How to replace an MBR, when original not available

[jaymax2U]

Hello,

I recently lost access to my primary active HDD with a BSOD - 76... Inaccessible message.
The disk is in a RAID 1 Array, It (they) are seen but are not bootable. I suspect a corruption of the MBR.

The system
Win 2K Prof:
AMD 2180 MHz
8 drives - with 2 RAID Arrays
The Boot disk
149.05 Gb NTFS formatted
Single (1) partition on disk

Current MBR on Boot Drive:

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C
00000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BD BE 07 B1 04
00000020 38 6E 00 7C 09 75 13 83 C5 10 E2 F4 CD 18 8B F5
00000030 83 C6 10 49 74 19 38 2C 74 F6 A0 B5 07 B4 07 8B
00000040 F0 AC 3C 00 74 FC BB 07 00 B4 0E CD 10 EB F2 88
00000050 4E 10 E8 46 00 73 2A FE 46 10 80 7E 04 0B 74 0B
00000060 80 7E 04 0C 74 05 A0 B6 07 75 D2 80 46 02 06 83
00000070 46 08 06 83 56 0A 00 E8 21 00 73 05 A0 B6 07 EB
00000080 BC 81 3E FE 7D 55 AA 74 0B 80 7E 10 00 74 C8 A0
00000090 B7 07 EB A9 8B FC 1E 57 8B F5 CB BF 05 00 8A 56
000000A0 00 B4 08 CD 13 72 23 8A C1 24 3F 98 8A DE 8A FC
000000B0 43 F7 E3 8B D1 86 D6 B1 06 D2 EE 42 F7 E2 39 56
000000C0 0A 77 23 72 05 39 46 08 73 1C B8 01 02 BB 00 7C
000000D0 8B 4E 02 8B 56 00 CD 13 73 51 4F 74 4E 32 E4 8A
000000E0 56 00 CD 13 EB E4 8A 56 00 60 BB AA 55 B4 41 CD
000000F0 13 72 36 81 FB 55 AA 75 30 F6 C1 01 74 2B 61 60
00000100 6A 00 6A 00 FF 76 0A FF 76 08 6A 00 68 00 7C 6A
00000110 01 6A 10 B4 42 8B F4 CD 13 61 61 73 0E 4F 74 0B
00000120 32 E4 8A 56 00 CD 13 EB D6 61 F9 C3 49 6E 76 61
00000130 6C 69 64 20 70 61 72 74 69 74 69 6F 6E 20 74 61
00000140 62 6C 65 00 45 72 72 6F 72 20 6C 6F 61 64 69 6E
00000150 67 20 6F 70 65 72 61 74 69 6E 67 20 73 79 73 74
00000160 65 6D 00 4D 69 73 73 69 6E 67 20 6F 70 65 72 61
00000170 74 69 6E 67 20 73 79 73 74 65 6D 00 00 00 00 00
00000180 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001B0 00 00 00 00 00 2C 44 63 64 09 0C CB 00 00 80 01
000001C0 01 00 07 FE FF FF 3F 00 00 00 82 8A A1 12 00 00
000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

How can I tell definitively if this is the problem, are there any indicators or programs that I can use to ascertain this. Signatures, 55AA and NT's seems OK

From my limited architeural understanding the standard MBR design is as follows -

0x0000 ==> 0x01BD should be for codes = 446 bytes, of which
0x01B8 ==> 0x01BB for O/S, NT Signature area, = 4 bytes and
0x01BC ==> 0x01BD Nulls w/ error messages = 2 bytes

0x01BE ==> 0x01FD Partition Tables info, 4 - 16 bytes entries = 64 bytes
0x01FE ==> 55 hex Signature
0x01FF ==> AA hex Signature

For a 2000/XP system it should be

0x0000 ==> 0x012B should be for codes = 300 bytes,
0x012C ==> 0x017B are for error codes
0x017C ==> 0x01BD padded zeros exception -
0x01B5 ==> 0x01B7 part of dmadmin.exe file
0x01B8 ==> 0x01BB 4 byte, Disk signature or S/N
0x01BE ==> 0x01FD Partition Tables
0x01FE ==> 55 hex Signature
0x01FF ==> AA hex Signature


I have a generic MBR

Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F

00000000 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 1B 7C
00000010 BF 1B 06 50 57 B9 E5 01 F3 A4 CB BE BE 07 B1 04
00000020 38 2C 7C 09 75 15 83 C6 10 E2 F5 CD 18 8B 14 8B
00000030 EE 83 C6 10 49 74 16 38 2C 74 F6 BE 10 07 4E AC
00000040 3C 00 74 FA BB 07 00 B4 0E CD 10 EB F2 89 46 25
00000050 96 8A 46 04 B4 06 3C 0E 74 11 B4 0B 3C 0C 74 05
00000060 3A C4 75 2B 40 C6 46 25 06 75 24 BB AA 55 50 B4
00000070 41 CD 13 58 72 16 81 FB 55 AA 75 10 F6 C1 01 74
00000080 0B 8A E0 88 56 24 C7 06 A1 06 EB 1E 88 66 04 BF
00000090 0A 00 B8 01 02 8B DC 33 C9 83 FF 05 7F 03 8B 4E
000000A0 25 03 4E 02 CD 13 72 29 BE 75 07 81 3E FE 7D 55
000000B0 AA 74 5A 83 EF 05 7F DA 85 F6 75 83 BE 3F 07 EB
000000C0 8A 98 91 52 99 03 46 08 13 56 0A E8 12 00 5A EB
000000D0 D5 4F 74 E4 33 C0 CD 13 EB B8 00 00 80 42 04 17
000000E0 56 33 F6 56 56 52 50 06 53 51 BE 10 00 56 8B F4
000000F0 50 52 B8 00 42 8A 56 24 CD 13 5A 58 8D 64 10 72
00000100 0A 40 75 01 42 80 C7 02 E2 F7 F8 5E C3 EB 74 49
00000110 6E 76 61 6C 69 64 20 70 61 72 74 69 74 69 6F 6E
00000120 20 74 61 62 6C 65 2E 20 53 65 74 75 70 20 63 61
00000130 6E 6E 6F 74 20 63 6F 6E 74 69 6E 75 65 2E 00 45
00000140 72 72 6F 72 20 6C 6F 61 64 69 6E 67 20 6F 70 65
00000150 72 61 74 69 6E 67 20 73 79 73 74 65 6D 2E 20 53
00000160 65 74 75 70 20 63 61 6E 6E 6F 74 20 63 6F 6E 74
00000170 69 6E 75 65 2E 00 00 00 00 00 00 00 00 00 00 00
00000180 00 00 00 8B FC 1E 57 8B F5 CB 00 00 00 00 00 00
00000190 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
000001F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 AA

But there are some disturbing features - Considerable differences from the architecture described above:
Actually from 0x018A ==> 0x018D are nulled out, Should these be filled in with a hex editor?

Or should I just copy the first 446 bytes from here so as not to garble the Partition Tables, i.e from 0x0000 => 0x01BD

Would it be safe to insert/restore this to the MBR Sector ?

Any assistance would be appreciated, and of course in the process, I'd like to retain my data.

Thanks

 

[BadBigBen]

First I would make a BackUp... better to be safe than sorry...

then I would try the following program:

TestDisk

http://www.cgsecurity.org/wiki/TestDisk

The first 446 bytes of the MBR are code that boots the computer. This is followed by a 64 byte partition table, and the last two bytes are always 0x55 and 0xAA. You should always check these last two bytes, as a simple "sanity check" that the MBR is ok.

sourc: Partition Table Tutorial

another program that works, but I have not tested:

FixMBR

http://www.msfn.org/board/lofiversion/index.php/t30378.html

Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[jaymax2U]

Thanks BadBigBen:

I do have backup of files from volume post-hiccup problems.

I have ran TestDisk, not too sure of my interpretation of the output. I'll attempt to upload sreenshots if you'll be so kind to take a look.

I broke the arrays and ran TestDisk on the individual Disks.

TestDisk-1.gif => Disks on system and 1st boot analyzed

Boot disk highlighted. The pair in the RAID are listed as MAXTOR S TM3160812AS

[ii] After entering the Analyse step from the menu this screen is returned, which seemed OK!

Here the CHS
Start is 0 1 1
End is 19456 254 63
Seems reasonable and labeled "*" bootable

[iii]But Quick Search is selected, if I continue with the Quick Search option then

-3.gif] is generated
But here the CHS
Start is 19456 254 63 and
End is 38913 253 61
A message at the top of the display also states
"The harddisk (160 GB / 149 GiB> seems too small! << 320 GB / 298 GiB>
Check the harddisk size: HD jumpers settings, Bios detection ...

[iv]Continuing =>

-3a.gif]
With disk descriptor highlighted in green, showing expected CHS, and info at bottom saying Structure OK.

[v]Continuing =>

-3b.gif]

With quit option

Now is the Quick Search results at step [iii] an artifact or real ? and I could not find any clarification in the documentation.

Hopefully, you caan help

Thanks

 

[jaymax2U]

Sorry BadBigBen,
The last postings had settings for graphics that I naively thought would be uploaded on submitting, apparently this only works for graphics from a web site.

If I could figure out an mode of emailing I would do so

Well< I may have a solution.

An attached *.pdf file. Ignore the images after 2nd HDD in RAID as they are a reproduction of the 1st disk in the RAID. The last image is the files showing up in the ghost partition if indeed it does exist.

Thanks

 

[BadBigBen]

I broke the arrays

and

Now is the Quick Search results at step [iii] an artifact or real

obviously it thinks that it is still in an array...

since you broke the RAID, I would just go ahead and run from the Recovery Console the command FIXMBR on just ONE drive...

once that is bootable, create an IMAGE onto an external source, or onto another drive not involved in the RAID setup...

then CREATE a new RAID 1, transfer the IMAGE back onto the RAID, and that should be it...


PS: on this FORUM, attaching files does not work the way it does on other FORUMS, if one wishes to attach a picture you will have to use the [ignore]

[/ignore] tag and an online service such as PhotoBucket...


Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"

 

[jaymax2U]

Thanks for your patience BadBigBen;

Hopefully this is the last clarification sought and no need to bother you further.

Just to be absolutely sure of my step, I was thinking of the same, but doing a complete reformatting of this disk and then restoring from a Win 2K *.bkf or an ASO backup. However you mentioned a Disk image, which I can supposedly create in Nero [ISO file].

According to your steps:

>obviously it thinks that it is still in an array...since you broke the RAID, I would just go
>ahead and run from the Recovery Console the command FIXMBR on just ONE drive...


FIXMBR would wipe the disk clean, I think or is it FIXBOOT that does a clean wipe.


>once that is bootable, create an IMAGE onto an external source, or onto another drive not
>involved in the RAID setup...


Then is that to make an iso image of the "FIX'D" disk. that is now cleaned of all partitions ?
{Doesn't that implies loss of data but at least there will be a decent MBR}
{Or is it an IMAGE of the mirror of the RAID. In copying this back to the RAID, sector by sector copying, wouldn't it be copying back the corrupted code in the MBR sector 0 . If indeed that's the problem ? }


>then CREATE a new RAID 1, transfer the IMAGE back onto the RAID, and that should be it...

Then restore the "FIX'D" image back onto the RAID
or the Mirror'd IMAGE


Sorry for apparently dragging this out

Thanks again

 

[BadBigBen]

no need to bother you further.

no bother...

However you mentioned a Disk image, which I can supposedly create in Nero [ISO file].

The image I was referring to, is an image of the HardDrive, and NERO has nothing to do with this... e.g. the usage of Paragon Partition Magic ($39.95), which will do an IMAGE(aka BACKUP_ of HDD to DVDs or USB HDD, from which you can rewrite onto a RAID 1...

Smart Backup options for headache-free security

* Schedule backups automatically
* Perform incremental backups to maximize space and save time
* Run Backup solutions directly from the Master CD – no software installation is required
* Backup to any media or special secure place on your hard disk
* NEW! Exclude Files/Folders - Save space by backing up only the data you want
* NEW! Blu-ray Disc Support – Burn your backup archives to Blu-ray discs and more

source: Drive Backup 9.0 Personal

I was thinking of the same, but doing a complete reformatting of this disk and then restoring from a Win 2K *.bkf or an ASO backup.

since you already have a BACKUP, then ignore my ramblings above, and create the array new, then recopy it using your backup...

to clear up a few things:

FIXMBR would wipe the disk clean, I think or is it FIXBOOT that does a clean wipe.

Neither... FIXMBR does exactly what it's name implies, it rewrites the MBR, and FIXBOOT does exactly what it's name states too, in that it fixes the BOOT.INI and reinstalls the BOOTLOADER (NTDETECT.com and NTLDR)...



Ben
"If it works don't fix it! If it doesn't use a sledgehammer..."
How to ask a question, when posting them to a professional forum.
Only ask questions with yes/no answers if you want "yes" or "no"