It seems like I’m recommending the program MBRwork to someone at least once a month. I recommended it two or three times just last week. But there are a couple of things I don’t like about it. One, it’s DOS. Creating DOS boot floppies isn’t as easy as it used to be. And two, it’s proprietary, so it could theoretically disappear any minute.
But similar tools exist for Linux.The most highly regarded is gpart (guess partition), which just happens to be included on the BG-Rescue Linux two-floppy rescue system. Download BG-Rescue Linux and burn the ISO image to a CD, or download the two-floppy version and write it to two floppies, and keep it in your toolbox. Or, of course, they’re on Knoppix.
When a partition table vanishes, or, a more likely scenario, a system quits booting mysteriously, you can boot BG-Rescue Linux and run gpart. You can also check FAT/FAT32 filesystems with dosfsck and NTFS partitions with ntfsfix.
Need to undelete some files in an emergency? You can even undelete files from NTFS partitions with ntfsundelete.
Clearly, skills with a handful of Unix utilities are very useful even in a strictly Windows shop.
Looks like I should explore these tools a bit more in-depth this week.
David Farquhar is a computer security professional, entrepreneur, and author. He started his career as a part-time computer technician in 1994, worked his way up to system administrator by 1997, and has specialized in vulnerability management since 2013. He invests in real estate on the side and his hobbies include O gauge trains, baseball cards, and retro computers and video games. A University of Missouri graduate, he holds CISSP and Security+ certifications. He lives in St. Louis with his family.
I’m listening – do tell more, please!
Ought to be required reading for some of your co-workers, although giving some of them tools like these could be EXTREMELY dangerous.
(shudder)
I wish I’d known this about seven years ago. I was a few months into my first job, and a power failure or system crash took out my partition table. At least, looking back, it seems like that was what happened. I had an alternate OS on a SCSI disk on the system so I booted from that, and couldn’t see a thing on the drive. We brought in the grizzled veterans, including the biggest NT experts we could find, and no one knew how to fix it. And we weren’t about to send it to Ontrack.
So I reformatted and started over. Today I’d be able to get it back.