[prev in list] [next in list] [prev in thread] [next in thread] 

List:       forensics
Subject:    Re: MBR deleted
From:       bsmathers () reypd ! com
Date:       2006-04-27 1:47:16
Message-ID: 20060427014716.29910.qmail () securityfocus ! com
[Download RAW message or body]

I believe you can only restore the MBR if you used the Active@ Partition Recovery \
software to back it up. 

You should be able to repair or re-create the MBR by using the fdisk /mbr command if \
the OS you are using is either Win95, 98, or ME. For NT, 2000, or XP, you can boot \
from startup disks or CD-ROM and select the repair option during setup and run \
Recovery Console. When you are logged on, from there you can then run FIXMBR command \
to fix MBR.

Have you tried to take a look at the MBR using a disk editor like Norton Disk Editor? \
Since the MBR is always the first sector of the disk, check it out and see what it \
looks like. The first 446 bytes are the MBR. The next 64 bytes are the Partition \
Table. Check to see if the signature is still at the end. It should be the last two \
bytes in the sector. It should read 0x55AA. 

If the sector is unreadable, you may have to use some sort of partition/data recovery \
software and get what data can be recovered and save to a new location. 

Useful utilities:
http://thestarman.dan123.com/asm/mbr/BootToolsRefs.htm

For future reference:
http://support.microsoft.com/?kbid=166997


[prev in list] [next in list] [prev in thread] [next in thread]