|MBRtool version 2.3.200, user
Manual version 2.0, revision 8 - dated: November 2009
Brought to you by DIYDataRecovery.
|The contents of this
This documentation accompanies MBRtool version 2.3.200.
A word about the version numbering:
As of MBRtool version 2 the VRM numbering method is used. This means that the number consists of a Version-number, a Release-number and a Modification-number (and yes, I was inspired by IBM when I thought this up).
CAUTION: changing things in the MBR can be destructive, whether that is intentional or not. Whenever you decide to change something in the MBR, always make a backup first. The backup and restore routines of MBRtool have been tested extensively and are reliable. If something should go wrong during an action that changes something in a MBR, you will be happy that you've made that backup.
|This document assumes the reader to have
some knowledge concerning hard disks and partitioning. You should know what
the Master Boot Record is and what Partition Tables are. We also assume you know how to make
a real-mode boot disk and have at least working knowledge of the Windows
operating system(s) and real mode
environments. You should also know what Simple and Dynamic volumes are
(used in Windows 200X / XP / Vista / Win7) and what the Windows NT4 equivalents are
(Stripesets and Mirrorsets).
permission and distribution notices
This program is conceived and coded by Tom Kuurstra.
All the Information and/or Programs supplied by us (DIYDataRecovery) are AS IS. Use of this Information and/or Programs is at your own risk. We can not and will not be held responsible for any damage that is inflicted by the person and/or persons using the Information and/or Programs we supply.
You may not include (parts of) this program in your own code and/or programs. Please check below for redistribution notices.
You, as the user, are not permitted to:
This program is distributed as Freeware. You are free to use and distribute this program, as long as you comply with the above mentioned rules.
about the MBR
The Master Boot Record (or MBR) is the very first sector of a hard disk. This very important sector contains a number of things that
the Operating System and the computer BIOS need to start the system. If
the contents of this sector are lost or damaged you can not access the
data on the hard disk. Please note that each hard disk has a MBR, so if
you have 2 or more hard disks in your computer, each has its own MBR. If
multiple disks are configured as an array there is usually 1 MBR that
services the entire array, placed on the 1st disk in the array (there
are exceptions to this rule, but that is beyond the scope of this
manual). It should be clear that the MBR is one of the most important
(and, strangely enough, overlooked) sectors on your hard disk.
The smallest addressable space on a hard disk is 512 bytes at a time. A hard disk sector is 512 bytes long, so 1 sector is the smallest addressable space on a hard disk. The MBR is 1 sector, so the MBR is 512 bytes long. These 512 bytes are divided into several parts that each have their own function in getting the computer to start. The 4 main parts of the MBR are (in the order as they appear in the MBR):
The bootcode: this part of the MBR gets read by the computer BIOS when the computer is started. When the computer finishes its own startup procedures (getting the disks spinning, doing some checks) and gets ready to start the operating system, the bootcode in the MBR is read first. This allows the computer to interpret the rest of the MBR.
The volume bytes: these are 4 bytes that are located after the bootcode and just before the partition table. Windows 2000 and Windows XP use these 4 bytes to identify the mountable volumes on the hard disk. If these bytes are changed or erased from the MBR, Windows 2000/XP will go through a simple hardware detection round that will re-identify all the volumes on the disk. This is done during the next Windows startup after changing the volume bytes. Drive letters assigned to volumes might change after this. This goes for simple volumes, I have at this point no information on the effect of removing the volume bytes when using dynamic volumes.
The partition table: this is a sequence of 64 bytes (4 x 16) that
identify the first 4 (or less) primary partitions on a hard disk. There
is space for identifying 4 partitions. Each partition-identification is
made up of 16 bytes that describe a number of things about the
partition, such as: where it starts, what type it is, how big it is, is
it an active partition or not, etc. One of these 4 partition
descriptions can be used to describe an extended partition, which itself
can then contain logical drives. The logical drives are not described in
The signature bytes: these are 2 bytes that are used to signify an important sector. They can be found trailing the MBR, but there are other sectors that contain these bytes as well. If they are not trailing the MBR the computer will not be able to read the MBR (because it will not be recognized as an important sector).
So, the MBR consists of:
This makes a total of 512 bytes.
A word about Unix based Operating Systems:
MBRtool is the only tool that let's you play with each part of the MBR, so be sure to understand that MBRtool is a very powerful piece of equipment.
MBRtool allows you to do the following things:
MBRtool can be run from the command line or from the MBRtool menu. Type "MBRtool.exe" (without parameters) to use the menu. Type "MBRtool.exe /?" to see the parameter list. MBRtool returns errorlevels to DOS so that when the program runs from a batch-file results can be tested. Errorlevels are only returned if the program is run with the command line parameters, no errorlevels are set when the MBRtool menu is used.
MBRtool supports the first 4 hard disks that the BIOS finds. This means that the controller type or the disk type is not relevant. However, if the BIOS does not see the disks or arrays, MBRtool will not see any disks either.
Backups can be made from the MBR to sector or to file.
MBR Backups to sector: MBRtool can be left to
auto-select a target sector for the backup or MBRtool can be forced to
use a sector, no matter what it contains. Use /SEC
to let the program auto-select a target-sector from the range 2 - 10 or
enter /SEC:x (where x is the
sector) to force the program to write the backup to the selected sector.
MBR Backups to file: MBRtool places the file containing the
MBR backup in the current folder. If the file already exists it will be
overwritten. Use /FIL without a filename to use the default filename
(MBR_BACK) or use /FIL:filename to enter a filename to be used for the
backup. The maximum length for the filename is 8 characters. Do not enter the extension.
The extension is added by MBRtool and will consist of the physical disk
number that contains the original MBR, 128 through 131.
If you wish to make MBR backups to file and retain a history of backups, use the following batch-file as an example to achieve this. The example will retain the last 3 backups, but can easily be expanded:
if exist mbrback3.128 del
The Backups: The backups are changed so that the program
recognizes them as MBR backups. This means that the backups themselves
are not usable, they must be restored using MBRtool.
The method: MBRtool uses int13H calls to access the
hard disk through the BIOS. This means that the program will NOT work in
Windows NT or Windows 2000 and later versions (these versions prohibit access to hardware). If
you wish to use MBRtool on a system running Windows NT or Windows 2000
you must use a real-mode DOS boot disk. If you run into problems running
the tool from Command prompts in Windows 9x or ME, use a real-mode
|How to use
MBRtool can be used from the command line or from the MBRtool menu.
The menu is displayed if no options are entered on the command line.
MBRtool can be controlled either from the command line or from the menu.
Both offer the same functions.
Using the command line
"MBRtool /?" will display the help-screen and the
/xxx - select the
action to be performed,
where xxx is the selected
action (BCK, RST etc.)
/FIL - select a file
as target or source for a backup, the program will use the default
MBRtool /DSP /DSK:0 - will
display the MBR for disk 0
Using the menu
Typing "MBRtool.exe" without parameters will bring up the
menu. All functions that are available from the command line are also
available from the menu.
Type "?" (plus Enter) from the menu-prompt to see a shortened version of these directions.
The layout of the options across the menus is as follows:
The Main menu:
1 - perform automatic backup of all
MBRs to disk
The MBR actions menu:
1 - backup
The Track0 actions menu:
1 - save
The Other actions menu:
1 - check if backup sectors are free for auto-select
All command line arguments in detail:
/BCK - perform a MBR
/RST - restore a MBR
from a previously made backup.
/VFY - verify a backup
against the original MBR, or validate a backup.
/CHK - check target
/LST - list the sectors
that contain a backup.
/CLR - remove the
backups from the backup sectors.
/ST0 - backup up the
entire track 0.
/RT0 - restore the
entire track 0.
/VT0 - verify track 0
backup against the original on disk.
/WT0 - wipe entire track
/CT0 - clean track
/DT0 - dump track0
(either the original or a file-backup) to a text-file.
/NEW - write a blank
/DSP - display the MBR,
either the original or a backup.
/DMP - dump the MBR (either
the original or a backup) to a text-file.
/WPE - wipe the MBR,
either the original MBR or a backup.
/BPT - blank the
Partition Table, either in the original MBR or a backup.
/WBC - blank the
bootcode, either in the original MBR or a backup.
/RBC - write/refresh the
bootcode, either in the original MBR or a backup.
/ZVB - zap (remove)
the volume bytes from the MBR, either the original or a backup.
/RVB - restore the
volume bytes to the MBR.
/SIG - write the
signature bytes for the MBR.
/EPT - edit the MBR
Partition Table, either for the original or a backup.
/PTM - change attribute
for partitions that are listed in the MBR, either in the original MBR or a backup.
The Partition Table editor
When the /EPT option
is selected the Partition Table editor is displayed.
Each Table consists of 4 entries, making up the Partition Table. The entries contain, from left to right (as is also displayed in the blue top-bar) the 10 following values:
The following options are valid when in the editor (as displayed in
When you choose to edit one of the entries, you will be asked to
enter the values for that entry. The program will ask you to enter a
value for each of the 10 values that make up 1 entry. Press 'Esc' (or
without typing any value) to leave that value unchanged.
When you have entered the C/H/S values for start and end entries, the
program will calculate the LBA values for the last two fields that make
up the partition table entry. You will still be allowed to edit these
last two values, in case the calculations might be incorrect (this could happen
because of incorrect geometry information that the BIOS returns to MBRtool).
When performing edit functions
you should check the LBA calculations if you think your BIOS might
return illogical values for your disk geometry. The edit screen displays
the values that are used for LBA calculations at the 3rd line from the
top. If these values are incorrect, calculate the LBA yourself and enter
the values in the appropriate fields. The formula for calculating LBA
addresses is: LBAsector = ((Cyl * DiskHeads) + Head) * DiskSectors +
Sec - 1. Or you can use the Custom Values function ('G') in the editor.
The values you enter are checked for consistency. You are allowed to enter more than 1023 cylinders, to correctly calculate the LBA address. However, you are not allowed to enter values higher than your disk geometry for heads or sectors.
NT / 2K / XP Volume Bytes
All Windows versions that use NTFS (Windows NT, Windows 2000, Windows XP etc.) change 4 bytes in the MBR, at the end of the bootcode. These bytes, known as the Volume Bytes or the Admin Bytes, are used for recording information about so-called "sticky drive letters" and for other drive-letter assignments (check the Windows documentation for info on this. Info can be found in the Resource Kit or the Knowledgebase, which are both available on-line at www.microsoft.com). This means that if you refresh the bootcode using ANY OTHER TOOL THAN MBRtool these bytes will be overwritten. MBRtool is aware of these volume bytes and leaves them undisturbed when refreshing the bootcode. Please note that the current version of MBRtool is also capable of restoring the volume bytes from a backup to the MBR on disk, effectively offering support for volume bytes.
Consider the following scenarios, where you might have lost the volume bytes by for instance using fdisk /mbr:
If you have NO simple or dynamic volumes (in Windows NT4 also known as stripesets or mirrorsets):
If you have a current backup of your MBR that was made using MBRtool,
you can restore the volume bytes from that backup. Check the parameter
description for "/RVB" to read how to do this.
If you use Simple or Dynamic volumes (or the Windows NT4 equivalent):
If in this case the volume bytes are wiped it is most likely that some or all volumes are no longer visible to Windows. Perform the necessary recovery by trying to import unknown volumes or by trying to revive volumes. A description of this does not fall within the scope of this manual. Check the Microsoft knowledgebase for information.
These scenarios are provided as examples, to clarify the use of volume bytes.
Again, please note the following:
CAUTION: the MBRtool functionality of dealing with volume bytes is built on real world tests, as it is difficult to find solid information on how Windows deals with this. Therefore it is possible that MBRtool does not achieve the desired effect when working with volume bytes. Always make backups of your system and your MBR when working with volume bytes.
errors, program notifications and errorlevels
a normal MBRtool run all the messages displayed are notifications. The
program informs you of the operation that has been requested and what
the result is. If the displayed message starts with a '-'
(as in '- Backup NOT written to sector')
it means that something has gone wrong and that the operation was not
completed, or was aborted. This usually means that MBRtool could not get to
the necessary resources (the backup-sector, the backup-file or the MBR)
to complete the action. Check to see if the backup-sector or backup-file
are not corrupted (by displaying them) and check to see if you have
selected an existing disk for the operation.
MBRtool returns errorlevels when used from the command line. These errorlevels can be used to test for results when MBRtool is called from within a batch-file. The errorlevels are:
When the program exits, the highest encountered errorlevel during program execution is returned to DOS. This errorlevel value is also displayed by the program on exit.
Errorlevels are not returned or displayed when the MBRtool menu is used.
An example batch-file:
REM example batchfile for running
MBRtool and checking for results
If something unexplainable happens and you ask for support, be sure to include any messages the program displays.
If a situation occurs that MBRtool can not handle, the program will abort with an error message. Please send the message with the error codes to us (see contact information) and we'll get back to you as soon as we can.
|Tools used in
creating MBRtool and other copyrights that need mentioning
MBRtool was created using Powerbasic for DOS, version 3.5.
All mentioning in the text of "win9x/DOS "
refers to MS-Windows, (c) Microsoft Corporation.
for this version
Still none yet.
Current version: 2.3.200
Changes since version 2.3.100
Changes since version 2.2.100
Changes since version 2.1.100
Changes since version 2.0.150:
Changes since version 2.0.100:
Changes since version 1.20:
Changes since version 1.10:
Changes since version 1.01:
Changes since version 1.00:
website: DIY DataRecovery , (http://www.diydatarecovery.nl) - general data recovery tools, help and information
For information, questions and support for MBRtool, go to the DIYDataRecovery Support Forum
Check the web pages for current info on MBRtool.