2. |
| If you have a question about hard disks, Boot
disks or anything else and your PC still "boots up" OK:
Try to include all relevant information, such as:
Drive size(s), Operating System (OS) (Is it Windows 7, 8 or 10, XP (SP1, 2 or 3), 2000, NT4, ME, 98SE, 98, 95B; some
kind of DOS? Or is it Linux or some other kind of OS ? ), if there's more than one OS on the drive (it's for 'dual' or
multi-boot), the computer maker (Dell, HP, Toshiba, etc. or good old generic); the MOTHERBOARD maker (GIGABYTE, ASUS, etc.) Anything else that might
apply to your question.
If you want to know more about your hard disk drive's MBR and/or Volume Boot Record(s), you can use one or
more of the tools on this page to save that data to files which you can then email us for analysis: Boot Tools. Feel free to ask questions about how to use any of these or other tools you may already have.
a) "Does my PC have a Boot Virus?" A boot virus is an
infection on your PC that is run before the OS ever starts, every time the PC first boots-up, because it resides in the first Sector of the PC's boot
drive (or worse, but rare, in the BIOS itself!). Many boot viruses will also infect any storage media (such as a floppy diskette or USB drive)
plugged into an infected PC, so they can migrate to other PCs as well.
There are both MBR (Master Boot Record) and VBR (Volume Boot
Record) boot viruses. The first step in checking for a boot virus is to boot-up the PC from a known-good CD (which obviously could never be infected by
a PC with a virus) that can be used to check the MBR code in your boot drive's first Sector. A VBR boot virus is located in the first and/or
following sectors (usually within the first 16) of an OS partition; which means it can also load itself into Memory and run before an OS (such as Windows)
starts. So, it can protect itself before any Anti-virus programs running under the OS have a chance to even look for a virus there. We are preparing a
bootable CD which will do a cursory check on your drive's MBR and also make a copy of the drive's first 63, 100 and/or 2300 sectors, hash and display the
hash value of the file, then save the file on a drive. By checking its hash value later, you will know for sure if it was ever altered.
b) "Rootkit Viruses" are called this, because they were first designed to take over Unix, Linux and other such OSs by
becoming the "root" user (think highest level Administrator). After gaining access as 'root' the infection (or a real person) could not
only further infect modules or even the OS kernel to protect that code from discovery, but also remove traces of its having done so! So, this type of
virus infects OS system files, and will load and protect those infected files from detection before any other OS code or Anti-virus programs have a
chance to check or look for them. By booting from some specially made Anti-virus CDs, the PC's OS files can be scanned for this type of infection.
We hope to add more to this page on how to combat Rootkit viruses.
|
3. | |
You want to do a fresh install from scratch (go all the way back to the beginning of setting up a new PC!),
but you're having problems deleting a partition from the hard disk, or the install has problems with the disk:
Then try our ZAP63 utility which will 'zero-out' the first 63 sectors
of any PC's hard disk. You should then be able to use any OS install media without problems (or the old "FDISK /MBR" command to write a new
MBR sector if working with DOS; see FDISK /MBR for more info). See #4 below for completely
removing all data from a drive!
NOTE: If you want to delete only a NON-DOS/Windows partition, but keep data from other partitions
on the same drive, contact us about what you want to do for the best approach; depends upon what OS you have. But see our Tools page here:
Boot Tools and References
For old DOS systems, the Microsoft DELPart program* (here on our site) will remove only the partitions you select from the Partition Table. If you're familiar
with Linux, then you could also use its fdisk or sfdisk on a Linux Live or Rescue CD.
*Note: Here's a page All about the DELPart Utility (with pictures)!
|
4. | |
You either: a) Want to make sure that every byte of a new/used hard disk can be written to and
read from, or: b) Want to give/sell a drive to someone, but make sure they can not recover any of your files!
File system checks are OK once an OS is installed, but to really make sure there are no
defective sectors or 'left-over' code strings from a virus, you need to 'zero-out' and test every single byte on a drive! The best
way to do that is with a utility made by the hard disk or SSD's manufacturer. Western Digital has often had special programs for
doing this (WD_DIAG for older drives, or DLG_DIAG for more recent models; this is the same program you must run before they will allow you
to return the drive as faulty under warranty), and every other reputable drive manufacturer should also have similar programs. [
Here's one called DFT for Hitachi/IBM drives. Or see this:
HDD utils listing for
other manufacturers.]
If you just bought a brand new drive, or obtained a used one from a friend, this is the ideal program (assuming the drive maker has one)
to both test the drive and 'zero-out' every byte at the same time. Obviously, if you want to give or sell your own drive to someone,
this is also what you want to use! IF you've tried searching everywhere on the Net but still can't find
such a program for your drive, here's a utility which will 'zero-out' up to 8.4 GB of any hard drive: You'll find it listed as WIPE8.zip on our "Wipe" page. See that WIPE.html page for other suggestions.
|
5. | |
If your computer will not boot:
a. Describe how far along in the boot process it gets... Do you see anything
on the screen? If it has a hard drive, does that spin up? What error messages, if any, are displayed? Think about what you were doing just
before this happened (when was the last time it booted-up?). Did you change any settings, add a new program or update the OS? Things like that.
b. PCs today no longer have floppy drives (some don't even have CD/DVD drives!). For many, the only alternative was
to remove the PC's storage drive and connect it as a slave to another PC (still a choice many techs may prefer, since their own PC will already
have all the tools they need to use). But we will show you how to make a simple boot CD or bootable USB drive to at least check if your
PC/drive has any hardware problems.
Or, if you already have a Windows 7 OS Install DVD plus a USB drive to download some programs to,
you can use that DVD to boot-up your PC and copy various sectors (the MBR, VBR, etc.) of the drive to study, compare or email to us, and also use it to
know for sure if any of the files you must get back can simply be copied, need to be corrected or have been overwritten.
WARNING: Do not ever allow this DVD to repair your non-booting drive, nor run chkdsk on a drive;
unless, you are absolutely sure it is the correct thing to do! Do not trust anyone telling you to do so without proof!
You should be able to copy any critical files from your PC to the USB dirve as well. However, for copying the whole drive, we'd recommend using either
the Ubuntu Live CD (see below) or some other boot CD/DVD rather than this workaround method.
(Note: We had been working on a page for the Windows 8 install DVD, but it does not allow you to access USB drives! However, if you do have a Windows 8 OS Install DVD availble, this page could be helpful in using whatever programs might be available
from your disk drive, and to at least see if your critical files are still readable.)
PC manufacturers (by removing floppy drives) AND a big OS company (by not providing a way to create similar bootable CD or USB media; which
could run familiar utilities) made it difficult for average users to freely (some commercial boot CDs do exist) access their PC hardware, so
hackers have worked on making this possible. What we can use:
1. For some, using a bootable "Live" Linux Distro (on CD/DVD or a USB drive) is just fine; and if you do not know some of
the essential Unix/Linux commands (such as: ls [list files/folders], cd [change directory; same command in DOS/Windows], cat, cp, dd, hexdump, hexedit, vi etc.), this could
be a great learning experience in using some very helpful tools. But: It's quite easy today, with just a little help, to use an Ubuntu
Live CD (32-bit or 64-bit .ISO file) to view and copy important files from your Windows NTFS partitions, or at least go online with its FireFox
Web Browser to ask for help.
Full Guide to Using an Ubuntu Live CD (by TheStarman) (Step by step GUI pictures of its windows!)
2. Others simply want a quick way to see if they can still access their files in an OS they already know; that is, Windows! That big OS
company does make something called a PE (Pre-install Environment) tool kit, but many Windows functions familiar to the user can not run under a
simple PE CD.
Note: It is possible, as we mentioned above, to boot from a Windows Install DVD and open NOTEPAD (you could even do that
from a PE CD) and view the familiar window for selecting a file to open. This will at least allow one to know if the folder/file structure can be seen;
and you could even attempt to open any files, not only text-based files. You could also (and maybe should) run the chkdsk command (but do not
allow it to make changes!) on a drive, to check for any problems with the whole file system. Simply enter help at the prompt to see what
commands are available. And although many programs will fail to run under Windows PE, we have been able to run a number of utility programs, including
the HxD Disk Editor, under PE or a Win7 or Win8 Install DVD (see links above).
Note: We are
also in the process of creating a bootable FreeDOS .iso file (to make a CD or bootable USB drive from) in order to run some 16-bit DOS-like programs
from.
Note: Hackers have created bootable Mini-Windows XP OS CDs, but due to the nature of what files are often included on such
CDs and whatever illegal sites they may link to, we cannot recommend such CDs (and the average user is likely to have trouble using them); in spite of
how useful they may be. One such CD is called the Falcon 4 UBCD (testing shows this does not fully boot-up on many laptop PCs). We admit it would be
quite helpful to be able to get online with such a CD; this one can even set up a WiFi connection, while running familiar Windows XP utilities and even
a 32-bit Windows program from a USB drive.
But for a company or individual concerned about using legally correct methods (with a lot more 'above
board' help available too!), they should use a bootable linux OS (as described above), possibly pay for a solution licensed to handle Microsoft file
systems, or if you have the skills to do so: Connect the drive as a slave to a clean Windows workstation to examine its files! Note:
Connecting a drive with older NTFS partitions to a newer Windows OS may alter how its files are saved, or even chnage the file system! If possible, we'd
recommend using an OS with the same NTFS file system version; unless you simply want to move data files to a new OS drive and wipe the old one.
|