Strange MBR changes

[sinsi]

Here's a new one. MBR is all 00, except for the AA55 signature. Once again, no virus/malware/rootkit.
Can't really think how it happened, maybe a rootkit install interrupted?

Got the partitions back with a nice program - TestDisk.

[mineiro]

Hello Sr sinsi
I have seen some virtual machines changing mbr on real machines. These computers have some VM installed?
This happened to me while using vmware (forgot the version now), my real mbr changed.
Alias, to backup partition, search for bad blocks, unerase files, ...,  a good disk heditor program can be "winhex"

[dedndave]

somewhere out in the middle of an NTFS partition, is supposed to be a copy of the MBR
i haven't figured out how to find it, yet - lol
but - i do keep a copy of all MBR's for each drive i have   :U
i use MbrWizard

[P1]

somewhere out in the middle of an NTFS partition, is supposed to be a copy of the MBR
i haven't figured out how to find it, yet - lol
but - i do keep a copy of all MBR's for each drive i have   :U
i use MbrWizard

The Win 2000/XP OSs make a "backup" of each NTFS volume's Boot Record which they store in the very last sector of its partition!

Regards,  P1  :8)

[dedndave]

does that mean that vista and win7 do not ?
or is that some really old text   :P

[P1]

does that mean that vista and win7 do not ?
or is that some really old text   :P

Do they run a NTFS format on the hard drive ???

Regards,  P1   :8)

[dedndave]

hey - it was your quote, not mine   :bg

The Win 2000/XP OSs make a "backup" of each NTFS volume's Boot Record which they store in the very last sector of its partition!

[P1]

hey - it was your quote, not mine   :bg

The Win 2000/XP OSs make a "backup" of each NTFS volume's Boot Record which they store in the very last sector of its partition!

Base utilities for dealing with hard drive issues of NTFS, like the MBR are the same, even through W7.

Regards,  P1   :8)