Can I reinstall win98 without wiping out knoppix hdd?

[turbine]

I'm dual booting knoppix and win98 using boot floppy to bring up knoppix. My current win98 needs to be re-installed but I'm concerned that said installation will:
a: Fool with my mbr thereby eliminating any semblance of my knoppix install
b: Not recognize my linux partitions and overwrite same with win98 stuff
If these are true is there any way to keep them from happening?

Thanks

Nick

[fingers99]

Do you have Windows and Knoppix on different drives?

[turbine]

No, they're on the same physical drive only different partitions.

[tdjokic]

I see your situation this way:
- you have win98 on its part of hdd and you boot it with his boot loader from MBR - this seems to me as separate OS and you can reinstal it on his partition. If you stay on the same size of partition, there is no reason for win98 to interfere with Linux. You are the only one who deside how much of hdd will win98 use and how much will be for Linux.
- since you boot Linux with floppy there is no chance win98 can fool your floppy.

[Harry Kuhman]

I'm dual booting knoppix and win98 using boot floppy to bring up knoppix. My current win98 needs to be re-installed but I'm concerned that said installation will:
a: Fool with my mbr thereby eliminating any semblance of my knoppix install
Yup, I expect it will do that. You'll likely need to run lilo again. If you have Lilo installed onto the Linux partition rather than the MBR you never have to touch it again., just reinstall something like SBM to the MBR or XOSL to it's own partition, both easier (at least for me) than fooling with Lilo.


b: Not recognize my linux partitions and overwrite same with win98 stuff
If these are true is there any way to keep them from happening?
No, Win98 is pretty good about letting you run fdisk and control your own partitions. The MS fdisk will see the Linux partitions as an unknown type, but that shouldn't be a problem. You likely will not want to repartition anything anyway, maybe just reformat your Windows partition.

[mr_ed]

I'm dual booting knoppix and win98 using boot floppy to bring up knoppix. My current win98 needs to be re-installed but I'm concerned that said installation will:
a: Fool with my mbr thereby eliminating any semblance of my knoppix install
Yup, I expect it will do that. You'll likely need to run lilo again....
Harry is being restrained here. :D If Windows doesn't overwrite your MBR, then Microsoft wants to know about it, fast!

But that doesn't eliminate Knoppix by a long shot. Well, first of all, you're booting from a floppy - that will still work.

And LILO has three pieces - the one that gets installed to either the Master Boot Record or the Partition Boot Sector is only one of them, and it can be rebuilt with the other two very easily.

First, there's the LILO program itself. That's still there in your Knoppix partition. And so is its configuration file, /etc/lilo.conf. All ya gotta do is be in your Knoppix partition and, as root, type # lilo.

Now here's the beauty part of keeping your Knoppix CD around even after you've installed it to hard drive. Suppose your floppy stops working and Martians rewrite the MBR with gibberish. (In fact, NetBSD did just that to me a couple of days ago....)

You can boot from the CD, get into the Knoppix hard-drive partition, run LILO, and restore a multi-boot MBR. Suppose Knoppix is on partition hda2. You do this in a terminal window:


(CD)$ su
(CD)# mount [-o remount rw] /mnt/hda2
(CD)# chroot /mnt/hda2
(hda2)# lilo
(hda2)# exit
(CD)# reboot (or whatever)
You only use the part inside the - but without the [ and ] - if you had the Knoppix CD automount the partition before you do this operation. Maybe you clicked on its icon on the desktop.

When you do that, Knoppix mounts hard-drive partitions as read-only, so you need to remount it with the option read/write. You can check to see what's mounted, and where and how, by typing the command [b]$ mount with nothing after it.

But if you just boot the CD and go straight to a terminal window, you don't need the part in the brackets.

Hope this helps!

-- Ed

[turbine]

Wow! Thank you all very much for your help.

There are 2 things that make me leery about doing this reinstall process. First when I do boot into win98, win98 doesn't recognize my linux partitions at all. They don't show up in the file manager. Second I wiped out my entire linux os once by running Norton Antivirus on the win98 side. Norton told me that there was a potential virus in my mbr and asked if I wanted it restored. I said yes. Later when I tried booting into knoppix, I discovered that everything was gone. Root partition, swap partition, everything. So I learned the hard way that altering the mbr can destroy the linux partitions.

Thanks again

Nick

[fingers99]

First when I do boot into win98, win98 doesn't recognize my linux partitions at all.

That's normal enough: Windows simply can't recognise any non M$ partitions.

As Mr Ed points out, there are a lot of ways back if Windows zaps the MBR. A dual boot system (I stopped dual booting 3 years ago and don't miss Windows at all) with a drive for each OS is safer and easier to manage, but you should be safe enough.

[Harry Kuhman]

Wow! Thank you all very much for your help.

There are 2 things that make me leery about doing this reinstall process. First when I do boot into win98, win98 doesn't recognize my linux partitions at all. They don't show up in the file manager. ...
Of course not. Windows can't use those partitions (access files on them) so it doesn't show them to you. But if you run Win98 fdisk it does know that the partitions are there, it just calls them something like unknown type. It will leave them alone, which is what you want. Some older versions of fdisk wouldn't even be willing to delete them if you wanted, but I think MS has "fixed" that.


.... Second I wiped out my entire linux os once by running Norton Antivirus on the win98 side. Norton told me that there was a potential virus in my mbr and asked if I wanted it restored. I said yes. Later when I tried booting into knoppix, I discovered that everything was gone.
I'm not a big Norton fan (and that's putting it very mildly), but are you sure that the Linux partitions were gone? I would have expected it to wipe out Lilo on your MBR, but having done something to the partition table seems strange. And what did it put in the partition table slots where the linux partitions used to be? It certainly shouldn't have given the space back to the Windows partition by replacing the entire sector zero rather than just the MBR portion of it,, that would have messed up the Windows partition too. Even if it did remove the partition table entry for the linux partitions (which still seems unlikely), you could have recovered them with gpart. One thing learned here is never to let Norton "fix" a MBR.


None of the above should be taken as an endorsement for installing Knoppix on the hard drive rather than Debian or other Linux distro intended for hard drive installation.

[mr_ed]

Hmmm. Well, the main partition table - the teeny-tiny one that limits you to only four primary partitions - is in the drive's first sector along with the MBR. It sounds like NAV rewrote that as part of getting rid of the potential virus. :evil:

It could have given the newly unallocated space back to Windows, which you might not have noticed, or it might have left it as unallocated. Either way, the Linux data was still on the drive.

Going back immediately after NAV did its thing, the whole 512 bytes of sector 0 could have been restored. LILO could have written a new boot portion of the sector from its configuration file or even re-installed the pre-Knoppix copy that it automatically backed up.

I didn't know about gpart - thanks, Harry! But even without gpart, a partition-table editor could have been used to re-create the pre-Norton status, for example from a printout or handwritten notes you made the last time you changed the partitions.

The Knoppix distro provides at least four Linux partition editors (I've used fdisk, cfdisk, parted, and qtparted) along with documentation and access to source code so you can see for yourself what they do.

I think there are a couple of lessons buried in your painful experience with NAV. One is that Windows' ease of use comes at the price of giving control over your machine to software that you also can't control. The other is to have backups - or at least notes - for important stuff.

Now for a ray of sunshine on this gloomy landscape! :D PowerQuest - of Partition Magic fame - used to have a couple of Windows tools to let you view and edit partition tables. They worked on the primary table in the MBR and on the tables for extended partitions too.

The bad news is that PowerQuest no longer exists. The good news is that partinfo and ptedit live on. The better news is that they're free! Wheeee! :D

The ironic news is that Nort ... errr .... Symantec bought PowerQuest, and you can download these and a few other Windows tools here: ftp://ftp.symantec.com/public/english_us_canada/tools/pq/utilities/. For Win98 get PartIn9x.zip and ptedit.zip.

A tiny bit of documentation for partinfo is at http://service1.symantec.com/SUPPORT/powerquest.nsf/0b685d0feb12bb8988256e970047cea7/dac340394944447c88256e75007cb02d and for ptedit at http://service1.symantec.com/SUPPORT/powerquest.nsf/92374e26e66cc3a188256e97004b8ff5/1b52c5e04b2dfbbb88256e75007ca1e5

If these urls don't work because the lines are too long, enter 2004073190203662 and 2004063693751462 at http://www.symantec.com/search/

Hack on!

-- Ed

[mr_ed]

More disk tools

dd - as the manual pages for gpart point out, the ancient and venerable Unix tool dd can be used to back up and restore things like boot sectors. Using a Knoppix CD, you can even save these to Win98 whether a Linux is installed on the hard drive or not.

:!: $ man dd :!: before using :!:

Save a copy of the MBR/bootsector and also save just the primary partition table - to Win98 on hda1 - when booted from Knoppix CD:


$ su
# dd if=/dev/hda of=bsect00.dat bs=512 count=1
# dd if=/dev/hda of=ptable00.dat bs=1 count=64 skip=446
# mount /mnt/hda1
# cp *dat /mnt/hda1
# exit
$ ...
if - input file - for the Master Boot Record specify the entire drive; for a Partition Boot Sector use a partition;
of - output file - I use the extension .dat so neither Windows nor I will treat it as text or a program - as you change things, increase 00 by one each time - using two digits keeps them in numerical order in the directory after your 10th backup;
bs - block size, default is bytes - 512 bytes in a sector;
count - how many blocks to read and write;
skip - how many blocks to skip over in the input file before reading - only 446 bytes are allocated for executable code, then come 16 bytes for each of the four partitions that the stupid BIOS knows about, and then there's a two-byte MBR signature.rawrite - a DOS/Windows utility with many variants, for writing unformatted data.

pfdisk - a DOS/Windows utility for reading and writing to the MBR, possibly also available for other operating systems.

FreeDOS - a free MS-DOS clone that can be used as a boot floppy or installed to hard drive.

tomsrtbt - Tom's root/boot: "The most GNU/Linux on one floppy disk" - ummm, that says it all.

Also use Google to search for linux forensic tools like The Coroner's Toolkit and Autopsy, and Penguin Sleuth Kit.

Some ways to use these tools- install tomsrtbt to floppy under DOS or Linux - Linux boot floppy with recovery tools;
- write FreeDOS image to floppy with rawrite or dd - boot floppy that reads/writes to FAT32 partitions;
- add pfdisk to FreeDOS - work with MBR without Windows interference.Resources
rawrite, pfdisk - ftp://ftp.netbsd.org/pub/NetBSD/NetBSD-2.0.2/i386/installation/misc/;
FreeDOS - http://freedos.org/;
tomsrtbt - www.toms.net/rb/;
The Coroner's Toolkit, Autopsy - www.sleuthkit.org/index.php;
Penguin Sleuth Kit - www.linux-forensics.com/.

Happy hacking!

-- Ed