More disk tools

dd - as the manual pages for gpart point out, the ancient and venerable Unix tool dd can be used to back up and restore things like boot sectors. Using a Knoppix CD, you can even save these to Win98 whether a Linux is installed on the hard drive or not.

$ man dd before using

Save a copy of the MBR/bootsector and also save just the primary partition table - to Win98 on hda1 - when booted from Knoppix CD:

Code:
$ su
# dd if=/dev/hda of=bsect00.dat bs=512 count=1
# dd if=/dev/hda of=ptable00.dat bs=1 count=64 skip=446
# mount /mnt/hda1
# cp *dat /mnt/hda1
# exit
$ ...
  • if - input file - for the Master Boot Record specify the entire drive; for a Partition Boot Sector use a partition;
    of - output file - I use the extension .dat so neither Windows nor I will treat it as text or a program - as you change things, increase 00 by one each time - using two digits keeps them in numerical order in the directory after your 10th backup;
    bs - block size, default is bytes - 512 bytes in a sector;
    count - how many blocks to read and write;
    skip - how many blocks to skip over in the input file before reading - only 446 bytes are allocated for executable code, then come 16 bytes for each of the four partitions that the stupid BIOS knows about, and then there's a two-byte MBR signature.
rawrite - a DOS/Windows utility with many variants, for writing unformatted data.

pfdisk - a DOS/Windows utility for reading and writing to the MBR, possibly also available for other operating systems.

FreeDOS - a free MS-DOS clone that can be used as a boot floppy or installed to hard drive.

tomsrtbt - Tom's root/boot: "The most GNU/Linux on one floppy disk" - ummm, that says it all.

Also use Google to search for linux forensic tools like The Coroner's Toolkit and Autopsy, and Penguin Sleuth Kit.

Some ways to use these tools
  • - install tomsrtbt to floppy under DOS or Linux - Linux boot floppy with recovery tools;
    - write FreeDOS image to floppy with rawrite or dd - boot floppy that reads/writes to FAT32 partitions;
    - add pfdisk to FreeDOS - work with MBR without Windows interference.
Resources
rawrite, pfdisk - ftp://ftp.netbsd.org/pub/NetBSD/NetB...allation/misc/;
FreeDOS - http://freedos.org/;
tomsrtbt - www.toms.net/rb/;
The Coroner's Toolkit, Autopsy - www.sleuthkit.org/index.php;
Penguin Sleuth Kit - www.linux-forensics.com/.

Happy hacking!

-- Ed