backup to sector. Only backups will be removed. If the sector contains other data, the sector will be left alone.

X - backup up the entire track 0.
A disk must be selected (/D:0 - /D:3) and a filename must be entered (/F:filename). This option will dump the entire track 0 for the selected disk to a file. The file will only contain the exact image of the track 0 and nothing else. These files can be used to perform remote editing on track 0 by using a hex-editor, or to safely look around in track 0 using a hex-editor without the risk of damaging the real track 0. Ofcourse they can also be used as simple backups.

Y - restore the entire track 0.
A disk must be selected (/D:0 - /D:3) and a filename must be entered (/F:filename). This option will restore the entire track 0 to the disk that has been selected on the command-line. Please note that the extension for the file will determine which disk was selected. If the disk selected on the command-line is not the same as the disk portrayed in the file extension, the restore will not proceed. To force this (if neccessary), rename the file.

O - wipe entire track 0.
A disk must be selected (/D:0 - /D:3). This option will wipe the entire track 0. Track 0 will be filled with null-characters. Use with caution. This will also wipe any disk-manager signatures. Use this option to for instance kill disk-manager signatures or to clean the harddisk to prepare for a clean install.

A - write a blank MBR-backup file.
A disk must be selected (/D:0 - /D:3) and a filename must be entered (/F:filename). This option will create a blank MBR-backup file. This can be used to recreate a MBR from scratch and restore it later. This could be handy for remote recovery support.

D - display the MBR, either original or backup.
A disk must be selected (/D:0 - /D:3). If /S:x or /F:filename is not used, the original MBR is displayed. When displaying a backup, the location of the backup must be specified through /S:n or /F:filename. This option will also validate the backup and tell you if it has been corrupted.

E - edit the MBR Partition Tables, either for the original or a backup.
A disk must be selected (/D:0 - /D:3). If /S:x or /F:filename is not used, the original MBR is selected. When editing a backup, the location of the backup must be specified through /S:n or /F:filename. This option will also validate the backup and tell you if it has been corrupted. Please check below for information on the editor.

W - wipe the MBR, either the original MBR or a backup.
A disk must be selected (/D:0 - /D:3). If /S:x or /F:filename is not used, the original MBR is wiped. When wiping a backup, the location of the backup must be specified through /S:n or /F:filename. This option will also validate the backup and tell you if it has been corrupted (allthough that is rather uninteresting when wiping it, nevertheless).

P - blank the Partition Tables, either in the original MBR or a backup.
A disk must be selected (/D:0 - /D:3). If /S:x or /F:filename is not used, the original MBR is selected. When blanking the Partition Tables in a backup, the location of the backup must be specified through /S:n or /F:filename. The bootcode is NOT blanked. This option will also validate the backup and tell you if it has been corrupted.

C - blank the bootcode, either in the original MBR or a backup.
A disk must be selected (/D:0 - /D:3). If /S:x or /F:filename is not used, the original MBR is selected. When blanking the bootcode in a backup, the location of the backup must be specified through /S:n or /F:filename. The Partition Tables are NOT blanked. This option will also validate the backup and tell you if it has been corrupted.

M - write/refresh the bootcode, either in the original MBR or a backup.
A disk must be selected (/D:0 - /D:3). If /S:x or /F:filename is not used, the original MBR is selected. When writing the bootcode in a backup, the location of the backup must be specified through /S:n or /F:filename. The Partition Tables are NOT blanked. This option will also validate the backup and tell you if it has been corrupted.
Note : the bootcode that is written using this option is generic Wintel bootcode and can be used for all Win/DOS platforms. If you have the Linux LiLo bootcode in your MBR DO NOT USE this option, it will leave your system unusable. Support for this will be added later.

S - write the signature bytes for the MBR.
A disk must be selected (/D:0 - /D:3). This option can only be performed on the original MBR. Use this option if something or someone has corrupted the MBR by removing the 2 signature bytes from the MBR.
When a backup is restored the signature bytes are automatically written.

P - change attribute for partitions that are listed in the MBR, either in the original MBR or a backup.
A disk must be selected (/D:0 - /D:3). If /S:x or /F:filename is not used, the original MBR is selected. This option can be used to change the attribute for the selected partition. Use the command as follows : /P:XyXyXyXy, where X is the selected action (A for activate, D for de-activate, H for hide and U for unhide) and y is the selected partition (1-4).
Example : /P:A2H1. This will activate partition 2 and hide partition 1.
This option can be used as a quick boot selector for multiple primary partitions, or to hide and unhide partitions without having to use a partition manager. Please note : "hide" will automatically de-activate a partition, "activate" will automatically un-hide a partition.
Remember to hide the other primary partitions when using this option as a bootable partition selector.

- The Partition Table editor

When the /X:E option is selected the Partition Table editor is displayed.
The screen displays the Tables twice. The top section displays the Tables as they are now, either from the original MBR or a backup. This is signified by the word "cur" on the left in the blue top-bar. Directly below the first display of the Tables is the menu-bar. This bar contains the options that are valid in the editor. Below the menu-bar is the second display of the Tables. These tables will reflect the changes you make during the editing. This is signified by the word "new" on the left in the blue top-bar.
Both displays of the Partition Tables also contain the displaying of the entries as they are recorded in the MBR (under "partition tables as shown in MBR"), for reference.
The bottom display of the Tables and MBR reference will be refreshed after each value change.

Each Table consists of 4 entries, making up the Partition Tables. The entries contain, from left to right (as is also displayed in the blue top-bar) the 10 following values :

• Partition Active, Decimal
• Partition Type, Hex
• Start Cylinder, Decimal
• Start Head, Decimal
• Start Sector, Decimal
• End Cylinder, Decimal
• End Head, Decimal
• End Sector, Decimal
• LBA Start Sector, Decimal (32 bit value)
• LBA Length, Decimal (32 bit value)

The following options are valid when in the editor (as displayed in the menu-bar):
Press 'Q' to leave the editor. Any changes made will NOT be saved.
Press 'S' to save the Partition Tables you have edited to either the original MBR, or a backup (as selected on the commandline using /S:x or /F:filename).
Press 'R' to revert the changes you made. All Table entries will be restored to their original values, as displayed in the Table in the top section of the screen.
Press 'B' to set all values to 0 and create a clean Partition Table to fill.
Press '1' '2' '3' or '4' to edit the entry selected.
Press '5' '6' '7' or '8' to blank selected partitions entries; press 5 to blank entry 1, 6 to blank entry 2 etc.

When you choose to edit one of the entries, you will be asked to enter the values for that entry. The program will ask you to enter a value for each of the 10 values that make up 1 entry. Press 'Enter' without typing any value to leave that value unchanged.
All values are entered and treated as decimal values, with one notible exception : the Partition Type. This is entered in Hex.
Example: the Active Partition value (the first value in an entry) is Hex "80". In the table it is displayed as Dec "128". You must enter "128" if you wish to edit the Active Partition value.
However, the Partition Type value will for instance display "0B", which means FAT32. If you enter a Partition Type value you must enter this as Hex. It is beyond the scope of this manual to list all partition types and how to manipulate partitions using this value. Check the DIYDataRecovery pages for more information on this.

When you have entered the C/H/S values for start and end entries, the program will calulate the LBA values for the last two fields that make up the partition table entry. You will still be allowed to edit these last two values, in case the calculations might be incorrect. This could happen due to the information that the BIOS returns to MBRtool for disk geometry. This information can be different for some BIOS's and might change the outcome for LBA calculations. When performing edit functions you should check the LBA calculations if you think your BIOS might return illogical values for your disk geometry. The edit screen displays the values that are used for LBA calculations at the 3rd line from the top. If these values are incorrect, calculate the LBA yourself and enter the values in the appropriate fields. The formula for calculating LBA addresses is : LBAsector = ((Cyl * DiskHeads) + Head) * DiskSectors + Sec - 1.
Normally, when using C/H/S notations in partition tables you are not allowed to enter values higher than the following : 1023 for Cylinders / 254 for Heads / 63 for Sectors (this restriction comes from days long gone by, when disks where not as large are they are today). To correctly calculate the LBA values it should be obvious that the true values for C/H/S should be entered, even if they are higher than the mentioned maximum values. In MBRtool you should always enter the C/H/S values as they should be used for the LBA calculations (higher than the maximums or not). MBRtool will reset the C/H/S values to their allowed maximum after they have been used to perform the LBA calculations.
If all this seems daunting, check our website www.diydatarecovery.nl and download PartitionDoctor. PartitionDoctor will perform these calculations for you. All you would then have to do is enter them in MBRtool.

The values you enter are checked for consistency. You are allowed to enter more than 1023 cylinders, to correctly calculate the LBA address. However, you are not allowed to enter values higher than your disk geometry for cylinders, heads or sectors.

In a normal MBRtool run all the messages displayed are notifications. The program informs you of the operation that has been requested and what the result is. If the displayed message starts with a '-' (as in '- Backup NOT written to sector') it means that something has gone wrong and that the operation was not completed (or aborted). This usually means that MBRtool could not get to the necessary resources (the backup-sector, the backup-file or the MBR) to complete the action. Check to see if the backup-sector or backup-file are not corrupted (by displaying them) and check to see if you have selected an existing disk for the operation.
When the message '!- could not read/write selected disk (RC=x)' appears it means that an Int13H error occurred, meaning that the disk could not be read or written to. Please note that this could be because of a command-line parameter. If you entered the following command : 'MBRtool /x:l /d:A' MBRtool displays the backup sectors for all disks. MBRtool does not check to see if those disks actually exist. Thus if you only have 1 disk, the example command would lead to errors being displayed for the non-existent other 3 disks. This has been done on purpose. The scheme that detects the Int13H error does this on a sector bases so that it becomes possible to identify bad sectors, if they would be used for backup and restore operations.
The text 'RC=x' in the Int13H error message means Return Code. An Int13H error usually returns a value that let's you identify the error. The most common errors are RC=1 (disk error/non -existent disk) and RC=3 (read-only error, is displayed when sector operations are performed under Windows ME).
If something unexplainable happens and you ask for support, be sure to include any messages the program displays, and the RC if it is displayed.

If a situation occurs that MBRtool can not handle, the program will abort with an error message. Please send the message with the error codes to us (see  contact information) and we'll get back to you as soon as we can. Please observe our "E-mail notification" notice, this can be found on the web-pages. Check the information at the end of this document.

MBRtool was created using Powerbasic for DOS, version 3.5.

I would like to thank Mel Bishop for pointing me in the right direction when i was looking for Int13H info on the Powerbasic forums.

All mentioning in the text of "win9x/DOS " refers to MS-Windows, (c) Microsoft Coorporation.

Nothing yet...

Changes since version 1.01:

• major code overhaul
• bug in backup to file for more than 1 disk fixed
• check on maximum heads corrected
• partition type is now displayed correctly in the editor (including the attribute)
• partition attributes can now be changed from the command-line (/P parameter)
• display MBR now includes the Partition Tables in editor format
• added corruption check to the backup files
• added function to write a blank backup (/X:A)
• added errorhandling for reading the backup files
• changed the sequence of items in the partition table display and edit screens
• added LBA calculations to the editor
• added saving, restoring and wiping of track 0
• added display of used disk geometry values for LBA calculations in the edit screen
• added possibility to delete 1 entry in the edit screen

Changes since version 1.00:

• LBA values when entered in the Partition Table editor are now checked. Due to a restraint in the compiler, i can not calculate Hex values larger than Dec 2,147,483,647 (well, actually i can but i haven't figured it out completely yet). This means for now that you can not enter values for LBA larger than this. The above mentioned value translates into a 1Tb harddisk size, so in practice this will hardly pose a problem. However, people with harddisks/hardware raid5 systems larger than 1Tb should NOT use the partition table editor that MBRtool provides. Backup and restore are safe.
  Version 1.00 of MBRtool simply crashed when a large value for LBA was encountered. Though not quite nice, it means that no changes to the MBR were made at runtime so no trouble there.
• some minor cosmetic code changes

What to do with old backups:

Backups made to sector can always be restored, regardless of the MBRtool version. These do not contain MBRtool specific info (except for the signature byte changes, see Program Description).
The backups made to file can not be interchanged between different MBRtool versions. Retain the previous version of MBRtool if you have old back-files that need to be kept, or recreate the backup-files using the latest version of MBRtool. The old versions of MBRtool will be kept available for download for this specific reason.

DIYDataRecovery :

website : DIY DataRecovery , (http://www.diydatarecovery.nl)
Support  E-mail address (author) : TKuurstra@Worldmail.nl

Currently, the distribution point for MBRtool can be found here. (http://www.diydatarecovery.nl/~tkuurstra/DIY_Tools.htm).

Check our webpages for current info on MBRtool.

We receive a lot of E-mail requesting support in one form or another. To make things a little easier on us we ask you to give us as much information as possible, so that we can help you quicker and do not have to guess at things. Datarecovery is an exact science.

When you have a question concerning datarecovery please include the following things:

• a clear description of the symptoms (things like "my OS doesn't boot" we cannot take seriously), including (if any) the errors you might be getting from the tool you are using;
• how the problem came about. A thorough description of the actions that led to the problem and a description of the environment (real mode, protected mode etc.) in which the problem occurred;
• a description of the running OS (Windows 9x / ME / NT / 2000 or OS/2 or whatever), including language information and version information;
• the (latest version) RepoMan log if it is a RepoMan related problem;
• a Partinfo log file. Check below to see how to make a Partinfo log file.

If these things are not included in the support request you will not receive an answer. Also, problems that are not related to serious datarecovery (like messed up boot files for instance) will not be addressed. Check your local bookstore for a dummies-guide on that.

How to make a Partinfo log file:

Partinfo is a tool that is part of the Powerquest PartitionMagic suite. The Partinfo tool can be downloaded from the Powerquest FTP site from here. 
Please note that Powerquest allows you to download these tools.
Create a Partinfo log file by using the following command:
"Partinfo > drive:\file.ext", where drive:\file.ext is the location of the resulting log file.

Thanx for complying.