MBRtool manual

MBRtool version 2.3.200, user manual

Manual version 2.0, revision 10 ‐ dated: June 2016
Brought to you by DIYDataRecovery.

The contents of this document:

General information
Copyrights, disclaimer, and distribution
A word about the MBR
Program description
How to use
Windows NT/2K/XP Volume Bytes
Run errors, program notifications and errorlevels
Tools used and copyrights
Known issues
Version history
Contact information

General information

This documentation accompanies MBRtool version 2.3.200.

A word about the version numbering:

As of MBRtool version 2 the VRM numbering method is used. This means that the number consists of a Version‐number, a Release‐number and a Modification‐
number (and yes, I was inspired by IBM when I thought this up).

The Version‐number changes when major functional changes to the program are introduced.
The Release‐number changes when minor functional changes and/or major corrective changes to the program are introduced.
The Modification‐number changes when minor and/or major corrective changes to the program are introduced.

CAUTION: changing things in the MBR can be destructive, whether that is intentional or not. Whenever you decide to change something in the MBR, always
make a backup first. The backup and restore routines of MBRtool have been tested extensively and are reliable. If something should go wrong during an action
that changes something in a MBR, you will be happy that you've made that backup.

In the world of disks and data recovery we start counting disks at 0 (zero). So the first disk is disk 0, the second disk is disk 1, etc. When working with disks
on a level close to the hardware the first disk in the system is disk 128, the second is 129, etc. So disk 0 and disk 128 are the same disk, disk 1 and disk 129
are the same, etc. Both of these conventions (0‐based and 128‐based) are used by MBRtool.

This document assumes the reader to have some knowledge concerning hard disks and partitioning. You should know what the Master Boot Record is and what
Partition Tables are. We also assume you know how to make a real‐mode boot disk and have at least working knowledge of the Windows operating system(s)
and real mode environments. You should also know what Simple and Dynamic volumes are (used in Windows 200X / XP / Vista / Win7) and what the Windows
NT4 equivalents are (Stripesets and Mirrorsets).

Copyright, disclaimer, permission and distribution notices

This program is conceived and coded by Tom Kuurstra.

(C) 2000‐2016, DIYDataRecovery.nl

All the Information and/or Programs supplied by us (DIYDataRecovery) are AS IS. Use of this Information and/or Programs is at your own risk. We can not and
will not be held responsible for any damage that is inflicted by the person and/or persons using the Information and/or Programs we supply.

You may not include (parts of) this program in your own code and/or programs. Please check below for redistribution notices.

You, as the user, are not permitted to:

decompile, disassemble or change the program code in any way;

change the documentation or any text accompanying the program;
change the distribution in any way. No files may be removed from and no files may be added to the distribution;
use this program for commercial reasons or in environments (i.e. companies or persons) that (make a) profit from data recovery;
(re)sell the program, or accept any fee for distributing or using the program

This program is distributed as Freeware. You are free to use and distribute this program, as long as you comply with the above mentioned rules.

A word about the MBR

Introduction

The Master Boot Record (or MBR) is the very first sector of a hard disk. This very important sector contains a number of things that the Operating System and
the computer BIOS need to start the system. If the contents of this sector are lost or damaged you can not access the data on the hard disk. Please note that
each hard disk has a MBR, so if you have 2 or more hard disks in your computer, each has its own MBR. If multiple disks are configured as an array there is
usually 1 MBR that services the entire array, placed on the 1st disk in the array (there are exceptions to this rule, but that is beyond the scope of this manual).
It should be clear that the MBR is one of the most important (and, strangely enough, overlooked) sectors on your hard disk.
The following explanation is mainly about using the MBR with Windows or DOS based operating systems. The MBR is somewhat different when used with Unix
based systems.
Details

The smallest addressable space on a hard disk is 512 bytes at a time. A hard disk sector is 512 bytes long, so 1 sector is the smallest addressable space on a
hard disk. The MBR is 1 sector, so the MBR is 512 bytes long. These 512 bytes are divided into several parts that each have their own function in getting the
computer to start. The 4 main parts of the MBR are (in the order as they appear in the MBR):

the bootcode
the volume bytes
the partition table
the signature bytes

The bootcode: this part of the MBR gets read by the computer BIOS when the computer is started. When the computer finishes its own startup procedures
(getting the disks spinning, doing some checks) and gets ready to start the operating system, the bootcode in the MBR is read first. This allows the computer
to interpret the rest of the MBR.

The volume bytes: these are 4 bytes that are located after the bootcode and just before the partition table. Windows 2000 and Windows XP use these 4 bytes
to identify the mountable volumes on the hard disk. If these bytes are changed or erased from the MBR, Windows 2000/XP will go through a simple hardware
detection round that will re‐identify all the volumes on the disk. This is done during the next Windows startup after changing the volume bytes. Drive letters
assigned to volumes might change after this. This goes for simple volumes, I have at this point no information on the effect of removing the volume bytes
when using dynamic volumes.

The partition table: this is a sequence of 64 bytes (4 x 16) that identify the first 4 (or less) primary partitions on a hard disk. There is space for identifying 4
partitions. Each partition‐identification is made up of 16 bytes that describe a number of things about the partition, such as: where it starts, what type it is,
how big it is, is it an active partition or not, etc. One of these 4 partition descriptions can be used to describe an extended partition, which itself can then
contain logical drives. The logical drives are not described in the MBR.
An active partition is the partition from which the Operating System is started. This must be a primary partition, and there can only be 1 primary partition
active at any time.
If there are for instance only 2 partitions on a hard disk, the first 32 bytes of the partition table (2 x 16) would contain the descriptions of those partitions.
The other 32 bytes would contain all zeros. So deleting a partition consists of putting zeros in the chosen partition description.

The signature bytes: these are 2 bytes that are used to signify an important sector. They can be found trailing the MBR, but there are other sectors that
contain these bytes as well. If they are not trailing the MBR the computer will not be able to read the MBR (because it will not be recognized as an important
sector).

So, the MBR consists of:

440 bytes of bootcode, followed by

4 bytes with volume information, followed by
2 bytes that are (as far as I know) not used, followed by
64 bytes that contain the partition descriptions, followed by
2 bytes that "close up" the MBR

This makes a total of 512 bytes.

A word about Unix based Operating Systems:

The main difference between a Unix based MBR and a Windows based MBR is the bootcode. Unix based bootcode has the ability to look for partition
information outside the MBR. So it should be clear that replacing Unix bootcode with Windows bootcode could render a system un‐bootable. MBRtool is not Unix
bootcode aware, so be careful when playing with the bootcode. MBRtool only writes Windows based bootcode. However, all non‐bootcode‐related actions
(backups, editing partition tables, etc.) can be used for all platforms.

MBRtool is the only tool that let's you play with each part of the MBR, so be sure to understand that MBRtool is a very powerful piece of equipment.

Program description

MBRtool allows you to do the following things:

backup, verify and restore the MBR, using backup‐sectors or files

backup, restore, wipe, clean or dump the track 0 for a disk
edit or wipe the MBR Partition Table
refresh the MBR bootcode, without destroying the Volume Bytes
remove the MBR bootcode
re‐write the MBR signature bytes
display the MBR sector or dump the MBR sector to file
perform above mentioned edit, bootcode, display and dump functions on the MBR backups
create a blank backup‐file to create a MBR from scratch and restore it later
perform attribute changes on partitions listed in the MBR Partition Table (hide, activate, delete etc.)
manipulate the volume bytes that are associated with volumes in Windows NT / 2K / XP

MBRtool can be run from the command line or from the MBRtool menu. Type "MBRtool.exe" (without parameters) to use the menu. Type "MBRtool.exe /?" to see
the parameter list. MBRtool returns errorlevels to DOS so that when the program runs from a batch‐file results can be tested. Errorlevels are only returned if
the program is run with the command line parameters, no errorlevels are set when the MBRtool menu is used.

MBRtool supports the first 4 hard disks that the BIOS finds. This means that the controller type or the disk type is not relevant. However, if the BIOS does not
see the disks or arrays, MBRtool will not see any disks either.

Backups can be made from the MBR to sector or to file.

MBR Backups to sector: MBRtool can be left to auto‐select a target sector for the backup or MBRtool can be forced to use a sector, no matter what it contains.
Use /SEC to let the program auto‐select a target‐sector from the range 2 ‐ 10 or enter /SEC:x (where x is the sector) to force the program to write the backup
to the selected sector.
auto‐select (/SEC): the program uses the sectors 2 through 10, on track 0 on the disk that contains the MBR you wish to back‐up, to write the backups. MBRtool
uses a clever method to determine if the target sector contains anything that has to be there (like drive‐overlay signatures) and if anything is found, the
sector will not be used for backups. MBRtool starts with sector 10 and works its way down to sector 2. If all sectors are used (for either backups or anything
else) the program will not make a backup. You can list or clear the backups using a command described later.
select sector (/SEC:x): If a backup to sector is selected using /SEC:x the backup will be written to the specified sector, no matter what it contains. Be careful
with this. Only use this if you know the target sector is clear or contains an (old) MBR backup.
You can let the program check to see if the target sectors are clear using one of the options described later.

In practice: if you only make a backup every now and then and wish to make the backup to sector, run MBRtool using the auto‐select sector method.
Example: MBRtool.exe /BCK /DSK:0 /SEC. Once you run out of target sectors, clear them and start over.
If you wish to make regular backups, and wish to automate this by putting MBRtool in the Autoexec.bat (or any other procedure that runs often), use the select
sector method.
Example: MBRtool.exe /BCK /DSK:0 /SEC:10.

MBR Backups to file: MBRtool places the file containing the MBR backup in the current folder. If the file already exists it will be overwritten. Use /FIL without a
filename to use the default filename (MBR_BACK) or use /FIL:filename to enter a filename to be used for the backup. The maximum length for the filename is
8 characters. Do not enter the extension. The extension is added by MBRtool and will consist of the physical disk number that contains the original MBR, 128
through 131.
It should be obvious that making a backup to file on the disk that contains the MBR is not wise. In case of disaster the file can not be used for recovery,
because you cannot read the disk. Place MBR backups to file on a different disk than the one containing the original MBR.

If you wish to make MBR backups to file and retain a history of backups, use the following batch‐file as an example to achieve this. The example will retain the
last 3 backups, but can easily be expanded:

if exist mbrback3.128 del mbrback3.128

if exist mbrback2.128 ren mbrback2.128 mbrback3.128
if exist mbrback1.128 ren mbrback1.128 mbrback2.128
mbrtool.exe /BCK /DSK:0 /FIL:mbrback1

The Backups: The backups are changed so that the program recognizes them as MBR backups. This means that the backups themselves are not usable, they
must be restored using MBRtool.
It is, however, possible to recover a MBRtool backup sector without the use of MBRtool.
Let me explain: a conventional MBR has what we call a signature. This signature consists of 2 bytes at the end of the sector that contains the MBR. When
MBRtool makes a MBR backup to a sector or a file MBRtool changes this signature and replaces it with something MBRtool recognizes. The original signature is
put back in place when a restore is performed. The original signature for a MBR is Hex "55 AA". MBRtool replaces this with Hex "BB BB". Therefore, if you wish
to manually restore a backup sector to the original MBR sector, you must change the last 2 bytes back to Hex "55 AA". A manual restore operation, without the
use of MBRtool, can be performed with a hex‐editor. Explaining this procedure does not fall within the scope of this manual.
A manual recovery of a backup made to file is also possible, though somewhat more labor‐intensive. If you open a backup‐file you will see that it is made up as
follows: the first 3 lines contain the program name, the program version and the disk number. The lines following that contain the hex‐representation of the
MBR. Each line contains 32 bytes, each byte being a 2 digit Hex number. There are 16 lines, making up the 512 byte MBR. Please note that the 32 bytes (each
consisting of 2 digits) on each of the 16 lines also contain control values. These are placed at the end of the line after the 32 Hex‐bytes. So be careful when
using this restore method, use only the first 32 hex‐bytes (meaning the first 64 digits) on each line and discard the rest.
Use a Hex‐editor to enter the hex values you see here in the MBR. Don't forget about the signature bytes.
It should be obvious that the preferred and most logical way to restore backups, is to use MBRtool. The above examples are given to help users with recovery
scenarios in which they might not have the use of MBRtool (for whatever reason).

The method: MBRtool uses int13H calls to access the hard disk through the BIOS. This means that the program will NOT work from within Windows NT or
Windows 2000 and later versions (these versions prohibit access to hardware). If you wish to use MBRtool on a system running Windows NT or Windows 2000
and later, you must use a real‐mode DOS boot disk. If you run into problems running the tool from Command prompts in Windows 9x or ME, use a real‐mode
boot disk.
It is advisable to run MBRtool only from a real‐mode (DOS) boot disk.
On systems running Windows 9x it is possible to add MBRtool to the autoexec.bat for automatic creation of MBR backups. Windows ME does not allow this.
On Windows 9x systems it is possible to run MBRtool from a Command prompt in protected mode. Windows ME does not allow this. If MBRtool is asked to write
a backup to sector under Windows ME, it will inform you that the backup is NOT written. Windows ME does not allow write‐access to sectors in protected mode.
This means that making a backup to file will work okay.

How to use

MBRtool can be used from the command line or from the MBRtool menu. The menu is displayed if no options are entered on the command line. MBRtool can be
controlled either from the command line or from the menu. Both offer the same functions.
The program runs in real‐mode DOS or a Command prompt in Windows 9x or ME.

Using the command line

"MBRtool /?" will display the help‐screen and the copyright notice.
Please look at the examples below to gain a better understanding of the command line.
The command line arguments consist of the following:

/xxx ‐ select the action to be performed, where xxx is the selected action (BCK, RST etc.)
/PTM:XyXyXyXy ‐ change partition attribute X for partition y (max 4 times in 1 command)
/DSK:n ‐ select disk to perform the operation on, where n is one of: 0,1,2,3 or A for all
/SEC ‐ select a sector as target, the program will auto‐select a target sector.
OR
/SEC:n ‐ select a sector as target, force the program to write the backup to sector n

/FIL ‐ select a file as target or source for a backup, the program will use the default filename
OR
/FIL:filename ‐ select a file as target for a backup, using the filename entered. No extension, the filename must not exceed 8 characters in length

Note:

selecting all disks (/DSK:A) is only valid for Backup, Checking target sectors, Listing/Clearing backup sectors and Saving track 0. The requested action
will only be performed on disks that actually exist. This is checked by MBRtool before the actions are performed.
when performing a Restore, Verify, Display or Edit function on a backup, you must use /SEC:n or /FIL:filename to specify the location of the backup. If
/SEC or /FIL is not entered, the selected action will be performed on the original MBR.
 a filename must be entered (/FIL:filename) when backing up or restoring a track 0.
backup and restore to/from sectors all happen on the disk where the original MBR is located, meaning: making a backup of the MBR on disk 1 to a
backup sector will place that backup in the selected sector on disk 1.
MBRtool assumes the first disk to be disk 0, the second disk 1 etc.

Examples:

MBRtool /DSP /DSK:0 ‐ will display the MBR for disk 0

MBRtool /BCK /DSK:a /SEC ‐ will backup the MBR of all disks to the first available sector on the disks
MBRtool /BCK /DSK:1 /SEC ‐ will backup the MBR of disk 1 to the first available sector on disk 1
MBRtool /BCK /DSK:0 /FIL:my_mbr ‐ will backup the MBR of disk 0, to file "my_mbr"
MBRtool /RST /DSK:0 /FIL:my_mbr ‐ will restore the MBR from file "my_mbr", to disk 0
MBRtool /BCK /DSK:0 /SEC:3 ‐ will backup the MBR of disk 0, to sector 3 on disk 0
MBRtool /RST /DSK:0 /SEC:9 ‐ will restore the MBR to disk 0, from sector 9 on disk 0
MBRtool /PTM:h1a2 /DSK:0 ‐ will hide partition 1 and activate (and thus un‐hide) partition 2 on disk 0
MBRtool /PTM:z1 /DSK:0 /FIL:my_mbr ‐ will zap (delete) partition 1 in backup file "my_mbr"
MBRtool /WT0 /DSK:0 ‐ will wipe track 0 on disk 0
MBRtool /RBC /DSK:0 ‐ will refresh the bootcode in the MBR on disk 0
MBRtool /RBC /DSK:0 /FIL:my_mbr ‐ will refresh the bootcode in backup‐file "my_mbr"
MBRtool /RBC /DSK:0 /SEC:6 ‐ will refresh the bootcode in the MBR‐backup on sector 6 of disk 0
MBRtool /EPT /DSK:0 ‐ will start the partition table editor to edit the partition table in the MBR on disk 0
MBRtool /EPT /DSK:0 /FIL:my_mbr ‐ will start the partition table editor to edit the partition table in the backup file "my_mbr"

Using the menu

Typing "MBRtool.exe" without parameters will bring up the menu. All functions that are available from the command line are also available from the menu.
The menu will not be explained in‐depth, it is self explanatory. To learn about the menu options, read the section below on the command line arguments to
understand what everything does.
Important things about the menu:

use the Escape key to exit the program, exit a menu or to abort input.
in the top right hand corner of the screen you can see how many disks MBRtool has found. Next to the text "Disks" you will see 4 numbers (from 0 to 3)
in green or in red. Green means a disk is found on that port, red means no disk is found on that port. When a disk is selected during the use of the
menu options, the corresponding disk number will light up.
to the right of all menu options, you can see the corresponding command line option.
you can also use all command line options from the menu, as a shortcut. For instance, from the menu prompt, type "/DSP /DSK:0" to display the MBR
from disk 0. Type "/?" to see the command line help screen.
you can run a DOS command from the menu using the ">" character. For example, to delete a MBR backup file, you can type ">del backup.128". When the
DOS command is finished, you will be returned to the menu. Type ">" to shell to DOS, then type "exit" when you're finished.
where MBRtool asks you the following:
"‐ enter type, 'O' for original, 'S' for sector, 'F' for file ‐"
Original is the original MBR or track0 on the disk,
Sector is the MBR backup on a backup sector,
File is the MBR backup or track0 backup from a backup file.
options marked with a yellow dash instead of a white dash can be executed for original and backups.
the menu does not perform any validity checking on the values that are entered. All validity checking is handled by the main program. Therefore any
error notifications will only be shown after the last value was entered and the program tries to perform the requested action.

Type "?" (plus Enter) from the menu‐prompt to see a shortened version of these directions.

The layout of the options across the menus is as follows:

The Main menu:

1 - perform automatic backup of all MBRs to disk

2 - perform automatic backup of all MBRs to file
3 - perform automatic backup of all track0s to file

4 - work with a MBR (backup, restore, display etc.)

5 - work with a track0 (backup, restore, verify etc.)
6 - other options (clear/list backups, write signature bytes etc.)

The MBR actions menu:

1 - backup (/BCK)
2 - restore (/RST)
3 - verify (/VFY)
4 - display (/DSP)
5 - dump to plain text file (/DMP)
6 - wipe (/WPE)
7 - blank partition table (leaves the bootcode) (/BPT)
8 - blank bootcode (leaves the partition table) (/WBC)
9 - write/refresh bootcode (/RBC)
10 - remove the volume bytes (Windows NT/2K/XP only) (/ZVB)
11 - restore the volume bytes (Windows NT/2K/XP only) (/RVB)
12 - create blank MBR backup file (/NEW)

The Track0 actions menu:

1 - save (/ST0)
2 - restore (/RT0)
3 - verify (/VT0)
4 - clean (/CT0)
5 - dump to plain text file (/DT0)
6 - wipe (/WT0)
The Other actions menu:

1 - check if backup sectors are free for auto-select (/CHK)

2 - list sectors used for backup (/LST)
3 - clear sectors used for backup (/CLR)
4 - write signature bytes (to disk only) (/SIG)
5 - edit partition table (/EPT)
6 - partition table management (/PTM)

All command line arguments in detail:

The actions

/BCK ‐ perform a MBR backup.

A disk must be selected (/DSK:0 ‐ /DSK:3 or /DSK:A for All). If /DSK:A is selected a backup is made of all MBRs on the first 4 disks.
A target for the backup must be specified. Choose /SEC or /SEC:x to make a backup to a sector on the same disk as the original MBR.
Choose /FIL or /FIL:filename to make a backup to a file that will be written to the current folder or disk.

/RST ‐ restore a MBR from a previously made backup.

A disk must be selected (/DSK:0 ‐ /DSK:3). The location of the backup must be specified through /SEC:n or /FIL:filename.

/VFY ‐ verify a backup against the original MBR, or validate a backup.

A disk must be selected (/DSK:0 ‐ /DSK:3). The location of the backup must be specified through /SEC:n or /FIL:filename. This option will also validate the
backup and tell you if it has been corrupted, so you can use this option to simply tell if you can use the backup without it being important whether the backup is
identical to the MBR.

/CHK ‐ check target sectors.

A disk must be selected (/DSK:0 ‐ /DSK:3 or /DSK:A for All). This option will check the sectors that are used for backups to sector. The sectors 2 through 10 on
track 0 are checked to see if they are free for use. If the sectors already contain data or backups, they will not be used for backups if the auto‐select method is
used.

/LST ‐ list the sectors that contain a backup.

A disk must be selected (/DSK:0 ‐ /DSK:3 or /DSK:A for All). This option will list the sectors on track 0 that have been used for backups using the backup to
sector.

/CLR ‐ remove the backups from the backup sectors.

A disk must be selected (/DSK:0 ‐ /DSK:3 or /DSK:A for All). This option will clear all the sectors on track 0 that have been used for backups using the backup
to sector. Only backups will be removed. If the sector contains other data, the sector will be left alone.

/ST0 ‐ backup up the entire track 0.

A disk must be selected (/DSK:0 ‐ /DSK:3 or /DSK:A for All) and a filename must be entered (/FIL:filename). This option will dump the entire track 0 (including
the MBR) for the selected disk to a file. The file will only contain the exact image of the track 0 and nothing else. These files can be used to perform remote
editing on track 0 by using a hex‐editor, or to safely look around in track 0 using a hex‐editor without the risk of damaging the real track 0. Of course they can
also be used as simple backups.

/RT0 ‐ restore the entire track 0.

A disk must be selected (/DSK:0 ‐ /DSK:3) and a filename must be entered (/FIL:filename). This option will restore the entire track 0 (including the MBR) to
the disk that has been selected on the command line. Please note that the extension for the file will determine which disk was selected. If the disk selected on
the command line is not the same as the disk portrayed in the file extension, the restore will not proceed. To force this (if necessary), rename the file.
The restore will not proceed if the geometry values for the target disk differ from the geometry values used to write the track0 file.

/VT0 ‐ verify track 0 backup against the original on disk.

A disk must be selected (/DSK:0 ‐ /DSK:3) and a filename must be entered (/FIL:filename). This option will verify/compare the backup against the original
track 0 on disk. When this action is selected MBRtool will display a screen with the number of sectors (maximum 63). The original track 0 is read, the backup
track 0 is read and the differences will be displayed, per sector. A different sector will be marked by an "X". Identical sectors will be marked by a ".".
The verify will not proceed if the geometry values for the source disk differ from the geometry values used to write the track0 file.

/WT0 ‐ wipe entire track 0.

A disk must be selected (/DSK:0 ‐ /DSK:3). This option will wipe the entire track 0 (including the MBR). Track 0 will be filled with null‐characters. Use with
caution. This will also wipe any disk‐manager signatures. Use this option to for instance kill disk‐manager signatures or to clean the hard disk to prepare for a
clean install.

/CT0 ‐ clean track 0.

A disk must be selected (/DSK:0 ‐ /DSK:3). This option will clean track 0 on disk. This means that track 0 will be wiped except for the MBR. This can be used to
remove disk‐overlay leftovers or to clear the MBRtool backups. This would also wipe signatures left by for instance Symantec Ghost or Powerquest Partition
Magic.

/DT0 ‐ dump track0 (either the original or a file‐backup) to a text‐file.

A disk must be selected (/DSK:0 ‐ /DSK:3). If /FIL:filename is not used, the original track0 is dumped. When dumping a backup, the location of the backup
must be specified through /FIL:filename. The resulting text‐file is free of ASCII control‐characters and should print normally to any text printer. The target file
for the dump is MBRTOOL.DMP and will be placed in the current directory. If this file does not exist at the time the command is run, it will be created. If the
file already exists, the new dump will be added to the file. The dump‐file contains a datestamp in the format mm‐dd‐yyyy for each track0 dump, to keep track
of when the dump was created.

/NEW ‐ write a blank MBR‐backup file.

A disk must be selected (/DSK:0 ‐ /DSK:3) and a filename must be entered (/FIL:filename). This option will create a blank MBR‐backup file. This can be used
to recreate a MBR from scratch and restore it later. This could be handy for remote recovery support.

/DSP ‐ display the MBR, either the original or a backup.

A disk must be selected (/DSK:0 ‐ /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is displayed. When displaying a backup, the location of the
backup must be specified through /SEC:n or /FIL:filename. If the requested action was performed on a backup, this option will also validate the backup and
tell you if it has been corrupted.
On the display screen in the HEX display part the volume bytes will be highlighted. Also the first byte for each partition table entry will be displayed in yellow.
Below the HEX / ASCII representaion of the MBR is a list of all partition table entries in readable (decimal) format.
The BIOS values for Heads/Sectors for the selected disk are also displayed, for reference and for use in the Partition Table Editor.
/DMP ‐ dump the MBR (either the original or a backup) to a text‐file.
A disk must be selected (/DSK:0 ‐ /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is dumped. When dumping a backup, the location of the
backup must be specified through /SEC:n or /FIL:filename. If the requested action was performed on a backup, this option will also validate the backup and
tell you if it has been corrupted. The resulting text‐file is free of ASCII control‐characters and should print normally to any text printer. The target file for the
dump is MBRTOOL.DMP and will be placed in the current directory. If this file does not exist at the time the command is run, it will be created. If the file
already exists, the new dump will be added to the file. The dump‐file contains a datestamp in the format mm‐dd‐yyyy for each MBR dump, to keep track of
when the dump was created.
The BIOS values for Heads/Sectors for the selected disk are also included, for reference and for use in the Partition Table Editor.

/WPE ‐ wipe the MBR, either the original MBR or a backup.

A disk must be selected (/DSK:0 ‐ /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is wiped. When wiping a backup, the location of the backup
must be specified through /SEC:n or /FIL:filename. If the requested action was performed on a backup, this option will also validate the backup and tell you if
it has been corrupted (although that is rather uninteresting when wiping it, nevertheless).

/BPT ‐ blank the Partition Table, either in the original MBR or a backup.
A disk must be selected (/DSK:0 ‐ /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is selected. When blanking the Partition Table in a backup,
the location of the backup must be specified through /SEC:n or /FIL:filename. The bootcode is NOT blanked. If the requested action was performed on a
backup, this option will also validate the backup and tell you if it has been corrupted.

/WBC ‐ blank the bootcode, either in the original MBR or a backup.

A disk must be selected (/DSK:0 ‐ /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is selected. When blanking the bootcode in a backup, the
location of the backup must be specified through /SEC:n or /FIL:filename. The Partition Table is NOT blanked. If the requested action was performed on a
backup, this option will also validate the backup and tell you if it has been corrupted.
Note: wiping the bootcode will wipe the entire section of the MBR that is reserved for bootcode, so that includes the Windows NT / 2K / XP volume bytes.

/RBC ‐ write/refresh the bootcode, either in the original MBR or a backup.

A disk must be selected (/DSK:0 ‐ /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is selected. When writing the bootcode in a backup, the
location of the backup must be specified through /SEC:n or /FIL:filename. The Partition Table is NOT blanked. If the requested action was performed on a
backup, this option will also validate the backup and tell you if it has been corrupted.
Note: the bootcode that is written using this option is generic Wintel bootcode and can be used for all Win/DOS platforms. If you have the Linux LiLo bootcode
in your MBR DO NOT USE this option, it will leave your system unusable.
Note: refreshing the bootcode will only refresh the section of the MBR that is actually used for bootcode, and will not remove the Windows NT / 2K / XP volume
bytes. So it is possible to refresh the bootcode without destroying the mountable volume information.

/ZVB ‐ zap (remove) the volume bytes from the MBR, either the original or a backup.
CAUTION: this option can be destructive. Use with care. Read the volume bytes part in the manual for more info on the volume bytes.
A disk must be selected (/DSK:0 ‐ /DSK:3). If /SEC:x or /FIL:filename is not used, the volume bytes will be removed from the original MBR.

/RVB ‐ restore the volume bytes to the MBR.

CAUTION: this option can be destructive. Use with care. Read the volume bytes part in the manual for more info on the volume bytes.
A disk must be selected (/DSK:0 ‐ /DSK:3). The location of the backup must be specified through /SEC:n or /FIL:filename.

/SIG ‐ write the signature bytes for the MBR.

A disk must be selected (/DSK:0 ‐ /DSK:3). This option can only be performed on the original MBR. Use this option if something or someone has corrupted the
MBR by removing the 2 signature bytes from the MBR.
Please note: when a backup is restored the signature bytes are automatically written.

/EPT ‐ edit the MBR Partition Table, either for the original or a backup.
A disk must be selected (/DSK:0 ‐ /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is selected. When editing a backup, the location of the
backup must be specified through /SEC:n or /FIL:filename. If the requested action was performed on a backup, this option will also validate the backup and
tell you if it has been corrupted. Please check below for information on the editor.

/PTM ‐ change attribute for partitions that are listed in the MBR, either in the original MBR or a backup.
A disk must be selected (/DSK:0 ‐ /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is selected. This option can be used to change the attribute
for the selected partition. Use the command as follows: /PTM:XyXyXyXy, where X is the selected action (A for activate, D for de‐activate, H for hide, U for
unhide, Z for zap) and y is the selected partition (1‐4).
Example: /PTM:A2H1. This will activate partition 2 and hide partition 1.
This option can be used as a quick boot selector for multiple primary partitions, or to hide and unhide partitions without having to use a partition manager.

IMPORTANT:

"hide" will automatically de‐activate a partition, "activate" will automatically un‐hide a partition.
Remember to hide the other primary partitions when using this option as a bootable partition selector.
the number used to identify a partition in the /PTM parameter is the number of the entry for that partition in the partition table. So "/PTM:a1" will
activate the partition that is defined in the first entry in the partition table in the MBR.

The Partition Table editor

When the /EPT option is selected the Partition Table editor is displayed.
The screen displays the table twice. The top section displays the table as it is now, either from the original MBR or a backup. This is signified by the word "cur"
on the left in the blue top‐bar. Directly below the first display of the table is the option‐bar. This bar contains the options that are valid in the editor. Below the
option‐bar is the second display of the table. This table will reflect the changes you make during the editing. This is signified by the word "new" on the left in
the blue top‐bar.
Both displays of the Partition Table also contain the displaying of the entries as they are recorded in the MBR (under "partition table as shown in MBR"), for
reference.
The bottom display of the table and MBR reference will be refreshed after each value change.

Each Table consists of 4 entries, making up the Partition Table. The entries contain, from left to right (as is also displayed in the blue top‐bar) the 10 following
values:

Partition Active, Decimal

Partition Type, Hex
Start Cylinder, Decimal
Start Head, Decimal
 Start Sector, Decimal
End Cylinder, Decimal
End Head, Decimal
End Sector, Decimal
LBA Start Sector, Decimal (32 bit value)
LBA Length, Decimal (32 bit value)

The following options are valid when in the editor (as displayed in the menu‐bar):
Press 'Esc' to leave the editor. Any changes made will NOT be saved.
Press 'S' to save the Partition Table you have edited to either the original MBR, or a backup.
Press 'R' to revert the changes you made. All Table entries will be restored to their original values, as displayed in the Table in the top section of the screen.
Press 'B' to set all values to 0 and create a clean Partition Table to fill.
Press 'G' to use custom values for Heads/Sectors (these values are used for LBA calculations).

This option is a toggle. Press 'G' once to enter the new value for Heads and for Sectors. Press 'G' again to use the values from the BIOS. On the 3rd line from
the top you can see what the current values are and where the editor gets them from (BIOS or CUST). This option is useful when editing the Partition Table in a
backup on a different computer than the one that the backup was made from. If the Heads/Sectors geometry values are different on the two computers, you
can use custom values to correctly calculate the LBA values. It should be obvious that this is very important, without correct LBA values in the Partition Table
things will not work as expected. To get the Heads/Sectors values from the original computer, use a /DSP or /DMP command. The geometry values that
MBRtool uses are included in the output from these commands.

Press '1' '2' '3' or '4' to edit the entry selected.

Press '5' '6' '7' or '8' to blank selected partitions entries; press 5 to blank entry 1, 6 to blank entry 2 etc.

When you choose to edit one of the entries, you will be asked to enter the values for that entry. The program will ask you to enter a value for each of the 10
values that make up 1 entry. Press 'Esc' (or 'Enter' without typing any value) to leave that value unchanged.
All values are entered and treated as decimal values, with one notable exception: the Partition Type. This is entered in Hex.
Example: the Active Partition value (the first value in an entry) is Hex "80". In the table it is displayed as Dec "128". You must enter "128" or "0" if you wish to
edit the Active Partition value.
However, the Partition Type value will for instance display "0B", which means FAT32. If you enter a Partition Type value you must enter this as Hex. It is beyond
the scope of this manual to list all partition types and how to manipulate partitions using this value.

When you have entered the C/H/S values for start and end entries, the program will calculate the LBA values for the last two fields that make up the partition
table entry. You will still be allowed to edit these last two values, in case the calculations might be incorrect (this could happen because of incorrect geometry
information that the BIOS returns to MBRtool). When performing edit functions you should check the LBA calculations if you think your BIOS might return
illogical values for your disk geometry. The edit screen displays the values that are used for LBA calculations at the 3rd line from the top. If these values are
incorrect, calculate the LBA yourself and enter the values in the appropriate fields. The formula for calculating LBA addresses is: LBAsector = ((Cyl * DiskHeads)
+ Head) * DiskSectors + Sec ‐ 1. Or you can use the Custom Values function ('G') in the editor.
Normally, when using C/H/S notations in partition tables you are not allowed to enter values higher than the following: 1023 for Cylinders / 254 for Heads / 63
for Sectors (this restriction comes from days long gone by, when disks where not as large are they are today). To correctly calculate the LBA values it should be
obvious that the true values for C/H/S should be entered, even if they are higher than the mentioned maximum values. In MBRtool you should always enter the
C/H/S values as they should be used for the LBA calculations (higher than the maximums or not). MBRtool will reset the C/H/S values to their allowed
maximum after they have been used to perform the LBA calculations.

The values you enter are checked for consistency. You are allowed to enter more than 1023 cylinders, to correctly calculate the LBA address. However, you are
not allowed to enter values higher than your disk geometry for heads or sectors.

Windows NT / 2K / XP Volume Bytes

All Windows versions that use NTFS (Windows NT, Windows 2000, Windows XP etc.) change 4 bytes in the MBR, at the end of the bootcode. These bytes, known
as the Volume Bytes or the Admin Bytes, are used for recording information about so‐called "sticky drive letters" and for other drive‐letter assignments (check
the Windows documentation for info on this. Info can be found in the Resource Kit or the Knowledgebase, which are both available on‐line at
www.microsoft.com). This means that if you refresh the bootcode using ANY OTHER TOOL THAN MBRtool these bytes will be overwritten. MBRtool is aware of
these volume bytes and leaves them undisturbed when refreshing the bootcode. Please note that the current version of MBRtool is also capable of restoring the
volume bytes from a backup to the current MBR on a disk, effectively offering support for volume bytes.

Consider the following scenarios, where you might have lost the volume bytes by for instance using fdisk /mbr:

If you have NO simple or dynamic volumes (in Windows NT4 also known as stripesets or mirrorsets):

If you have a current backup of your MBR that was made using MBRtool, you can restore the volume bytes from that backup. Check the parameter description
for "/RVB" to read how to do this.
If you have no backup of your MBR there should still not be need for much concern. Windows will ask you if you want to restart the system after the next
successful boot. This is because Windows has reloaded some drivers that have to do with volume mounting and ‐detection, a direct result of the fact that the
volume bytes are no longer present. Answer "Yes" to restart your system. At this point Windows has refreshed the volume bytes in the MBR and all is well (you
may have lost some drive letter assignments, but that can easily be changed back to the way you had it before, by using the Windows disk manager). You
might want to consider making a backup of the MBR with the Windows 2000 / XP changes.

If you use Simple or Dynamic volumes (or the Windows NT4 equivalent):

If in this case the volume bytes are wiped it is most likely that some or all volumes are no longer visible to Windows. Perform the necessary recovery by trying
to import unknown volumes or by trying to revive volumes. A description of this does not fall within the scope of this manual. Check the Microsoft
knowledgebase for information.

These scenarios are provided as examples, to clarify the use of volume bytes.

Again, please note the following:

The "/WBC" parameter will wipe the entire section of the MBR that is reserved for bootcode, so that includes the Windows NT / 2K / XP volume bytes.
The "/RBC" parameter will only refresh the section of the MBR that is actually used for bootcode, and will not remove the Windows NT / 2K / XP volume
bytes. So it is possible to refresh the bootcode without destroying the mountable volume information.

CAUTION: the MBRtool functionality of dealing with volume bytes is built on real world tests, as it is difficult to find solid information on how Windows deals
with this. Therefore it is possible that MBRtool does not achieve the desired effect when working with volume bytes. Always make backups of your system and
your MBR when working with volume bytes.

Run errors, program notifications and errorlevels

Program notifications

In a normal MBRtool run all the messages displayed are notifications. The program informs you of the operation that has been requested and what the result is.
If the displayed message starts with a '‐' (as in '‐ Backup NOT written to sector') it means that something has gone wrong and that the operation was not
completed, or was aborted. This usually means that MBRtool could not get to the necessary resources (the backup‐sector, the backup‐file or the MBR) to
complete the action. Check to see if the backup‐sector or backup‐file are not corrupted (by displaying them) and check to see if you have selected an existing
disk for the operation.
When the message '!‐ could not read/write selected disk (RC=x)' appears it means that an Int13H error occurred, meaning that the disk could not be read or
written to.
The text 'RC=x' in the Int13H error message means Return Code. An Int13H error usually returns a value that lets you identify the error. The most common
errors are RC=1 (disk error/nonexistent disk) and RC=3 (read‐only error, is displayed when sector operations are performed under Windows ME).

Errorlevels

MBRtool returns errorlevels when used from the command line. These errorlevels can be used to test for results when MBRtool is called from within a batch‐file.
The errorlevels are:

0 ‐ correct execution of the requested action

1 ‐ syntax error in the command line
2 ‐ minor problem encountered (not possible to write/create a backup)
3 ‐ major problem encountered (not possible to perform a restore)
4 ‐ MBRtool encountered a problem it could not recover from. The program aborts and displays the relevant error codes. Include these error codes in the
error‐report when asking for support

When the program exits, the highest encountered errorlevel during program execution is returned to DOS. This errorlevel value is also displayed by the
program on exit.

Errorlevels are not returned or displayed when the MBRtool menu is used.

An example batch‐file:

REM example batchfile for running MBRtool and checking for results
MBRtool.exe /bck /dsk:0 /fil:backup
if errorlevel 4 goto trouble
if errorlevel 3 goto major_error
if errorlevel 2 goto minor_error
if errorlevel 1 goto syntax_error
echo Program execution correct.
goto end
:trouble
REM MBRtool has encountered an unrecoverable error. take appropriate action
goto end
:major_error
REM take appropriate action
goto end
:minor_error
REM take appropriate action
goto end
:syntax_error
REM take appropriate action
goto end
:end

If something unexplainable happens and you ask for support, be sure to include any messages the program displays.

If a situation occurs that MBRtool can not handle, the program will abort with an error message. Please send the message with the error codes to us (see
contact information) and we'll get back to you as soon as we can.

Tools used in creating MBRtool and other copyrights that need mentioning

MBRtool was created using Powerbasic for DOS, version 3.5.

All mentioning in the text of "win9x/DOS " refers to MS‐Windows, (c) Microsoft Corporation.
The mentioning of Symantec and Powerquest acknowledges the copyrights that exist for their products.

Known issues for this version

Still none yet.

Version history

Current version: 2.3.200

Changes since version 2.3.100

maintenance (manual changes/updates and a few source code updates/spelling fixes)

Changes since version 2.2.100

disk geometry detection changed (added head‐fix)

added a boot diskette builder

Changes since version 2.1.100

the /RBC parameter (refresh bootcode) is now Volume Byte aware. refreshing the bootcode will no longer overwrite the volume bytes, and thus leave the
volume information contained in the MBR intact. please note that wiping the bootcode (/WBC) WILL remove the Volume Bytes
manipulation of volume bytes has been adapted, only the 4 correct bytes can be erased or restored
bootcode is replaced with US English XP bootcode
minor cosmetic changes in some screens

Changes since version 2.0.150:

added the MBRtool menu, including the possibility to run commands from the menu prompt
added the dump track 0 function (/DT0)
added a Custom Geometry Value function to the Partition Table Editor
feedback on errors during restore / verify track0 improved
for /DSK:A, the requested action is only performed on actually existing disks. MBRtool now tests for disk existence before any action is performed
a backup count per disk is added to the /LST function
error checking has been changed, is now handled globally
maximum cylinder value in the Partition Table Editor is changed from 9999 to 99999
geometry values are added to Display and Dump output
Partition Table Editor has been changed to be a bit more friendly to work with

Changes since version 2.0.100:

minor cosmetic changes

command line help screen is now displayed if the menu add‐on is not found

Changes since version 1.20:

the command line is revised, and is now easier to understand and use
more on‐screen information has been added to several functions
the value entered in the partition table editor for Active Partition is now checked (must be 0 or 128)
/PTM has been improved, unknown partition types will be left alone
the MBR display function now uses 50 lines per screen, showing the entire MBR on 1 screen
saving and restoring of track 0 to file has been improved, it is now much faster
the saving and restoring of track 0 is now more reliable (the conditions and results are checked)
error display for track 0 functions and MBR backup functions has been improved
fixed: problem in the Partition Table Editor when a non‐existing backup from sector was requested
new function: clean track 0
new function: verify track 0 against a previously made backup
new function: delete a Partition Table Entry from the command line
new function: added support for volume bytes (delete and restore)
new function: dump a MBR (backup or original) to file
added errorlevels for batch‐file support
added a more elegant general‐error exit routine
a new and more indicative version numbering system is introduced

Changes since version 1.10:

the version number. it seemed that version 1.01 and version 1.10 were the same to some software download sites
the support information has been changed
the manual has been updated and expanded

Changes since version 1.01:

major code overhaul

bug in backup to file for more than 1 disk fixed
check on maximum heads corrected
partition type is now displayed correctly in the editor (including the attribute)
partition attributes can now be changed from the command line (/P parameter)
display MBR now includes the Partition Table in editor format
added corruption check to the backup files
added function to write a blank backup (/X:A)
added error handling for reading the backup files
changed the sequence of items in the partition table display and edit screens
added LBA calculations to the editor
added saving, restoring and wiping of track 0
added display of used disk geometry values for LBA calculations in the edit screen
added possibility to delete 1 entry in the edit screen

Changes since version 1.00:

LBA values when entered in the Partition Table editor are now checked. Due to a restraint in the compiler, I can not calculate Hex values larger than Dec
2,147,483,647 (well, actually I can but I haven't figured it out completely yet). This means for now that you can not enter values for LBA larger than this.
The above mentioned value translates into a 1Tb hard disk size, so in practice this will hardly pose a problem. However, people with hard
 disks/hardware raid5 systems larger than 1Tb should NOT use the partition table editor that MBRtool provides. Backup and restore are safe.
Version 1.00 of MBRtool simply crashed when a large value for LBA was encountered. Though not quite nice, it means that no changes to the MBR were
made at runtime so no trouble there.
some minor cosmetic code changes

Contact information

DIYDataRecovery:

website: DIY DataRecovery , (http://www.diydatarecovery.nl) ‐ general data recovery tools, help and information

For information, questions and support for MBRtool, go to the DIYDataRecovery Support Forum

Check the web pages for current info on MBRtool.

Contact the author: tom@diydatarecovery.nl

Enjoy.