How MBR Works
Acronis True Image 2010
XP Pro SP3
I want to make sure I understand what happens when you select MBR during an Acronis Home Image 2010 boot disk recovery.
For example, say the source disk backed up is a single partition C. The target disk has two existing primary partitions – C and D. You recover the image of the single partition C to the target C partition. You have also checked MBR recovery. Is the final result that the target disk now has a single partition C. The target D partition no longer exists (has become unformatted space) because the MBR from the source only had a single C partition. Thanks in advance.
Very nice succinct post Mark.
I see so much crap on the internet these days. Forums where people will post whatever jibberish they can conjur up... or whatever they think "sounds good". Worse yet, the mods won't even jump in to correct some of these crazy non-sense tech advice. It is refreshing to see good content for a change. I've been reading some of the threads on here and the vast majority of people give solid advice here. I truly wish that Acronis tech support based in India would have half the knowledge some of the MVP members have here.
Mark,
Am I right in thinking that for PCs, such as Dell, that have a hidden recovery partition, when restoring images of the complete drive one should also restore the MBR in order to maintain the abilty to boot to the recovery partition, should one wish to restore the PC to the state it was shipped? For Dell, the required boot code is in the first 440 bytes of the MBR, I believe.
Apologies if it is felt that posting here makes me guilty of hijack.
JRosenfeld:
Yes, you could save a copy of the MBR (one is automatically saved each time you create an image) and then restore it at some future date to re-enable booting into the recovery partition.
Dan Goodell has a lot of these details about Dell recovery partitions, etc., on his web site: http://www.goodells.net/dellrestore/
Yes, thanks, that's what I'd been reading before posting here.
Good info Mark!
I had a image restore bomb out on a Dell Vostro last week, gave up and reinstalled WinXP after getting rid of the dell hidden partition and overwriting the MBR using fixmbr with recovery console. Don't know why it bombed. But in the future for all Dells we have I would like to wipe the MBR and remove the hidden partition and partition the drive to C and D. Of course this would be done after I make an image file.
DElls mbr and hidden partition has caused my problems before (partition magic wouldn't work) so I plan on deleting the hidden partition using partition magic, create two partitions using all the unallocated space. Is the MBR changed TOTALLY from the Dell by doing this or do I have to use a third party program to get rid of all of Dells stuff or use fixmbr? What's the best way to do get rid of all the Dell stuff in the MBR?.
So after reading (some) of this, I understand that ti11 will not backup the parition table, is that correct? And if so, how do I do that?
Why would the partition table NOT be backed up?
It doesn't make sense! Why backup the 446 byte mbr, and leave out the 64 byte partition table? AND then go and backup the entire 100GB parition?!?!? Why not get those 64 bytes as well?
And can I safely use ati'11 (working from the rescue disk only!) to backup a standard dell dimension (with one hd and winxp) from 2007 ?? When I go to restore this, am I gonna have any strange boot problems or whatever?
Keatah:
There are a few third-party utilities that can back up and restore a partition table but they must be used with extreme caution. Or, if you have a disk editor you can save the entire first sector as a backup.
The reasons that TI does not restore the partition table are:
a) It isn't necessary and
b) Incorrectly applied, it can result in data destruction.
Here is an example of how things can go wrong if TI had decided to restore the partition table when restoring the MBR. Let's assume that you start out with a disk containing only one partition containing Windows and all of your files. You then back the partition up with TI and save the backup for a rainy day. Your partition table has only one entry for the main OS partition, which fills the disk.
A few weeks later you repartition your disk, shrinking the existing partition and adding a second partition for your data files. You then copy all of your photos, music, videos, and personal files to the new second partition. Your partition table now has two entries -- one for the OS partition and one for the data partition.
If you then restore the MBR, and if Acronis had decided that the partition table would also be restored when the MBR is restored, the partition table after restoration would be as it existed at the time of the backup (only one large partition) and all of your photos, music, videos, and personal files would vanish. Since this is obviously a bad outcome, the designers of TI chose not to restore the partition table along with the MBR.
When TI restores a partition, it creates a new entry in the partition table for it, so it isn't necessary to have a separate means to restore the partition table, and in fact it is dangerous to have a means to do so since it can be an accident waiting to happen.
Hope this helps...
You should be able to use TI 11 (or do you mean TI version 2011) to backup and restore your Dell Dimension PC with WinXP installed. If you are upgrading to a larger disk, be sure to remove the original disk after you have backed it up. Then install a new, blank hard disk into the Dimension and restore the backup to the new disk. For the first boot you should not have both the old and the new disks attached simultaneously or you will run into boot problems.
Ahh yes yes, thanks once again! I am referring to 2011. And now I see and understand about the partition table not being backed up. Creating a new partition table entry makes sense here. Again thanks for the tutorial. All the fine details are now coming together!
Mark you wrote:
"The term "MBR", or Master Boot Record, as commonly used usually means the first sector (512 bytes) on the disk. In this first sector are several items - the master boot code, the disk ID, and the partition table. When you restore the MBR using Acronis True Image, only the first item is restored. The partition table is never touched."
But then I would say to call this MBR restore in Acronis is completely wrong and confusing. On the other hand I just restored a partition with 2011 WITHOUT MBR and all my Win 7 versions did not boot anymore. Before I had WinXP and 2x Win7 OS installed with the Windows boot manager. So this confuses me even more. And I do not want to remember how often my partition tables got destroyed with 2010 in respect of the extended partitions - also with no MBR restore selected.
In theory you might be right ;-) But Acronis should fix the problems and not call it MBR restore anymore.
Well now, there is a conflict of information here, A previous poster, Mark, said that the partition table is NOT BACKED UP. Only the first part of the MBR is. He also says that when TI restores a partition, the partition table is UPDATED by TI, at the time of restore. Anyhow that is how I understand it.
"When TI restores a partition, it creates a new entry in the partition table for it, so it isn't necessary to have a separate means to restore the partition table, and in fact it is dangerous to have a means to do so since it can be an accident waiting to happen. "
And my question still remains, can TI get the partition designators correct as described here, http://www.goodells.net/dellutility/partparm.htm
??
So when I back-up this pc, should I just capture the "C" partition, and nothing else? Because, now learned that TI re-writes the partition-type designators and doesn't actually save them anywhere during a backup run/image.. And without the DE type designator, the DSR / F11 function is not operable.
But Keatah I beginn to understand now why it cannot restore the partition table - thank you. Because it almost always tries to resize the partitions at a restore (for whatever annoying reason - perhaps someone can explain). And so it has to write to the partition table at every restore.
But to call it MBR restore what you can select extra and to destroy the boot information without the selection of this is still not okay. You could only restore the MBR what you can select. But what it restores then is not the MBR but only parts of it.
Wow.. This is all great educational material. Perhaps not useful outside of this scenario, but the way of thinking to understand all this is important! Kudos to Mark again..
I can now, I believe, narrow my question..
Does ati2011 save, or put back, the partition type, for example [07] for an Installable NTFS, or in the case of restoring a Dell system of 2007 vintage, the [DE] type? Does it put that designator back into the table??
The DE designator is required in order to allow the bios to read the diagnostics partition.
And if I image/backup just one partition, does ati2011 just change the entry for the partition that I am backing up/restoring, or does it parse the entire table's 64 bytes?? If it doesn't parse, then I can definitely get by with doing just one partition, the "C" drive part. And just leave the others alone.
Or once again, would a sector by sector image work best here.
Thanks so much for bearing with me on this. You've been a great help so far!
John:
Replying to your post #10:
There is an entirely different reason that you ran into boot problems with Windows 7. Microsoft made a disk partitioning change starting with Vista. For many years, the first partition on a disk started at sector 63 and all partition boundaries were multiples of 63 sectors. Disk Management console in Windows XP would create a disk layout like this.
But Windows 7 and Vista's partitioning tools (the installer, Disk Managment console, and the command-line diskpart tool) start the first partition at sector 2048 and all partition boundaries are multiples of 2048 sectors (1 MB). So if you installed Win7 and let the installer create the partitions then they would have been created to the newer standard.
TrueImage still uses the older standard with 63-sector offset. So if you restored a backup of a Win7 partition then TI would create a new partition table entry for it and it would be created to the older standard and thus relocated to line up with the older 63-sector offset standard. There is nothing wrong with this; Vista and Win7 can happily exist on a disk with the old layout standards. However, due to the way that Vista/7 boot, the boot manager entries in the BCD (Boot Configuration Database) must be modified so that the boot manager is aware of the new location of the partition(s).
TI has the ability to automatically correct the BCD entries for a single boot installation, but its algorithm cannot always make all of the needed corrections for a multiboot installation; there are too many combinations. So, getting back to your issue, if you had a multiboot installation with WinXP installed to the active partition, and you restored your Win7 partition(s), TI probably couldn't fix the BCD correctly. The fix for this is to then boot the PC from a Win7 DVD and let the automatic repair fix the BCD, or to edit the BCD manually to fix it.
If you do this and then create a new backup with TI of your disk that is now partitioned to the older standard, the new backup can be restored as many times as you like going forward and you should not run into boot problems in the future. In other words, this will have been a one-time event.
Your other comment about TI restores corrupting extended partitions is probably a Windows issue. If your disk had mixed layouts with some partitions created by WinXP Disk Management and others created by Win7 Disk Management, then under some situations, data loss can occur. Backing up a logical partition created by Win7 and restoring it with TI will realign the partition to the older standard, and with chained logical partitions, the "chain" can be broken. Microsoft does not recommend modifying a disk layout created by one tool with the other tool. Here is a KB article from back in the Vista days: http://support.microsoft.com/kb/931854
If you are going to have a multiboot PC with XP/Win7 installed, and you are going to use TI to back it up, the safest way to do this is to have all of the partition layouts conform to the older standard (63-sector offsets) and to avoid using any of the Win7 partitioning tools on the disk. If you currently have a mixed layout with some partitions created by Win7 tools, then you can fix the layout by backing up the partition(s) with TI and then restoring them. TI will realign the partitions to the older standard during the restore operation. If you have a bunch of logical partitions then I would back them all up and use XP Disk Management to delete them all. Then restore them from their backups in the order that you want them to appear on the disk, resizing each as your restore.
Keatah:
Replying to your post #13:
Yes, when you restore a partition the partition type from the backup is written to the partition table. If you need to restore the Dell Recovery partition then TI should create a partition table entry for the partition with type DE.
When you restore a single partition, TI only writes an entry in the partition table for that partition. The others are not affected. So yes, you can restore only the C partition without affecting the Dell Recovery partition. If you're interested in details, you might want to read some of Dan Goodell's articles about Dell PCs on http://www.goodells.net/dellrestore/
It is not that easy Mark.
This is not correct that I had mixed partitions (XP and Win7). In my case ALL partitions are aligned to the 4 K standard now. Even so the WinXP partition. This since I have Win7 installed and the multi boot. All backups were done afterwards with version 2011. I checked the correct alignments with Paragon Alignment Tool™. Acronis 2011 did not destroy the alignment at restore. The version 2011 can handle alignment for 4k (an Acrionis statement that out of my experience I can confirm). Just the boot entries were gone.
In respect of the corrupted extended partitions entries with TI 2010 I restored only from the CD and this is not Windows OS if I am correct. I always used the CD because the Windows version created endless bad sectors - a different Acronis bug. Could not handle RAID0 and 64 K Clusters at FAT32. Only the CD version could. And at this time there was Windows 7 not even on the market - so all partitions were created by WinXP (I aligned them later). So no partition had a different standard then. At that time ALL of them were created using WinXP SP3.
It was a standard procedure then to restore my partition table with the software testdisk. Now it is a standard procedure to restore the boot entries of the MBR with the Win7 DVD and then EasyBCD. Don't see much improvement to be honest. And it has nothing at all to do with mixed partition layouts - I never had them mixed. So it might be Acronis ;-)
Well now!! That is what I call "tech support", can't beat that. While reading all this stuff I got to going through dan goodall's info. Wonderful info too. By using a partition table editor I think I can simulate this by making some partitions, labeling them and verifying what you say about how trueimage saves and replaces back the partition type, either [DE] or perhaps [07] or whatever.
I wish I could really find out what is on this computer and others, that is so secretive!!!
John:
You are correct - I had forgotten that the newer versions of TI will keep the 1 MB partition boundaries if they existed in the backup. However, I don't think that their algorithm for fixing the BCD is foolproof when there are multiple operating systems on the disk. Others report that it works for single-OS installations.
The CD version boots to a Linux-based OS. I had good success with it several years back but for the past couple of years I have been booting to a WindowsPE-based recovery environment, and that works well for me.
Mark, it works even better. I had an old backup not created aligned and restored it to an empty partition space. And Acronis 2011 restored this aligned. Perhaps I had luck but it did it. Perhaps it did it because I resized the partition at the same time.
But thank you for all your postings. It was an interesting discussion and a learned something. And 2012 is not so far away. And this version then... Perhaps the GUI is sadly only Backup Yes? No? then. Going back to the old DOS standard :-))
But in respect of resizing one more question. Do you know why TI always tries to resize the partition a little bit? It is annoying to set it back all the time when I restore. Now it is easier but at TI 2010 it was a nightmare to set it back. Use the slider and the entry fields in some sort of combination.
John:
Which tool did you use to create the partitions that are being resized a little bit? And which partition exhibits this behavior upon a restore; only the first, only the last, or any/all?
I haven't used TI 2011 yet, so I'm not sure of the details of how it creates a partition entry but I assume that it uses the new rules (2048 sector offset from start of the disk, and boundaries that begin and end on multiples of 2048 sectors). It probably also complies with the Windows practice of reserving a little bit of space, at least 1 MB, at the end of the disk in case you want to convert the disk to a dynamic disk later on.
Or, it could be a bug in the program. I don't notice this behavior on TI version 10 (not 2010) on a disk with all 63-sector alignment.
John,
If you restore one of the Windows 7 partitions, does TI screw up the booting of the other Windows? I'm curious if it was only because it was XP.
As for resizing, are you selecting to restore the partition image back to the exact same partition (no manual resizing adjustments)? If so, TI shouldn't be resizing it. Can you give an example of how it's moving?
What formatting and cluster size are you using on each Windows partition?
When you installed the Windows systems, was it XP, then Windows 7, then Windows 7? Or did you install using a different order or method (restoring, for example)?
To the resizing problem. It happens when I restore the partition to the exact same partition. So whenever I restore a partition (version 2010 or 2011) to the exact same location I get a final overview what will happen. In 2010 it will show you the free space before and free space after. I always have to set the free space after to 0. The same is true for 2011 but there the procedure is much easier to set it to 0. This happens at all partitions. They were created with Win7 now and with WinXP before. Mark, perhaps TI version 10 does not have this. You should really upgrade to enjoy the new problems :-)) But perhaps you are right and it tries to reserve space for dynamic disks - I never used them.
In respect of screwing up the booting. I will check next time if it happens at a restore of my Win 7 partitions too. It happened when I restored XP. Don't want to play around too much on my disks to test it now because I have several TB of data on my disks ;-)
In respect of formatting and cluster size it is like this:
WinXP FAT32 cluster size 32
All Win7 NTFS standard cluster size 4
All data partitions NTFS cluster size 64
WinXP runs on FAT32 because it is simply faster than NTFS. The data disks run on NTFS because it is more stable.
In respect of the installed Windows systems. Since I aligned all partitions to 4 K all of the OS got restored with TI 2011. So there is no installed version anymore. I created the boot sector with Win 7 after restore. Win 7 is only on 1 partition. That means I do not have the small boot partition. The alignment I did because Microsoft writes that even without SSDs or 4 K disks RAID 0 will be faster with it. But I could not find much difference after endless hours of work. I only found out that Win 7 cannot create a logical partition if for instance you just want to re-create the first one and leave the others untouched. What a poor software...
But one more question to this restore MBR flag at Acronis. I know now already that Acronis updates the partition table whenever it restores. It creates a new partition so it has to do this. But now I see that it even changes the boot information in the MBR at every restore even if this flag is not set - otherwise it would not have destroyed my existing entries. Sure the OS partition could have moved so it has to do this too. Perhaps it could look before it clears it if there are other OS installed and restore it in a correct way. But for what is this MBR flag good then if main things in the MBR get changed anyway? The good thing in 2011 is that it is somehow hidden now and does not confuse the users so much anymore.
John:
TI should only be changing the entry in the partition table in the MBR. How do you know that a TI restore is changing the other information in the MBR, presumably the master boot code? What is the symptom or error message that results after a restore?
The boot process in a PC can be described as a hop, skip, and a jump; it is a multi-phase process. The PC starts up by executing the MBR code which causes it to "hop" to the starting sector of one of the partitions (the one flagged as "active"). Then it executes the code in the first sector of this partition, which causes it to "skip" to the boot manager code (the file "bootmgr" in Windows 7), and the boot manager then either displays a menu screen that you make a selection from or it "jumps" directly to begin loading the operating system code (if there is only one OS).
So if the boot process is failing it doesn't necessarily mean that there is a problem with the MBR. There are several other places where things can go wrong. If the MBR code is defective then the usual symptom is a single blinking underline at the top left of the screen. If you see anything else like an error message then the MBR code has done its job and is working fine.
A common boot problem with Windows Vista and Windows 7 is that the partition's starting sector gets relocated during a restore and the boot manager cannot locate the files needed to boot the PC because the entries in the BCD (boot configuration database) are now incorrect. The boot manager will then display a detailed error message in white text on a black background. Is this what you are seeing?
Mark:
I do not know what happend. I just know:
Before I had at partition
1 WinXP active
2 Win 7
3 Win 7
Then I restored WinXP at partition 1 (same size and same partition and backup from this partition setup)
Afterwards I had the standard boot menu with
1 WinXP active and working
2 Win 7 not working
The other Win 7 and my text entries in the boot menu gone - was just the standard with text edited.
Perhaps it helps if I set a Win 7 active. Will test next time. Have too many data on the disk to play around.
John:
If you set one of the Win 7 partitions active the PC won't boot. On your system, booting is under control of the Windows 7 boot manager, which resides in the active (first or WinXP) partition along with the BCD. If you want to change this then you must move the boot files to one of the other partitions. This is done by moving the file "bootmgr" and the folder "boot" to another partition, correcting the approriate entries in the BCD, and then setting the "active" flag on that partition.
Upon re-reading all of your previous posts, this is what I think happened. You were using TI 2011 to restore the first (XP) partition and afterwards the boot menu was modified. The PC indeed started to boot correctly because you got to the menu display, so that rules out MBR changes as the cause. In the menu the third entry for Win7 was missing and the second entry for Win7 was present, but did not boot. The first entry for XP was working correctly. Is this correct?
If that's what happened then it had nothing to do with the MBR being changed or not changed. None of the boot files are located in the MBR; they are in the first partition. Conjecturing, TI 2011 has an algorithm to correct the Windows 7 BCD upon restoration, so it must have been TI that messed it up. The algorithm used is known to work for a single-boot Windows 7 partition, but it must have failed to correct your multiboot system's BCD. You may have found a case where TI incorrectly "corrected" the BCD, so you should report this to Acronis so that they can take corrective action.
Back to my version 10 - this version pre-dates the algorithm to automatically "correct" the BCD, so it has never given me a problem. It does have other issues with "correcting" the Windows XP boot.ini file, but that's another issue...
Mark, thank you very much for your explanation. Before I report a problem I want to have a more complete picture. Want to find out what happens when I restore the Win 7 partitions.
I always hold an OS version as backup were I install all new things that worked for at least a month without problems. This then gets my new backup version. When I restore the OS partitions next time to install such tested things I will check what happens again. I do not want to play around with my system to test. There are TB of data on this RAID disk. Even with good backups and mirrors it would take a while to rebuild and check the result afterwards. And my worst nightmare - if the backup/mirror disks would break when I restore... Too risky to play.