General information
Copyrights, disclaimer and distribution
A word about the MBR
Program description
How to use
Windows NT/2K/XP Volume Bytes
Run errors, program notifications and errorlevels
Tools used and copyrights
Known issues
Version history, and what to do with old backup-files
Contact information
The E-mail support notification

A word about the version numbering:

As of MBRtool version 2 the VRM numbering method is used. This means that the number consists of a Version-number, a Release-number and a Modification-number (and yes, i was inspired by IBM when i thought this up).

• The Version-number changes when major functional changes to the program are introduced.
• The Release-number changes when minor functional changes and/or major corrective changes to the program are introduced.
• The Modification-number changes when minor and/or major corrective changes to the program are introduced.

CAUTION: changing things in the MBR can be destructive, whether that is intentional or not. Whenever you decide to change something in the MBR, always make a backup first. The backup and restore routines of MBRtool have been tested extensively and are reliable. If something should go wrong during an action that changes something in a MBR, you will be happy that you've made that backup.

MBRtool.exe - the program, version 2.2.100
MBRtool_manual.htm - this manual, formatted, in HTML
Readme.txt - the obligatory readme file

To prevent compatibility issues, the MBRtool.exe file has not been compressed with an EXE compressor. If you wish to add MBRtool.exe to your recovery floppy-disk (which would be advisable) compress MBRtool.exe to make sure it takes up as little space as possible and will fit on the floppy-disk with the rest of your tools. I would advise using UPX. i have tested this and found it to be very flexible and reliable.
The webpage-address is http://upx.sourceforge.net/

For info on harddisks and recovery check the DIY DataRecovery (http://www.diydatarecovery.nl) pages. This site contains information on harddisk recovery and assorted info.

This program is conceived and coded by Tom Kuurstra.
Original concept by Tom Kuurstra and Joep van Steen.
(C) 2000/2001/2002/2003, DIYdatarecovery.nl.

All the Information and/or Programs supplied by us (DIYDataRecovery) are AS IS. Use of this Information and/or Programs is at your own risk. We can not and will not be held responsible for any damage that is inflicted by the person and/or persons using the Information and/or Programs we supply.

You may not include (parts of) this program in your own code and/or programs. Please check below for redistribution notices.

You, as the user, are not permitted to:

• decompile, disassemble or change the program code in any way;
• change the documentation or any text accompanying the program;
• change the distribution in any way. No files may be removed from and no files may be added to the distribution;
• use this program for commercial reasons or in environments (i.e. companies or persons) that (make a) profit from datarecovery;
• (re)sell the program, or accept any fee for distributing or using the program

This program is distributed as Freeware. You are free to use and distribute this program, as long as you comply with the above mentioned rules.

- introduction

The Master Boot Record (or MBR) is the very first sector of a harddisk. This very important sector contains a number of things that the Operating System and the computer BIOS need to start the system. If the contents of this sector are lost or damaged you can not access the data on the harddisk. Please note that each harddisk has a MBR, so if you have 2 or more harddisks in your computer, each has it's own MBR. If multiple disks are configured as an array there is usually 1 MBR that services the entire array, placed on the 1st disk in the array (there are exceptions to this rule, but that is beyond the scope of this manual). It should be clear that the MBR is one of the most important (and, strangely enough, overlooked)  sectors on your harddisk.
The following explanation is mainly about using the MBR with Windows or DOS based operating systems. The MBR is somewhat different when used with Unix based systems. I will come back to this later on.

- details

The smallest addressable space on a harddisk is 512 bytes at a time. A harddisk sector is 512 bytes long, so 1 sector is the smallest addressable space on a harddisk. The MBR is 1 sector, so the MBR is 512 bytes long. These 512 bytes are divided into several parts that each have their own function in getting the computer to start. The 4 main parts of the MBR are (in the order they appear in the MBR) :

• the bootcode
• the volume bytes
• the partition table
• the signature bytes

The bootcode : this part of the MBR gets read by the computer BIOS when the computer is started. When the computer finishes it's own startup procedures (getting the disks spinning, doing some checks) and gets ready to start the operating system, the bootcode in the MBR is read first. This allows the computer to interpret the rest of the MBR.

The volume bytes : these are 4 bytes that are located after the bootcode and just before the partition table. Windows 2000 and Windows XP use these 4 bytes to identify the mountable volumes on the harddisk. If these bytes are changed or erased from the MBR, Windows 2000/XP will go through a simple hardware detection round that will re-identify all the volumes on the disk. This is done during the next Windows startup after changing the volume bytes. Driveletters assigned to volumes might change after this. This goes for simple volumes, i have at this point no information on the effect of removing the volume bytes when using dynamic volumes.

The partition table : this is a sequence of 64 bytes (4 x 16) that identify the first 4 (or less) primary partitions on a harddisk. There is space for identifying 4 partitions. Each partition-identification is made up of 16 bytes that describe a number of things about the partition, such as : where it starts, what type it is, how big it is, is it an active partition or not, etc. One of these 4 partition descriptions can be used to describe an extended partition, which itself can then contain logical drives. The logical drives are not described in the MBR.
An active partition is the partition from which the Operating System is started. This must be a primary partition, and there can only be 1 primary partition active at any time.
If there are for instance only 2 partitions on a harddisk, the first 32 bytes of the partition table (2 x 16) would contain the descriptions of those partitions. The other 32 bytes would contain all zeros. So deleting a partition consists of putting zeros in the chosen partition description.

The signature bytes : these are 2 bytes that are used to signify an important sector. They can be found trailing the MBR, but there are other sectors that contain these bytes as well. If they are not trailing the MBR the computer will not be able to read the MBR (because it will not be recognised as an important sector).

So, the MBR consists of :

• 440 bytes of bootcode, followed by
• 4 bytes with volume information, followed by
• 2 bytes that are (as far as i know) not used, followed by
• 64 bytes that contain the partition descriptions, followed by
• 2 bytes that "close up" the MBR

This makes a total of 512 bytes.

A word about Unix based Operating Systems :
The main difference between a Unix based MBR and a Windows based MBR is the bootcode. Unix based bootcode has the ability to look for partition information outside the MBR. So it should be clear that replacing Unix bootcode with Windows bootcode could render a system unstartable. MBRtool is not Unix bootcode aware, so be careful when playing with the bootcode. MBRtool only writes Windows based bootcode. However, all none bootcode-related actions (backups, editing partition tables, etc.) can be used for all platforms.

MBRtool is the only tool that let's you play with each part of the MBR, so be sure to understand that MBRtool is a very powerful piece of equipment.

MBRtool allows you to do the following things:

• backup, verify and restore the MBR, using backup-sectors or files
• backup, restore, wipe, clean or dump the track 0 for a disk
• edit or wipe the MBR Partition Table
• refresh the MBR bootcode, without destroying the Volume Bytes
• remove the MBR bootcode
• re-write the MBR signature bytes
• display the MBR sector or dump the MBR sector to file
• perform above mentioned edit, bootcode, display and dump functions on the MBR backups
• create a blank backup-file to create a MBR from scratch and restore it later
• perform attribute changes on partitions listed in the MBR Partition Table (hide, activate, delete etc.)
• manipulate the volume bytes that are associated with volumes in Windows NT / 2K / XP

MBRtool can be run from the commandline or from the MBRtool menu. Type "MBRtool.exe" (without parameters) to use the menu. Type "MBRtool.exe /?" to see the parameter list. MBRtool returns errorlevels to DOS so that when the program runs from a batch-file results can be tested. Errorlevels are only returned if the program is run with the commandline parameters, no errorlevels are set when the MBRtool menu is used.

MBRtool supports the first 4 harddisks that the BIOS finds. This means that the controller type or the disk type is not relevant. However, if the BIOS does not see the disks or arrays, MBRtool will not see any disks either.

Backups can be made from the MBR to sector or to file.

MBR Backups to sector: MBRtool can be left to auto-select a target sector for the backup or MBRtool can be forced to use a sector, no matter what it contains. Use /SEC to let the program auto-select a target-sector from the range 2 - 10 or enter /SEC:x (where x is the sector) to force the program to write the backup to the selected sector.
auto-select (/SEC) : the program uses the sectors 2 through 10, on track 0 on the disk that contains the MBR you wish to back-up, to write the backups. MBRtool uses a clever method to determine if the target sector contains anything that has to be there (like drive-overlay signatures) and if anything is found, the sector will not be used for backups. MBRtool starts with sector 10 and works it's way done to sector 2. If all sectors are used (for either backups or anything else) the program will not make a backup. You can list or clear the backups using a command described later.
select sector (/SEC:x) : If a backup to sector is selected using /SEC:x the backup will be written to the specified sector, no matter what it contains. Be careful with this. Only use this if you know the target sector is clear or contains an (old) MBR backup.
You can let the program check to see if the target sectors are clear using one of the options described later.

In practice : if you only make a backup every now and then and wish to make the backup to sector, run MBRtool using the auto-select sector method. Example : MBRtool.exe /BCK /DSK:0 /SEC. Once you run out of target sectors, clear them and start over.
If you wish to make regular backups, and wish to automate this by putting MBRtool in the Autoexec.bat (or any other procedure that runs often), use the select sector method. Example : MBRtool.exe /BCK /DSK:0 /SEC:10.

MBR Backups to file: MBRtool places the file containing the MBR backup in the current folder. If the file already exists it will be overwritten. Use /FIL without a filename to use the default filename (MBR_BACK) or use /FIL:filename to enter a filename to be used for the backup. The maximum length for the filename is 8 characters. Do not enter the extension. The extension is added by MBRtool and will consist of the physical disk number that contains the original MBR, 128 through 131.
It should be obvious that making a backup to file on the disk that contains the MBR is not wise. In case of disaster the file can not be used for recovery, because you cannot read the disk. Place MBR backups to file on a different disk then the one containing the original MBR.

If you wish to make MBR backups to file and retain a history of backups, use the following batch-file as an example to achieve this. The example will retain the last 3 backups, but can easily be expanded:

if exist mbrback3.128 del mbrback3.128
if exist mbrback2.128 ren mbrback2.128 mbrback3.128
if exist mbrback1.128 ren mbrback1.128 mbrback2.128
mbrtool.exe /BCK /DSK:0 /FIL:mbrback1

The Backups: The backups are changed so that the program recognises them as MBR backups. This means that the backups themselves are not usable, they must be restored using MBRtool.
It is, however, possible to recover a MBRtool backup sector without the use of MBRtool.
Let me explain : a conventional MBR has what we call a signature. This signature consists of 2 bytes at the end of the sector that contains the MBR. When MBRtool makes a MBR backup to a sector or a file MBRtool changes this signature and replaces it with something MBRtool recognises. The original signature is put back in place when a restore is performed. The original signature for a MBR is Hex "55 AA". MBRtool replaces this with Hex "BB BB". Therefore, if you wish to manually restore a backup sector to the original MBR sector, you must change the last 2 bytes back to Hex "55 AA". A manual restore operation, without the use of MBRtool, can be performed with a hex-editor. Explaining this procedure does not fall within the scope of this manual. Visit the DIYDataRecovery Recovery guides for information on this.
A manual recovery of a backup made to file is also possible, though somewhat more labour-intensive. If you open a backup-file you will see that it is made up as follows : the first 3 lines contain the program name, the program version and the disk number. The lines following that contain the hex-representation of the MBR. Each line contains 32 bytes, each byte being a 2 digit Hex number. There are 16 lines, making up the 512 byte MBR. Please note that the 32 bytes (each consisting of 2 digits) on each of the 16 lines also contain control values. These are placed at the end of the line after the 32 Hex-bytes. So be careful when using this restore method, use only the first 32 hex-bytes (meaning the first 64 digits) on each line and discard the rest.
Use a Hex-editor to enter the hex values you see here in the MBR. Don't forget about the signature bytes.
It should be obvious that the preferred and most logical way to restore backups, is to use MBRtool. The above examples are given to help users with recovery scenarios in which they might not have the use of MBRtool (for whatever reason).

The method: MBRtool uses int13H calls to access the harddisk through BIOS. This means that the program will NOT run from Windows NT or Windows 2000/XP (NT and 2000/XP prohibit access to hardware). If you wish to use MBRtool on a system running Windows NT or Windows 2000/XP, you must use a real-mode DOS boot-disk. If you run into problems running the tool from Command prompts in Windows 9x or ME, use a real-mode bootdisk.
It is advisable to run MBRtool only from a real-mode (DOS) bootdisk.
On systems running Windows 9x it is possible to add MBRtool to the autoexec.bat for automatic creation of MBR backups. Windows ME does not allow this.
On Windows 9x systems it is possible to run MBRtool from a Command prompt in protected mode. Windows ME does not allow this. If MBRtool is asked to write a backup to sector under Windows ME, it will inform you that the backup is NOT written. Windows ME does not allow write-access to sectors in protected mode. This means that making a backup to file will work okay.

MBRtool can be used from the commandline or from the MBRtool menu. The menu is displayed if no options are entered on the commandline. MBRtool can be controlled either from the commandline or from the menu. Both offer the same functions.
The program runs in real-mode DOS or a Command prompt in Windows 9x or ME.

- Using the command line

"MBRtool /?"  will display the help-screen and the copyright notice.
Please look at the examples below to gain a better understanding of the commandline.
The commandline arguments consist of the following:

/xxx - select the action to be performed, where xxx is the selected action (BCK, RST etc.)
/PTM:XyXyXyXy - change partition attribute X for partition y (max 4 times in 1 command)
/DSK:n - select disk to perform the operation on, where n is one of: 0,1,2,3 or A for all
/SEC - select a sector as target, the program will auto-select a target sector.
  OR
/SEC:n -  select a sector as target, force the program to write the backup to sector n

/FIL - select a file as target or source for a backup, the program will use the default filename
  OR
/FIL:filename - select a file as target for a backup, using the filename entered. No extension, the filename must not exceed 8 characters in length

Note :
- selecting all disks (/DSK:A) is only valid for Backup, Checking target sectors, Listing/Clearing backup sectors and Saving track 0. The requested action will only be performed on disks that actually exist. This is checked by MBRtool before the actions are performed.
- when performing a Restore, Verify, Display or Edit function on a backup, you must use /SEC:n or /FIL:filename to specify the location of the backup. If /SEC or /FIL is not entered, the selected action will be performed on the original MBR.
- a filename must be entered (/FIL:filename) when backing up or restoring a track 0.
- backup and restore to/from sectors all happen on the disk were the original MBR is located, meaning :  making a backup of the MBR on disk 1 to a backup sector will place that backup in the selected sector on disk 1.

Please note that MBRtool assumes the first disk to be disk 0, the second disk 1 etc.

Examples :

MBRtool /DSP /DSK:0 - will display the MBR for disk 0
MBRtool /BCK /DSK:a /SEC - will backup the MBR of all disks to the first available sector on the disks
MBRtool /BCK /DSK:1 /SEC - will backup the MBR of disk 1 to the first available sector on disk 1
MBRtool /BCK /DSK:0 /FIL:my_mbr - will backup the MBR of disk 0, to file "my_mbr"
MBRtool /RST /DSK:0 /FIL:my_mbr - will restore the MBR from file "my_mbr", to disk 0
MBRtool /BCK /DSK:0 /SEC:3 - will backup the MBR of disk 0, to sector 3 on disk 0
MBRtool /RST /DSK:0 /SEC:9 - will restore the MBR to disk 0, from sector 9 on disk 0
MBRtool /PTM:h1a2 /DSK:0 - will hide partition 1 and activate (and thus un-hide) partition 2 on disk 0
MBRtool /PTM:z1 /DSK:0 /FIL:my_mbr - will zap (delete) partition 1 in backup file "my_mbr"
MBRtool /WT0 /DSK:0 - will wipe track 0 on disk 0
MBRtool /RBC /DSK:0 - will refresh the bootcode in the MBR on disk 0
MBRtool /RBC /DSK:0 /FIL:my_mbr - will refresh the bootcode in backup-file "my_mbr"
MBRtool /RBC /DSK:0 /SEC:6 - will refresh the bootcode in the MBR-backup on sector 6 of disk 0
MBRtool /EPT /DSK:0 - will start the partition table editor to edit the partition table in the MBR on disk 0
MBRtool /EPT /DSK:0 /FIL:my_mbr - will start the partition table editor to edit the partition table in the backup file "my_mbr"

- Using the menu

Typing "MBRtool.exe" without parameters will bring up the menu. All functions that are available from the commandline are also available from the menu.
The menu will not be explained in-depth, it is self explanatory. To learn about the menu options, read the section below on the commandline arguments to understand what everything does.
Important things about the menu:

• use the Escape key to exit the program, exit a menu or to abort input.
• in the top right hand corner of the screen you can see how many disks MBRtool has found. Next to the text "Disks" you will see 4 numbers (from 0 to 3) in green or in red. Green means a disk is found on that port, red means no disk is found on that port. When a disk is selected during the use of the menu options, the corresponding disk number will light up.
• to the right of all menu options, you can see the corresponding commandline option.
• you can also use all commandline options from the menu, as a shortcut. For instance, from the menu prompt, type "/DSP /DSK:0" to display the MBR from disk 0. Type "/?" to see the commandline help screen.
• you can run a DOS command from the menu using the ">" character. For example, to delete a MBR backup file, you can type ">del backup.128". When the DOS command is finished, you will be returned to the menu. Type ">" to shell to DOS, then type "exit" when you're finished.
• where MBRtool asks you the following :
  "- enter type, 'O' for original, 'S' for sector, 'F' for file -"
  Original is the original MBR or track0 on the disk,
  Sector is the MBR backup on a backup sector,
  File is the MBR backup or track0 backup from a backup file.
• options marked with a yellow dash instead of a white dash can be executed for original and backups.
• the menu does not perform any validity checking on the values that are entered. All validity checking is handled bij the main program. Therefore any error notifications will only be shown after the last value was entered and the program tries to perform the requested action.

Type "?" (plus Enter) from the menu-prompt to see a shortened version of these directions.

The layout of the options across the menu's is as follows:

The Main menu:

1 - perform automatic backup of all MBR's to disk
2 - perform automatic backup of all MBR's to file
3 - perform automatic backup of all track0's to file

4 - work with a MBR (backup, restore, display etc.)
5 - work with a track0 (backup, restore, verify etc.)
6 - other options (clear/list backups, write signature bytes etc.)

The MBR actions menu:

1 - backup                                                      (/BCK)
2 - restore                                                     (/RST)
3 - verify                                                      (/VFY)
4 - display                                                     (/DSP)
5 - dump to plain text file                                     (/DMP)
6 - wipe                                                        (/WPE)
7 - blank partition table (leaves the bootcode)                 (/BPT)
8 - blank bootcode (leaves the partition table)                 (/WBC)
9 - write/refresh bootcode                                      (/RBC)
10 - remove the volume bytes (Windows NT/2K/XP only)            (/ZVB)
11 - restore the volume bytes (Windows NT/2K/XP only)           (/RVB)
12 - create blank MBR backup file                               (/NEW)

The Track0 actions menu:

1 - save                                                        (/ST0)
2 - restore                                                     (/RT0)
3 - verify                                                      (/VT0)
4 - clean                                                       (/CT0)
5 - dump to plain text file                                     (/DT0)
6 - wipe                                                        (/WT0)

The Other actions menu:

1 - check if backup sectors are free for auto-select            (/CHK)
2 - list sectors used for backup                                (/LST)
3 - clear sectors used for backup                               (/CLR)
4 - write signature bytes (to disk only)                        (/SIG)
5 - edit partition table                                        (/EPT)
6 - partition table management                                  (/PTM)

All commandline arguments in detail :

- The actions

/BCK - perform a MBR backup.
A disk must be selected (/DSK:0 - /DSK:3 or /DSK:A for All). If /DSK:A is selected a backup is made of all MBR's on the first 4 disks.
A target for the backup must be specified. Choose /SEC or /SEC:x to make a backup to a sector on the same disk as the original MBR.
Choose /FIL or /FIL:filename to make a backup to a file that will be written to the current folder or disk.

/RST - restore a MBR from a previously made backup.
A disk must be selected (/DSK:0 - /DSK:3). The location of the backup must be specified through /SEC:n or /FIL:filename.

/VFY - verify a backup against the original MBR, or validate a backup.
A disk must be selected (/DSK:0 - /DSK:3). The location of the backup must be specified through /SEC:n or /FIL:filename. This option will also validate the backup and tell you if it has been corrupted, so you can use this option to simply tell if you can use the backup without it being important whether the backup is identical to the MBR.

/CHK - check target sectors.
A disk must be selected (/DSK:0 - /DSK:3 or /DSK:A for All). This option will check the sectors that are used for backups to sector. The sectors 2 through 10 on track 0 are checked to see if they are free for use. If the sectors already contain data or backups, they will not be used for backups if the auto-select method is used.

/LST - list the sectors that contain a backup.
A disk must be selected (/DSK:0 - /DSK:3 or /DSK:A for All). This option will list the sectors on track 0 that have been used for backups using the backup to sector.

/CLR - remove the backups from the backup sectors.
A disk must be selected (/DSK:0 - /DSK:3 or /DSK:A for All). This option will clear all the sectors on track 0 that have been used for backups using the backup to sector. Only backups will be removed. If the sector contains other data, the sector will be left alone.

/ST0 - backup up the entire track 0.
A disk must be selected (/DSK:0 - /DSK:3 or /DSK:A for All) and a filename must be entered (/FIL:filename). This option will dump the entire track 0 (including the MBR) for the selected disk to a file. The file will only contain the exact image of the track 0 and nothing else. These files can be used to perform remote editing on track 0 by using a hex-editor, or to safely look around in track 0 using a hex-editor without the risk of damaging the real track 0. Ofcourse they can also be used as simple backups.

/RT0 - restore the entire track 0.
A disk must be selected (/DSK:0 - /DSK:3) and a filename must be entered (/FIL:filename). This option will restore the entire track 0 (including the MBR) to the disk that has been selected on the commandline. Please note that the extension for the file will determine which disk was selected. If the disk selected on the commandline is not the same as the disk portrayed in the file extension, the restore will not proceed. To force this (if neccessary), rename the file.
The restore will not proceed if the geometry values for the target disk differ from the geometry values used to write the track0 file.

/VT0 - verify track 0 backup against the original on disk.
A disk must be selected (/DSK:0 - /DSK:3) and a filename must be entered (/FIL:filename). This option will verify/compare the backup against the original track 0 on disk. When this action is selected MBRtool will display a screen with the number of sectors (maximum 63). The original track 0 is read, the backup track 0 is read and the differences will be displayed, per sector. A different sector will be marked by an "X". Identical sectors will be marked bij a ".".
The verify will not proceed if the geometry values for the source disk differ from the geometry values used to write the track0 file.

/WT0 - wipe entire track 0.
A disk must be selected (/DSK:0 - /DSK:3). This option will wipe the entire track 0 (including the MBR). Track 0 will be filled with null-characters. Use with caution. This will also wipe any disk-manager signatures. Use this option to for instance kill disk-manager signatures or to clean the harddisk to prepare for a clean install.

/CT0 - clean track 0.
A disk must be selected (/DSK:0 - /DSK:3). This option will clean track 0 on disk. This means that track 0 will be wiped except for the MBR. This can be used to remove disk-overlay leftovers or to clear the MBRtool backups. This would also wipe signatures left by for instance Symantec Ghost or Powerquest Partition Magic.

/DT0 - dump track0 (either the original or a file-backup) to a text-file.
A disk must be selected (/DSK:0 - /DSK:3). If /FIL:filename is not used, the original track0 is dumped. When dumping a backup, the location of the backup must be specified through /FIL:filename. The resulting text-file is free of ASCII control-characters and should print normally to any text printer. The target file for the dump is MBRTOOL.DMP and will be placed in the current directory. If this file does not exist at the time the command is run, it will be created. If the file already exists, the new dump will be added to the file. The dump-file contains a datestamp in the format mm-dd-yyyy for each track0 dump, to keep track of when the dump was created.

/NEW - write a blank MBR-backup file.
A disk must be selected (/DSK:0 - /DSK:3) and a filename must be entered (/FIL:filename). This option will create a blank MBR-backup file. This can be used to recreate a MBR from scratch and restore it later. This could be handy for remote recovery support.

/DSP - display the MBR, either the original or a backup.
A disk must be selected (/DSK:0 - /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is displayed. When displaying a backup, the location of the backup must be specified through /SEC:n or /FIL:filename. If the requested action was performed on a backup, this option will also validate the backup and tell you if it has been corrupted.
On the display screen in the HEX display part the volume bytes will be highlighted. Also the first byte for each partition table entry will be displayed in yellow. Below the HEX / ASCII representaion of the MBR is a list of all partition table entries in readable (decimal) format.
The BIOS values for Heads/Sectors for the selected disk are also displayed, for reference and for use in the Partition Table Editor.

/DMP - dump the MBR (either the original or a backup) to a text-file.
A disk must be selected (/DSK:0 - /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is dumped. When dumping a backup, the location of the backup must be specified through /SEC:n or /FIL:filename. If the requested action was performed on a backup, this option will also validate the backup and tell you if it has been corrupted. The resulting text-file is free of ASCII control-characters and should print normally to any text printer. The target file for the dump is MBRTOOL.DMP and will be placed in the current directory. If this file does not exist at the time the command is run, it will be created. If the file already exists, the new dump will be added to the file. The dump-file contains a datestamp in the format mm-dd-yyyy for each MBR dump, to keep track of when the dump was created.
The BIOS values for Heads/Sectors for the selected disk are also included, for reference and for use in the Partition Table Editor.

/WPE - wipe the MBR, either the original MBR or a backup.
A disk must be selected (/DSK:0 - /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is wiped. When wiping a backup, the location of the backup must be specified through /SEC:n or /FIL:filename. If the requested action was performed on a backup, this option will also validate the backup and tell you if it has been corrupted (allthough that is rather uninteresting when wiping it, nevertheless).

/BPT - blank the Partition Table, either in the original MBR or a backup.
A disk must be selected (/DSK:0 - /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is selected. When blanking the Partition Table in a backup, the location of the backup must be specified through /SEC:n or /FIL:filename. The bootcode is NOT blanked. If the requested action was performed on a backup, this option will also validate the backup and tell you if it has been corrupted.

/WBC - blank the bootcode, either in the original MBR or a backup.
A disk must be selected (/DSK:0 - /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is selected. When blanking the bootcode in a backup, the location of the backup must be specified through /SEC:n or /FIL:filename. The Partition Table is NOT blanked. If the requested action was performed on a backup, this option will also validate the backup and tell you if it has been corrupted.
NOTE : wiping the bootcode will wipe the entire section of the MBR that is reserved for bootcode, so that includes the Windows NT / 2K / XP volume bytes.

/RBC - write/refresh the bootcode, either in the original MBR or a backup.
A disk must be selected (/DSK:0 - /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is selected. When writing the bootcode in a backup, the location of the backup must be specified through /SEC:n or /FIL:filename. The Partition Table is NOT blanked. If the requested action was performed on a backup, this option will also validate the backup and tell you if it has been corrupted.
Note : the bootcode that is written using this option is generic Wintel bootcode and can be used for all Win/DOS platforms. If you have the Linux LiLo bootcode in your MBR DO NOT USE this option, it will leave your system unusable.
NOTE : refreshing the bootcode will only refresh the section of the MBR that is actually used for bootcode, and will not remove the Windows NT / 2K / XP volume bytes. So it is possible to refresh the bootcode without destroying the mountable volume information.

/ZVB - zap (remove) the volume bytes from the MBR, either the original or a backup.
CAUTION: this option can be destructive. Use with care. Read the volume bytes part in the manual for more info on the volume bytes.
A disk must be selected (/DSK:0 - /DSK:3). If /SEC:x or /FIL:filename is not used, the volume bytes will be removed from the original MBR.

/RVB - restore the volume bytes to the MBR.
CAUTION: this option can be destructive. Use with care. Read the volume bytes part in the manual for more info on the volume bytes.
A disk must be selected (/DSK:0 - /DSK:3). The location of the backup must be specified through /SEC:n or /FIL:filename. 

/SIG - write the signature bytes for the MBR.
A disk must be selected (/DSK:0 - /DSK:3). This option can only be performed on the original MBR. Use this option if something or someone has corrupted the MBR by removing the 2 signature bytes from the MBR.
Please note : when a backup is restored the signature bytes are automatically written.

/EPT - edit the MBR Partition Table, either for the original or a backup.
A disk must be selected (/DSK:0 - /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is selected. When editing a backup, the location of the backup must be specified through /SEC:n or /FIL:filename. If the requested action was performed on a backup, this option will also validate the backup and tell you if it has been corrupted. Please check below for information on the editor.

/PTM - change attribute for partitions that are listed in the MBR, either in the original MBR or a backup.
A disk must be selected (/DSK:0 - /DSK:3). If /SEC:x or /FIL:filename is not used, the original MBR is selected. This option can be used to change the attribute for the selected partition. Use the command as follows : /PTM:XyXyXyXy, where X is the selected action (A for activate, D for de-activate, H for hide, U for unhide, Z for zap) and y is the selected partition (1-4).
Example : /PTM:A2H1. This will activate partition 2 and hide partition 1.
This option can be used as a quick boot selector for multiple primary partitions, or to hide and unhide partitions without having to use a partition manager.

IMPORTANT :

•  "hide" will automatically de-activate a partition, "activate" will automatically un-hide a partition.
  Remember to hide the other primary partitions when using this option as a bootable partition selector.
• the number used to identify a partition in the /PTM parameter is the number of the entry for that partition in the partition table. So "/PTM:a1" will activate the partition that is defined in the first entry in the partition table in the MBR.

- The Partition Table editor

When the /EPT option is selected the Partition Table editor is displayed.
The screen displays the table twice. The top section displays the table as it is now, either from the original MBR or a backup. This is signified by the word "cur" on the left in the blue top-bar. Directly below the first display of the table is the option-bar. This bar contains the options that are valid in the editor. Below the option-bar is the second display of the table. This table will reflect the changes you make during the editing. This is signified by the word "new" on the left in the blue top-bar.
Both displays of the Partition Table also contain the displaying of the entries as they are recorded in the MBR (under "partition table as shown in MBR"), for reference.
The bottom display of the table and MBR reference will be refreshed after each value change.

Each Table consists of 4 entries, making up the Partition Table. The entries contain, from left to right (as is also displayed in the blue top-bar) the 10 following values :

• Partition Active, Decimal
• Partition Type, Hex
• Start Cylinder, Decimal
• Start Head, Decimal
• Start Sector, Decimal
• End Cylinder, Decimal
• End Head, Decimal
• End Sector, Decimal
• LBA Start Sector, Decimal (32 bit value)
• LBA Length, Decimal (32 bit value)

The following options are valid when in the editor (as displayed in the menu-bar):
Press 'Esc' to leave the editor. Any changes made will NOT be saved.
Press 'S' to save the Partition Table you have edited to either the original MBR, or a backup (as selected on the commandline using /S:x or /F:filename).
Press 'R' to revert the changes you made. All Table entries will be restored to their original values, as displayed in the Table in the top section of the screen.
Press 'B' to set all values to 0 and create a clean Partition Table to fill.
Press 'G' to use custom values for Heads/Sectors (these values are used for LBA calculations).

This option is a toggle. Press 'G' once to enter the new value for Heads and for Sectors. Press 'G' again to use the values from the BIOS. On the 3rd line from the top you can see what the current values are and where the editor gets them from (BIOS or CUST). This option is useful when editing the Partition Table in a backup on a different computer than the one that the backup was made from. If the Heads/Sectors geometry values are different on the two computers, you can use custom values to correctly calculate the LBA values. It should be obvious that this is very important, without correct LBA values in the Partition Table things will not work as expected. To get the Heads/Sectors values from the original computer, use a /DSP or /DMP command. The geometry values that MBRtool uses are included in the output from these commands.
Please note: the geometry values that MBRtool uses (Heads/Sectors) come directly from the BIOS. Remember that the BIOS counts as follows: Cylinders start at 0, Heads start at 0, Sectors start at 1. So if MBRtool reports a Heads value of 254, it means that there are 255 heads (start with 0!) and if MBRtool reports a Sectors value of 63, there are 63 sectors (starts with 1!). So when using custom values in the Partition Table Editor, remember this. Do not enter the actual amount of heads, but the BIOS number of 'maximum head'. If in doubt, use "MBRtool /DSP" as described above on the original computer to get the correct values.

Press '1' '2' '3' or '4' to edit the entry selected.
Press '5' '6' '7' or '8' to blank selected partitions entries; press 5 to blank entry 1, 6 to blank entry 2 etc.

When you choose to edit one of the entries, you will be asked to enter the values for that entry. The program will ask you to enter a value for each of the 10 values that make up 1 entry. Press 'Esc' (or 'Enter' without typing any value) to leave that value unchanged.
All values are entered and treated as decimal values, with one notible exception : the Partition Type. This is entered in Hex.
Example: the Active Partition value (the first value in an entry) is Hex "80". In the table it is displayed as Dec "128". You must enter "128" or "0" if you wish to edit the Active Partition value.
However, the Partition Type value will for instance display "0B", which means FAT32. If you enter a Partition Type value you must enter this as Hex. It is beyond the scope of this manual to list all partition types and how to manipulate partitions using this value. Check the DIYDataRecovery pages for more information on this.

When you have entered the C/H/S values for start and end entries, the program will calulate the LBA values for the last two fields that make up the partition table entry. You will still be allowed to edit these last two values, in case the calculations might be incorrect. This could happen due to the information that the BIOS returns to MBRtool for disk geometry. This information can be different for some BIOS's and might change the outcome for LBA calculations. When performing edit functions you should check the LBA calculations if you think your BIOS might return illogical values for your disk geometry. The edit screen displays the values that are used for LBA calculations at the 3rd line from the top. If these values are incorrect, calculate the LBA yourself and enter the values in the appropriate fields. The formula for calculating LBA addresses is : LBAsector = ((Cyl * DiskHeads) + Head) * DiskSectors + Sec - 1. Or you can use the Custom Values function ('G') in the editor.
Normally, when using C/H/S notations in partition tables you are not allowed to enter values higher than the following : 1023 for Cylinders / 254 for Heads / 63 for Sectors (this restriction comes from days long gone by, when disks where not as large are they are today). To correctly calculate the LBA values it should be obvious that the true values for C/H/S should be entered, even if they are higher than the mentioned maximum values. In MBRtool you should always enter the C/H/S values as they should be used for the LBA calculations (higher than the maximums or not). MBRtool will reset the C/H/S values to their allowed maximum after they have been used to perform the LBA calculations.

The values you enter are checked for consistency. You are allowed to enter more than 1023 cylinders, to correctly calculate the LBA address. However, you are not allowed to enter values higher than your disk geometry for heads or sectors.

All Windows versions that use NTFS (Windows NT, Windows 2000, Windows XP) change 4 bytes in the MBR, at the end of the bootcode. These bytes, known as the Volume Bytes or the Admin Bytes, are used for recording information about so-called "sticky driveletters" and for other drive-letter assignments (check the Windows documentation for info on this. Info can be found in the Resource Kit or the Knowledgebase, which are both available on-line at www.microsoft.com). This means that if you refresh the bootcode using ANY OTHER TOOL THEN MBRtool these bytes will be overwritten. MBRtool is aware of these volume bytes and leaves them undisturbed when refreshing the bootcode. Please note that the current version of MBRtool is also capable of restoring the volume bytes from a backup to the MBR on disk, effectively offering support for volume bytes.

Consider the following scenario's, where you might have lost the volume bytes by for instance using fdisk /mbr :

If you have NO simple or dynamic volumes (in Windows NT4 also known as stripesets or mirrorsets):

If you have a current backup of your MBR that was made using MBRtool, you can restore the volume bytes from that backup. Check the parameter description for "/RVB" to read how to do this.
If you have no backup of your MBR there should still not be need for much concern. Windows will ask you if you want to restart the system after the next successfull boot. This is because Windows has reloaded some drivers that have to do with volume mounting and -detection, a direct result of the fact that the volume bytes are no longer present. Answer "Yes" to restart your system. At this point Windows has refreshed the volume bytes in the MBR and all is well (you may have lost some driveletter assignments, but that can easily be changed back to the way you had it before, by using the Windows disk manager). You might want to consider making a backup of the MBR with the Windows 2000 / XP changes.

If you use Simple or Dynamic volumes (or the Windows NT4 equivalent):

If in this case the volume bytes are wiped it is most likely that some or all volumes are no longer visible to Windows. Perform the necessary recovery by trying to import unknown volumes or by trying to revive volumes. A description of this does not fall within the scope of this manual. Check the Microsoft knowledgebase for information.

These scenario's are provided as examples, to clarify the use of volume bytes.

Again, please note the following :

• The "/WBC" parameter will wipe the entire section of the MBR that is reserved for bootcode, so that includes the Windows NT / 2K / XP volume bytes.
• The "/RBC" parameter will only refresh the section of the MBR that is actually used for bootcode, and will not remove the Windows NT / 2K / XP volume bytes. So it is possible to refresh the bootcode without destroying the mountable volume information.

CAUTION: the MBRtool functionality of dealing with volume bytes is built on real world tests, as it is difficult to find solid information on how Windows deals with this. Therefore it is possible that MBRtool does not achieve the desired effect when working with volume bytes. Always make backups of your system and your MBR when working with volume bytes.

Program notifications

In a normal MBRtool run all the messages displayed are notifications. The program informs you of the operation that has been requested and what the result is. If the displayed message starts with a '-' (as in '- Backup NOT written to sector') it means that something has gone wrong and that the operation was not completed, or was aborted. This usually means that MBRtool could not get to the necessary resources (the backup-sector, the backup-file or the MBR) to complete the action. Check to see if the backup-sector or backup-file are not corrupted (by displaying them) and check to see if you have selected an existing disk for the operation.
When the message '!- could not read/write selected disk (RC=x)' appears it means that an Int13H error occurred, meaning that the disk could not be read or written to.
The text 'RC=x' in the Int13H error message means Return Code. An Int13H error usually returns a value that let's you identify the error. The most common errors are RC=1 (disk error/non -existent disk) and RC=3 (read-only error, is displayed when sector operations are performed under Windows ME).

Errorlevels

MBRtool returns errorlevels when used from the commandline. These errorlevels can be used to test for results when MBRtool is called from within a batch-file. The errorlevels are:

• 0 - correct execution of the requested action
• 1 - syntax error in the commandline
• 2 - minor problem encountered (not possible to write/create a backup)
• 3 - major problem encountered (not possible to perform a restore)
• 4 - MBRtool encountered a problem it could not recover from. the program aborts and displays the relevant errorcodes. include these errorcodes in the error-report when asking for support

When the program exits, the highest encountered errorlevel during program execution is returned to DOS. This errorlevel value is also displayed by the program on exit.

Errorlevels are not returned or displayed when the MBRtool menu is used.

An example batch-file :

REM example batchfile for running MBRtool and checking for results
MBRtool.exe /bck /dsk:0 /fil:backup
if errorlevel 4 goto trouble
if errorlevel 3 goto major_error
if errorlevel 2 goto minor_error
if errorlevel 1 goto syntax_error
echo Program execution correct.
goto end
:trouble
REM MBRtool has encountered an unrecoverable error. take appropriate action
goto end
:major_error
REM take appropriate action
goto end
:minor_error
REM take appropriate action
goto end
:syntax_error
REM take appropriate action
goto end
:end

If something unexplainable happens and you ask for support, be sure to include any messages the program displays.

If a situation occurs that MBRtool can not handle, the program will abort with an error message. Please send the message with the error codes to us (see contact information) and we'll get back to you as soon as we can. Please observe our "E-mail notification" notice, this can be found on the web-pages. Check the information at the end of this document.

MBRtool was created using Powerbasic for DOS, version 3.5.

All mentioning in the text of "win9x/DOS " refers to MS-Windows, (c) Microsoft Coorporation.
The mentioning of Symantec and Powerquest acknowledges the copyrights that exist for their products.

Still none yet.

Current version : 2.2.100

Changes since version 2.1.100

• the /RBC parameter (refresh bootcode) is now Volume Byte aware. refreshing the bootcode will no longer overwrite the volume bytes, and thus leave the volume information contained in the MBR intact. please note that wiping the bootcode (/WBC) WILL remove the Volume Bytes
• manipulation of volume bytes has been adapted, only the 4 correct bytes can be erased or restored
• bootcode is replaced with US english XP bootcode
• minor cosmetic changes in some screens

Changes since version 2.0.150:

• added the MBRtool menu, including the possibility to run commands from the menuprompt
• added the dump track 0 function (/DT0)
• added a Custom Geometry Value function to the Partition Table Editor
• feedback on errors during restore / verify track0 improved
• for /DSK:A, the requested action is only performed on actually existing disks. MBRtool now tests for disk existence before any action is performed
• a backup count per disk is added to the /LST function
• error checking has been changed, is now handled globally
• maximum cylinder value in the Partition Table Editor is changed from 9999 to 99999
• geometry values are added to Display and Dump output
• Partition Table Editor has been changed to be a bit more friendly to work with

Changes since version 2.0.100:

• minor cosmetic changes
• commandline help screen is now displayed if the menu add-on is not found

Changes since version 1.20:

• the commandline is revised, and is now easier to understand and use
• more on-screen information has been added to several functions
• the value entered in the partition table editor for Active Partition is now checked (must be 0 or 128)
• /PTM has been improved, unknown partition types will be left alone
• the MBR display function now uses 50 lines per screen, showing the entire MBR on 1 screen
• saving and restoring of track 0 to file has been improved, it is now much faster
• the saving and restoring of track 0 is now more reliable (the conditions and results are checked)
• errordisplay for track 0 functions and MBR backup functions has been improved
• fixed: problem in the Partition Table Editor when a non-existing backup from sector was requested
• new function: clean track 0
• new function: verify track 0 against a previously made backup
• new function: delete a Partition Table Entry from the commandline
• new function: added support for volume bytes (delete and restore)
• new function: dump a MBR (backup or original) to file
• added errorlevels for batch-file support
• added a more elegant general-error exit routine
• a new and more indicative version numbering system is introduced

Changes since version 1.10:

• the version number. it seemed that version 1.01 and version 1.10 were the same to some software download sites
• the support information has been changed
• the manual has been updated and expanded

Changes since version 1.01:

• major code overhaul
• bug in backup to file for more than 1 disk fixed
• check on maximum heads corrected
• partition type is now displayed correctly in the editor (including the attribute)
• partition attributes can now be changed from the commandline (/P parameter)
• display MBR now includes the Partition Table in editor format
• added corruption check to the backup files
• added function to write a blank backup (/X:A)
• added errorhandling for reading the backup files
• changed the sequence of items in the partition table display and edit screens
• added LBA calculations to the editor
• added saving, restoring and wiping of track 0
• added display of used disk geometry values for LBA calculations in the edit screen
• added possibility to delete 1 entry in the edit screen

Changes since version 1.00:

• LBA values when entered in the Partition Table editor are now checked. Due to a restraint in the compiler, i can not calculate Hex values larger than Dec 2,147,483,647 (well, actually i can but i haven't figured it out completely yet). This means for now that you can not enter values for LBA larger than this. The above mentioned value translates into a 1Tb harddisk size, so in practice this will hardly pose a problem. However, people with harddisks/hardware raid5 systems larger than 1Tb should NOT use the partition table editor that MBRtool provides. Backup and restore are safe.
  Version 1.00 of MBRtool simply crashed when a large value for LBA was encountered. Though not quite nice, it means that no changes to the MBR were made at runtime so no trouble there.
• some minor cosmetic code changes

What to do with old backups:

Backups made to sector can always be restored, regardless of the MBRtool version. These do not contain MBRtool specific info (except for the signature byte changes, see Program Description).
The backup file-format is changed since version 1.01. This means that file backups made by version 1.01 can not be restored using the later versions.
Currently the backup file format for version 1.10, version 1.20 and version 2.xx is identical. If you wish to restore a backup made with version 1.20 using version 2.xx you must edit the backup file. Load the file in an ASCII editor (Notepad or the DOS editor) and change the version number found on line 2 to the current version number. Display the MBRtool helpscreen for the exact version number.

DIYDataRecovery :

website : DIY DataRecovery , (http://www.diydatarecovery.nl) - general datarecovery tools, help and information

For information, questions and support for MBRtool, go to the DiyDataRecovery Support Forum (http://pub50.bravenet.com/forum/show.php?usernum=4220517151)

Before contacting us, make sure you have read our E-mail support notification below.

Check the webpages for current info on MBRtool.

We receive a lot of E-mail requesting support in one form or another. To make things a little easier for us we ask you to give us as much information as possible, so that we can help you quicker and do not have to guess at things. Datarecovery is an exact science.

When you have a question concerning MBRtool please include the following things:

• a clear description of the symptoms (things like "my OS doesn't boot" we cannot take seriously), including (if any) the errors you might be getting from the tool you are using;
• how the problem came about. A thorough description of the actions that led to the problem and a description of the environment (real mode, protected mode etc.) in which the problem occurred;
• a description of the running OS (Windows 9x / ME / NT / 2000 / XP or OS/2 or whatever), including language information and version information;
• a Partinfo log file. Check below to see how to make a Partinfo log file.

If these things are not included in the support request you will not receive an answer.

How to make a Partinfo log file:

Partinfo is a tool that is part of the Powerquest PartitionMagic suite. The Partinfo tool can be downloaded from the Powerquest webpages.
Please note that Powerquest allows you to download these tools.
Create a Partinfo log file by using the following command:
"Partinfo > drive:\file.ext", where drive:\file.ext is the location of the resulting log file.

Thanks for complying.