Through Baidu Knows: The general MBR is exactly one sector, 512 bytes.
The first part: boot loader (446 bytes)
The second part: DPT ( 64 bytes)
The third part: 55AA ( 2 bytes)
----------
Total: (512 bytes)
Questions:
1. For tools such as fdisk /mbr, PE, Ghost Killing Special, etc., to repair the damaged MBR.
Is it to overwrite and rewrite all 512 bytes? Or only rewrite the first part, and the second and third parts remain unchanged.
2. Regarding the 446-byte boot code in the first part. Are they the same regardless of the hard disk, regardless of the manufacturer, without version, all the same, fixed for many years?
Does the DOS command Fdisk.exe itself contain this 446-byte data? Otherwise, how can it be restored?
Could it be that the Fdisk.exe in DOS 2.0 version in 1983 already had this 446-byte data? The same as the main boot code of a 500G hard disk in 2010?
3. Which parts of the MBR are infected by the Ghost virus?
The computer is infected by Ghost, and it has been cleared now. When infected, the C, D, E, F of the hard disk are all visible (in Explorer), and file operations are basically normal.
Does this indicate that the second part DPT is normal and not modified by the virus? Can it be guaranteed that DPT is healthy and clean?
4. If the first part of the boot loader is all the same, there is no need to back it up.
Is it very necessary to leave a backup for the second part DPT?
What software is good for leaving a backup? It should be simple and convenient, and the most used tool by netizens at present.
5. If there is no backup of the DPT partition table. If the DPT is damaged by the virus, diskfix and DiskGenius can also find the lost partitions.
Are the recovered partition data safe? Will there be minor differences from the original DPT data, causing bugs?
What is the success rate of recovery? What are the serious consequences of not being able to recover (or only partially recover)?
Which of the two software is better?
[ Last edited by proof on 2010-8-21 at 20:15 ]
The first part: boot loader (446 bytes)
The second part: DPT ( 64 bytes)
The third part: 55AA ( 2 bytes)
----------
Total: (512 bytes)
Questions:
1. For tools such as fdisk /mbr, PE, Ghost Killing Special, etc., to repair the damaged MBR.
Is it to overwrite and rewrite all 512 bytes? Or only rewrite the first part, and the second and third parts remain unchanged.
2. Regarding the 446-byte boot code in the first part. Are they the same regardless of the hard disk, regardless of the manufacturer, without version, all the same, fixed for many years?
Does the DOS command Fdisk.exe itself contain this 446-byte data? Otherwise, how can it be restored?
Could it be that the Fdisk.exe in DOS 2.0 version in 1983 already had this 446-byte data? The same as the main boot code of a 500G hard disk in 2010?
3. Which parts of the MBR are infected by the Ghost virus?
The computer is infected by Ghost, and it has been cleared now. When infected, the C, D, E, F of the hard disk are all visible (in Explorer), and file operations are basically normal.
Does this indicate that the second part DPT is normal and not modified by the virus? Can it be guaranteed that DPT is healthy and clean?
4. If the first part of the boot loader is all the same, there is no need to back it up.
Is it very necessary to leave a backup for the second part DPT?
What software is good for leaving a backup? It should be simple and convenient, and the most used tool by netizens at present.
5. If there is no backup of the DPT partition table. If the DPT is damaged by the virus, diskfix and DiskGenius can also find the lost partitions.
Are the recovered partition data safe? Will there be minor differences from the original DPT data, causing bugs?
What is the success rate of recovery? What are the serious consequences of not being able to recover (or only partially recover)?
Which of the two software is better?
[ Last edited by proof on 2010-8-21 at 20:15 ]