Master Boot Record

  • Thread starter Thread starter KeV
  • Start date Start date
K

KeV

Hello, does anyone know how to format the master boot
record using XP Home Edition? I have tryed using a floppy
on startup and using the command FDISK /mbr... but it was
on the A drive and did'nt work. I need to type this on the
C drive, can anyone help?
 
"KeV" said in news:[email protected]:
Hello, does anyone know how to format the master boot
record using XP Home Edition? I have tryed using a floppy
on startup and using the command FDISK /mbr... but it was
on the A drive and did'nt work. I need to type this on the
C drive, can anyone help?

FDISK /MBR will overwrite the master boot record of only drive 0 (this is
the first physical hard drive found). You don't mention your drive setup
(which are master or slave, attached to which IDE ports and whether on the
motherboard or a daughtercard controller, and what driver-only support
drives, like CD-ROM drives are in the mix). If you have a hard drive on the
mobo's IDE0 port as master then it is the drive-0 device. Could be you have
a CD drive as master on IDE0 and the lone hard drive is master on IDE1 so it
is drive-0 over there. Depends on your hardware setup.

I'm wondering why you need to overwrite the MBR. Are you trying to remove a
bootmanager, like Powerquest's BootMagic, IBM's BootManager, or a Linux
bootmanager? Are you trying to wipe out a dynamic disk overlay program that
you once needed with an older motherboard that didn't support large sized
hard drives? Did your MBR get infected with a boot sector virus (which is
in the MBR instead of the boot sector of the active partition) and think
that overwriting the MBR will eliminate it? If so, overwriting the MBR to
eliminate the virus could render your drives unreadable because such viruses
often offset (move) the partition table or modify the pointers recorded in
the partition table that point to the partitions.

The default partition loader code that you overwrite using FDISK /MBR or
FIXMBR will look for the partition table in its default location. The MBR
is on drive-0 at sector 0 to provide up to 512 bytes. The BIOS doesn't
check MBRs on other drives, only on drive-0. While it is possible the
replace the MBR partition loader program with a bootmanager that will then
use partition tables on other drives to boot from those, the default MBR
partition loader program only knows how to read the partition table on its
own drive (i.e., the partition table immediately following the partition
loader program within the 512-byte MBR area in sector 0 on drive-0) and only
knows how to read a partition table that describes a maximum of 4
partitions. Following the 446 bytes for the partition loader (or bootstrap)
program is supposed to be the 64 bytes for the partition table. The
partition table consists of a maximum of four 16-byte entries with 10 fields
each (see http://support.microsoft.com/?kbid=114841). The last 2 bytes of
the 512-byte sector 0 MBR area are the boot signature bytes (55AA). So you
have the MBR on drive-0 at sector 0 which is 512 bytes long occupied by 446
bytes for a loader program, 64 bytes for the partition table, and 2 bytes
for the signature. According to Microsoft, "If 55AA is not present at the
end of sector 0 and you run [FDISK /MBR], the partition table and all the
partition information on that hard disk are destroyed." You need to use a
disk editor to ensure or enter "55AA" in the last 2 bytes of sector 0
(unless you don't care about losing the partitions if the MBR got infected
or corrupted).

The only time FDISK /MBR (or FIXMBR) is effective against a virus is if the
virus only infected the loader program area of the MBR; i.e., it only
overwrote the first 446 bytes of the MBR (sector 0). FDISK /MBR (FIXMBR)
will only overwrite the first 446 bytes of the MBR. It doesn't locate an
offsetted partition table or rebuild it. A stealth virus will offset the
partition table and/or the pointers within for the partitions. You
overwriting with a default partition loader program that expects the
partition table to be in one place (i.e., starting at the 447th byte of
sector 0) where it is not, or it using the offsetted pointers within the
infection modified partition table, will result in an unusable drive (until
you FDISK and reformat it). Boot viruses can do some really nasty stuff,
and removing their infection by simply overwriting just the first 446 bytes
of the MBR can leave your drive unusable. Although Microsoft provided FDISK
/MBR (or FIXMBR), you use it at your own risk. Be sure you have data
backups before doing this.
 
Back
Top