willdwilly
Technical User
Could any one tell me ,if when you format a HD does it remove the MBR , and if not how do you wipe out the MBR ? Kelly
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations Chriss Miller on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
Format and MBR 1
- Thread starter willdwilly
- Start date
- Status
gpalmer711
IS-IT--Management
If you format the Hard Drive nothing is ever physically removed from your drive. The File allocation table is changed in such a way that it becomes unreadable. Meaning that using special recovery tools you could recover most if not all files that were on a formatted hard drive.
When you format the Hard Drive the MBR is cleared as there is no OS for it to boot. However I do not think it is removed. Could be wrong.
Greg Palmer
----------------------------------------
Any feed back is appreciated.
When you format the Hard Drive the MBR is cleared as there is no OS for it to boot. However I do not think it is removed. Could be wrong.
Greg Palmer
----------------------------------------
Any feed back is appreciated.
You can "clean" the MBR with dikpart:
clean [all]
Use the clean command to remove partition or volume formatting from the current in-focus disk by zeroing sectors. By default, only the MBR or GPT partitioning information and any hidden sector information on MBR disks is overwritten. If you specify the all parameter, each and every sector can be zeroed, and all data that is contained on the drive can be deleted.
"Format" under Windows NT -- XP will always write the MBR on basic disks that are marked "Active."
clean [all]
Use the clean command to remove partition or volume formatting from the current in-focus disk by zeroing sectors. By default, only the MBR or GPT partitioning information and any hidden sector information on MBR disks is overwritten. If you specify the all parameter, each and every sector can be zeroed, and all data that is contained on the drive can be deleted.
"Format" under Windows NT -- XP will always write the MBR on basic disks that are marked "Active."
I know a person who served in the military most of his life time. He said that when erasing data they would perform a full format 3 times. This is what they thought 'sufficient' to make whatever data 'useless' on the hard drive.
To answer your question, a full format should remove the MBR, but it doesn't always. If it doesn't, try formatting a second time or use a tool such as recommended by bcastner.
To answer your question, a full format should remove the MBR, but it doesn't always. If it doesn't, try formatting a second time or use a tool such as recommended by bcastner.
It would help if I spelled "diskpart" correctly.
A general reference to the XP command diskpart:
A general reference to the XP command diskpart:
-
1
- #7
willdwilly - what are you tring to achieve? You don't generally want to 'wipe out' the mbr, as you can't boot from a disk without one (it contains bootstrap code among other things). Normally you may want to rewrite it with a standard one, if something has corrupted it (eg, a boot manager or a virus). Then fdisk /mbr or fixmbr from recovery console will do the job (for M$ windows). The format command will NOT wipe the mbr - because it needs the partition info in the mbr to know what to format!
- Thread starter
- #8
willdwilly
Technical User
wolluf > I need to clean up things as xp is running very slowly and doing odd things, like losing devise manager and user settings among others. Last time I formated (fdisk) and reinstalled XP I got some carry over from the previous instalation of a couple of apps ( Norton AV and Alien Shooter to name them)I was told to clean out the MBR. Good advise? or bum steer. Kelly
If you're doing a new clean install, it won't hurt to run fdisk /mbr or fixmbr as well as reformatting the partition - but as bcastner says, don't think those apps will store anything in mbr (as I said earlier - tends to be boot managers which store stuff in mbr - or boot sector viruses of course!)
I have to disagree with wolluf. Partition info is kept in the Partition Table which is distinct from the MBR. With a new disk you have to first patition it and define logical drive(s) with fdisk or di(s)kpart. Then you format each logical drive as FAT32 or NTFS - the MBR's for the two ARE different.
There is one MBR for each partition/logical drive that is bootable (dual- or multi-boot setups) but there is only one Partition Table (in Sector 0, I think) for the whole hard disk.
HTH
Gunny
There is one MBR for each partition/logical drive that is bootable (dual- or multi-boot setups) but there is only one Partition Table (in Sector 0, I think) for the whole hard disk.
HTH
Gunny
Gunny - there is only ONE MBR (that's why its called MASTER Boot Record) which is the first 512 bytes of sector 0. It includes a partition table for the whole disk (ie, partition table is withing the MBR, not distinct from it). Individual partitions have their own boot sectors.
Some good info here:-
Some good info here:-
- Thread starter
- #14
willdwilly
Technical User
bcastner: any idea what might be going on with my machine? Kelly
gpalmer711
IS-IT--Management
WildWilly,
I need to clean up things as xp is running very slowly and doing odd things, like losing devise manager and user settings among others. Last time I formated (fdisk) and reinstalled XP I got some carry over from the previous instalation of a couple of apps
Are you sure that you formatted the drive? Did you get any errors when formatting. My only reason for asking is that I have never seen anything stay visible on the drive after an error free format.
If you are looking to reinstall Windows then during the setup you are asked which drive you want to install on. At this point you can delete any partitions that are on your drive. Delete all that you are happy to delete and then recreate them. (instructions are on screen) After you have recreated the partition(s) you can choose to format the drive (Quick or Full), do a full format.
You should now find when you boot into windows after the install that all that exists on your drive is Windows.
If you are just looking to try and fix your problems then can you be a bit more specific as to what the problems are that you are experiencing. Are you getting any error messages. Check out the event log. Start > Settings > Control Panel > Admin Tools > Event Viewer
Greg Palmer
----------------------------------------
Any feed back is appreciated.
I need to clean up things as xp is running very slowly and doing odd things, like losing devise manager and user settings among others. Last time I formated (fdisk) and reinstalled XP I got some carry over from the previous instalation of a couple of apps
Are you sure that you formatted the drive? Did you get any errors when formatting. My only reason for asking is that I have never seen anything stay visible on the drive after an error free format.
If you are looking to reinstall Windows then during the setup you are asked which drive you want to install on. At this point you can delete any partitions that are on your drive. Delete all that you are happy to delete and then recreate them. (instructions are on screen) After you have recreated the partition(s) you can choose to format the drive (Quick or Full), do a full format.
You should now find when you boot into windows after the install that all that exists on your drive is Windows.
If you are just looking to try and fix your problems then can you be a bit more specific as to what the problems are that you are experiencing. Are you getting any error messages. Check out the event log. Start > Settings > Control Panel > Admin Tools > Event Viewer
Greg Palmer
----------------------------------------
Any feed back is appreciated.
Can I join in the conversation here about XP pro and boot virues.
My problem is on the same thread, but the problem is complicated as I am not sure what to do/try next.
A friend of mine has a PC which was up until now running Windows 98, they had no virus software on the PC (I know shock horror!), and their son downloaded something that had a virus which upset the machine, causing it to reboot/crash/become unstable.
They had nothing on their C drive which was salvagable, and their D drive was empty of data.
Having guided them to FDISK the Primary Drive, delete the partition, and then repartition it, and then format it under DOS Format. They put 98 back on, but still had major problems. They have now got XP, and installed this on a clean FDISKed machine, and freshly formatted. XP is booting fine, and no problems, I have installed a virus software, and whilst it did find one virus which it removed, the machine was clean - on repeated scans for this virus. When the scanner runs, it reports "W32.Opserva.K.Worm" virus on master boot record on drive #1.
So far I have run every downloadable virus scanner/been on loads of online web scanning site, each site reports both C:> and D:> to be totally clean of this virus, and the only thing that finds it is Symantecs Antivirus 2003, and reports it back as a strange looking E type curled symbol as being the file thas infected. I have used XP recovery console to re-do the MBR and the Boot record. I have used Windows 98SE to boot to DOS with CD rom support and do FDISK/MBR (although I put a space FDISK /MBR), the FDISK is not coming back and saying invalid command, and doing something. XP has said it has written both the boot and MBR correctly. However Nortons is still saying the E file is there on the MBR and infected.
The only thing I have not checked is if the D:> is a partition on the C:> (i.e. C:> is 20gb, D:> is 4gb, it could be a 24gb? 25gb? drive? and partitions as 20gb and 4gb?) if this is the case, will removing the D: partition clear the virus? is it hiding in slack space in here?
Also does FDISK report Drive #1 and Drive#2 on a partitioned drive? Can any one help? XP is running fine, but I want this virus report that Norton is picking up cleared and cleansed.
Help people
))
Chris
My problem is on the same thread, but the problem is complicated as I am not sure what to do/try next.
A friend of mine has a PC which was up until now running Windows 98, they had no virus software on the PC (I know shock horror!), and their son downloaded something that had a virus which upset the machine, causing it to reboot/crash/become unstable.
They had nothing on their C drive which was salvagable, and their D drive was empty of data.
Having guided them to FDISK the Primary Drive, delete the partition, and then repartition it, and then format it under DOS Format. They put 98 back on, but still had major problems. They have now got XP, and installed this on a clean FDISKed machine, and freshly formatted. XP is booting fine, and no problems, I have installed a virus software, and whilst it did find one virus which it removed, the machine was clean - on repeated scans for this virus. When the scanner runs, it reports "W32.Opserva.K.Worm" virus on master boot record on drive #1.
So far I have run every downloadable virus scanner/been on loads of online web scanning site, each site reports both C:> and D:> to be totally clean of this virus, and the only thing that finds it is Symantecs Antivirus 2003, and reports it back as a strange looking E type curled symbol as being the file thas infected. I have used XP recovery console to re-do the MBR and the Boot record. I have used Windows 98SE to boot to DOS with CD rom support and do FDISK/MBR (although I put a space FDISK /MBR), the FDISK is not coming back and saying invalid command, and doing something. XP has said it has written both the boot and MBR correctly. However Nortons is still saying the E file is there on the MBR and infected.
The only thing I have not checked is if the D:> is a partition on the C:> (i.e. C:> is 20gb, D:> is 4gb, it could be a 24gb? 25gb? drive? and partitions as 20gb and 4gb?) if this is the case, will removing the D: partition clear the virus? is it hiding in slack space in here?
Also does FDISK report Drive #1 and Drive#2 on a partitioned drive? Can any one help? XP is running fine, but I want this virus report that Norton is picking up cleared and cleansed.
Help people
)) Chris
zorko,
Run the Recovery Console.
FIXMBR
EXIT
Notes:
FIXMBR
fixmbr device name
Use this command to repair the master boot record (MBR) of the boot partition. In the command syntax, device name is an optional device name that specifies the device that needs a new MBR. Use this command if a virus has damaged the MBR and Windows cannot start.
WARNING: This command can damage your partition tables if a virus is present or a hardware problem exists. Using this command can result in inaccessible partitions. Microsoft recommends that you run antivirus software before you use this command.
You can obtain the device name from the output of the map command. If you do not specify a device name, the MBR of the boot device is repaired, for example:
fixmbr \device\harddisk2
If FIXMBR detects an invalid or non-standard partition table signature, FIXMBR prompts you for permission before rewriting the MBR. FIXMBR is supported only on x86-based computers.
Run the Recovery Console.
FIXMBR
EXIT
Notes:
FIXMBR
fixmbr device name
Use this command to repair the master boot record (MBR) of the boot partition. In the command syntax, device name is an optional device name that specifies the device that needs a new MBR. Use this command if a virus has damaged the MBR and Windows cannot start.
WARNING: This command can damage your partition tables if a virus is present or a hardware problem exists. Using this command can result in inaccessible partitions. Microsoft recommends that you run antivirus software before you use this command.
You can obtain the device name from the output of the map command. If you do not specify a device name, the MBR of the boot device is repaired, for example:
fixmbr \device\harddisk2
If FIXMBR detects an invalid or non-standard partition table signature, FIXMBR prompts you for permission before rewriting the MBR. FIXMBR is supported only on x86-based computers.
I have already installed recovery console and done a FIXMBR under XP, the only thing I did not do was FIXMBR <drivename> but I am assuming it looks for the main boot sector, on the main hard drive. Windows XP is starting fine with no problems, no errors and is stable. Its just Norton Symantec AntiVirus that is picking up the virus as the E character. No other virus scanners are detecting it.
Is this a bug in NAV 2003? is so is it nothing to worry about? or is there a way to write the MBR and blank/delete any virus sig that may remain?
Is this a bug in NAV 2003? is so is it nothing to worry about? or is there a way to write the MBR and blank/delete any virus sig that may remain?
Diskpart is the command you are thinking of.
Start, run, cmd
diskpart
select disk 0
clean
fixmbr
exit
Notes:
clean [all]
Use the clean command to remove partition or volume formatting from the current in-focus disk by zeroing sectors. By default, only the MBR or GPT partitioning information and any hidden sector information on MBR disks is overwritten. If you specify the all parameter, each and every sector can be zeroed, and all data that is contained on the drive can be deleted.
Notes #2:
You should assume this is possibly destructive to the data on the volume.
Start, run, cmd
diskpart
select disk 0
clean
fixmbr
exit
Notes:
clean [all]
Use the clean command to remove partition or volume formatting from the current in-focus disk by zeroing sectors. By default, only the MBR or GPT partitioning information and any hidden sector information on MBR disks is overwritten. If you specify the all parameter, each and every sector can be zeroed, and all data that is contained on the drive can be deleted.
Notes #2:
You should assume this is possibly destructive to the data on the volume.
So if I use:
diskpart
select disk 0
clean
fixmbr
exit
This will not destroy the data on the C:> drive, but clean the MBR and rewrite the MBR, thus leaving the data integretity intact?
The reason I am having to run this past you, is I will have to talk to the person doing this to their PC who lives miles from me, and I am unable to get to them again for a while, so what I dont want to do is end up trashing the OS (although they dont have much on there at the min, so it would be too bad, just they would have to reinstall XP).
If the above commands will clean the MBR and then rewrite it using the fixmbr, and then allow the reboot to work and load XP as normal that should be great!.
Look forward to hearing your reply.
Chris
diskpart
select disk 0
clean
fixmbr
exit
This will not destroy the data on the C:> drive, but clean the MBR and rewrite the MBR, thus leaving the data integretity intact?
The reason I am having to run this past you, is I will have to talk to the person doing this to their PC who lives miles from me, and I am unable to get to them again for a while, so what I dont want to do is end up trashing the OS (although they dont have much on there at the min, so it would be too bad, just they would have to reinstall XP).
If the above commands will clean the MBR and then rewrite it using the fixmbr, and then allow the reboot to work and load XP as normal that should be great!.
Look forward to hearing your reply.
Chris
- Status
Similar threads
- Locked
- Question
