Welcome, Guest. Please Login
 
  HomeHelpSearchLogin FAQ Radified Ghost.Classic Ghost.New Bootable CD Blog  
 
Pages: 1 2 
Send Topic Print
Sysprep v1.1 (Read 8849 times)
Citizen_Kang
Radmeister
**
Offline



Posts: 53


Back to top
Re: Sysprep v1.1
Reply #15 - Nov 12th, 2002 at 11:52pm
 
Hey Rad,

Well it looks like even the installation CD will write to the MBR.  Proof:

1) Start with only disk 2 is in the system and boot from a fully functional W2K on 2:1.
2) Restart and boot from the installation CD.  Reformat 2:1.  Shutdown.
3) Attach disk 1 which has fully functional W2K on 1:1.  Boot up off 1:1 with the two disks attached. 
4) Restart system and boot into DOS.  Start Ghost and then restore the image held on 1:4 to 2:1.
5) Exit Ghost.  Shutdown system.  Unattach disk 1.
6) Restart system normally.
(Note: Steps 1-6 are exactly test 1b from about post, just formally written out)

The result, which is now predictable and reproducable -> a virtual memory error which does not allow 2:1 to fully boot.
Now instead of remedying the problem with Fdisk /MBR:

7) Restart system and boot from installation CD.  Reformat 2:1
8 ) Exit and turn off system.  Reattach disk 1. 
9) Boot up into DOS.  Start Ghost.  Restore image from 1:4 to 2:1.  Exit Ghost.  Turn system off.
10) Unattach disk 1.
11) Reboot normally

The result -> W2K boots up fine off of 2:1.

Interpretation:
@ step 1 -> disk 2, obviously, has a correct MBR.
@ step 3 -> W2K on 1:1 writes to and changes disk 2's MBR
@ step 6 -> disk 2's MBR is incorrect = no boot
@ step 7 -> W2K on installation CD writes to and changes disk 2's MBR
@ step 11 -> disk 2's MBR is correct = boot

Summary Pts:
- The way you introduce a disk to a system may indeed affect your ghosting operations
- Notably, W2K (and I presume XP) will configure a disks MBR.  The way that the disk's MBR is configured is dependent upon wheither W2K "sees" other disks in the system
- Fdisk /MBR is the quick and easy remedy to these MBR related virtual memory problems.

Lastly, I would like to draw attention to what one poster in this thread said on 06/24/02:

"I may have got a bit adventurous about the order in which I deleted/created partitions, copying from secondary to priamry etc - whatever Partionmagic was happy to let me do Smiley. The trouble is, what PM allows you  to do is not always what w2k/XP would be happy with. There are no warnings about the consequences of your quite seemingly sound operations.  In future I would endeavour to perform operations in the order w2k expects, not what PM allows me."

Obviously, that individual was dealing with a slightly different set of circumstances.  However, the context of their message is bang on, and it can easily be extended to include Ghost within its scope.

------------------------------
Well, that concludes my experimentations with this problem.  I'm happy enough with my findings, and don't really care to delve any further.  As it stands, I'm perfectly happy with Ghost2K3 and I am confident that it will work the way I want it too when I need it too the most.

If anyone else is reading this thread besides you Rad, the least they should glean from it is the simple fact that Ghost is, indeed, an industrial strength back up and recovery program.  How many times have I restored an image over the past week?  I honestly don't remember....probably upwards of 15-20.  How many times did I completely hose my system over the weekend trying out different drivers and some other software?...4 times.   How many minutes did it take to restore an image and get me back up and running?.....probably about 10 minutes total for those 4 times (most of which is spent reattaching my disk 1 and rebooting into DOS!).    I even tried creating an image in a one disk configuration...took a whopping 3.5 minutes as opposed to the usual 50 seconds in a two disk configuration....forgot to try restoring in the one disk configuration, but I'm sure it would take only ~five minutes or so.

Talk soon, CK



 
 
IP Logged
 

Rad
Radministrator
*****
Offline


Sufferin' succotash

Posts: 4090
Newport Beach, California


Back to top
Re: Sysprep v1.1
Reply #16 - Nov 13th, 2002 at 3:00am
 
Excellent post. I read it 3 times.

Any speculation on WHY W2K rewrites disk #2's MBR in step 3.

I could see it doing this during an install, but had no idea it would do this during a normal boot.

Do you thinks it's cuz you just reformatted the disk and the O/S wants to 'own' the new/blank disk?

Does reformatting wipe the MBR?
 
WWW  
IP Logged
 
Citizen_Kang
Radmeister
**
Offline



Posts: 53


Back to top
Sysprep v1.1
Reply #17 - Nov 13th, 2002 at 9:10pm
 
Damn you Rad, you got me thinking again....

I wrote up a lengthy reply and realized that it was contradicting my conclusions and that I didn't completely understand what is occuring...then a plausible theory started presenting itself to me...going to write it up and perhaps do a little research for some support....but it will have to wait till later on tonight.....the dog is driving me crazy right now and so I better go take him for a walk.

CK
 
 
IP Logged
 
Rad
Radministrator
*****
Offline


Sufferin' succotash

Posts: 4090
Newport Beach, California


Back to top
Re: Sysprep v1.1
Reply #18 - Nov 14th, 2002 at 12:59am
 
Cheesy
 
WWW  
IP Logged
 
Citizen_Kang
Radmeister
**
Offline



Posts: 53


Back to top
Re: Sysprep v1.1
Reply #19 - Nov 14th, 2002 at 2:25am
 
What did I say, about ten posts ago, about taking a step back from everything to work things out?  I really should stop dispensing advice if I can't follow it myself.

1. First off, I recently said Quote:
Well it looks like even the installation CD will write to the MBR.

Dumb bastard..Is it too late to recant? Because:

2. You stated Quote:
Does reformatting wipe the MBR?

I believe your right. My testing would seem to indicate that it does, and I have refined my conclusions based upon this fact.  In fact, this is the key point, and I can't believe I overlooked this.   I was just too caught up in the W2K changing disk MBRs on the fly theory.....which, however is still partially correct....I just haven't figured out how an instance of W2K running from the installation CD behaves yet.

(Note: I quickly re-read the entire thread, and in early posts on the first page I mention reformating but having no luck...but if I recall, I was still hooking the two disks back up and booting into Windows from 1:1 just to copy the image back to 1:4 from 2:1....unfortunately, I did not detail all the steps I was taking)

3. Quote:
Any speculation on WHY W2K rewrites disk #2's MBR in step 3.
 As outlined in the above point, I now believe it is because the reformating performed in step 2 of the test wipes disk 2's MBR clean as a whislte [grumble]whatever that's supposed to mean[/grumble].  When W2K starts off of 1:1, it probably looks for a "logical signature" (more on this in a minute) in disk 2's MBR, but finds none and so writes a new one.

4.   Quote:
Do you thinks it's cuz you just reformatted the disk and the O/S wants to 'own' the new/blank disk?

Reformat wipes MBR, but "OS ownership" I don't think so.  I just believe W2K likes its universe to be really logically organised ... will try to explain in a moment.
 
 
IP Logged
 
Citizen_Kang
Radmeister
**
Offline



Posts: 53


Back to top
Re: Sysprep v1.1
Reply #20 - Nov 14th, 2002 at 2:28am
 
I just got a message is too long error so I'm splitting this up....didn't realize there was a limit placed on the amount I'm allowed to spew  Wink

5. Quote:
I could see it doing this during an install, but had no idea it would do this during a normal boot.

I speculate that W2K checks MBRs each and every time its starts up and will write to a disk's MBR if no "signature"  is found. (At least, I think I have proven that this is the case when W2K is run off a disk partition....but, as I mention in a above point, I'm still not sure about what an instance of W2K running from the installation CD does).

6. Quote:
Everytime I install a new disk, I see W2K says, "Installing your new hardware", so I know it knows the difference between new & old disks, even tho the new one may be the exact same make & model & partitioning the same as the old one. Then it requires a reboot.  When it sees it, maybe it rewrites its MBR?

According to the revised "KangRadian" theory, W2K should write to the disk's MBR because, being a new disk, there is no signature in the MBR.

7.  Plausable explanation for what occurs in step 3 of the test:
- W2K begins to load and performs a check: "am I booting up from the correct disk?"
- looks at disk 1's MBR signature -> disk 1's MBR signature indicates that it is the boot disk
- W2K continues boot from the disk 1 (loading files and initializing system resources)...
- gets to disk 2 -> looks for MBR signature, but doesn't find one
- W2K writes to disk 2's MBR, giving it a non boot disk signature (and this step will require a reboot to properly configure the disk --- just like what you have to do after changing anything with Fdisk!)

Plausable explanation for what occurs in step 6 of the test:
- W2K begins to load and performs a check: "am I booting up from the correct disk?"
- looks at disk 2's MBR signature -> disk 2's MBR signature indicates that it is a non boot disk
- W2K thinks that crucial files (like the page file) are not on disk (the only one in the system)
- loading of necessary files and initializing system resources is halted

Sketchy explanation for what occurs in step 11 of the test:
- (Recall, the Step 7 reformat wipes disk 2's MBR clean)
- W2K begins to load and performs a check: "am I booting up from the correct disk?"
- looks at disk 2's MBR signature -> disk 2's MBR has no signature

Stop.  Now this is where the conjecture gets a little fuzzy, but it still flows from a logical perspective and I will do my best to convey this...just keep in mind the "I think, therefore I am" idea...

Perhaps no MBR signature is good enough for W2K.  Obviously, if there is a "boot disk signature" W2K proceeds, and I believe I have illustrated that if the disk gives a "non disk signature" things will come to a halt (at least in a case, where there is only the single disk in the system).  But in a case where W2K gets nothin' back from the disk, its got to be saying to itself, "well I started from somewhere, and that somewhere is got to be here!", and so proceeds to look for the necessary files from its source.....Thus, what I am proposing is that W2K will respond accordingly to three possible disk MBR variables: [boot disk, non boot disk, no signature]=[boot from source, look elsewhere, boot from source default].   In this light, I see W2K as being a blindly obedient but philosophical OS.   

Anways, I would hazzard a guess that disk 2 gets its MBR written too dynamically by W2K on the fly.  Are you buying into it?  Logically, I think it makes sense. 
 
 
IP Logged
 

Citizen_Kang
Radmeister
**
Offline



Posts: 53


Back to top
Re: Sysprep v1.1
Reply #21 - Nov 14th, 2002 at 2:29am
 
Chessey Analogy:

In football you have a certain number of players (disks) on your team.  You can choose anyone of your players for a certain position, but hopefully you will select them based upon their natural suitability for such roles as a wide reciever, lineman...(boot disk, storage disk...).  However, the rules of the game also stipulate that certain functions such as pass recieving (booting) are only allowed to be performed by an eligilbe player.  A player's eligibility for a certain positiion/function is signified by their jersey number assignment (MBR)...

Continuing this analogy with my little proof from the above post:

In step 3, disk 1 has already been assigned as a wide reciever (boot disk) and its eligibility for this role has been denoted by writting 81 on its jersey (MBR = boot disk).  Disk 2 then enters the game and is assigned as a lineman, and its jersey is given an appropriate jersey No.56 (MBR = non boot disk).  So then, after step 6, the play starts up but the OS referee sees that you just threw the ball to your lineman...."Wow wow wow", cries the OS as it throws its flag onto the field.  The outcome of its proceeding call is obvious, "Ineligible reciever on the play...", the play is called back and you don't get to boot.  And you can try this play as many times as you like, but the OS will catch you for the infraction everytime.  Simply, you won't be able to use this lineman as a reciever until you make him eligible by changing his jersey number (MBR)....it doesn't even matter that your usual reciever has been sitting out on the sidelines during the play (disk 1 is unattached)...its all about the number (MBR) assignment that the players were given when they entered the play.

Okay, its not the most perfect analogy because W2K acts as the coach, rules of the game, and the referee enforcing the rules....judge, jury, and arbitrator I suppose.  Also the football analogy could be refined a bit, but I'm sure you get the picture.

I (purely) speculate that W2K likes to operate/play within a clearly defined environment and set of rules, and so assigns each disk a specific role at the time it is entered into the system...that assignment comes in form of a MBR signature.
 
 
IP Logged
 
Citizen_Kang
Radmeister
**
Offline



Posts: 53


Back to top
Re: Sysprep v1.1
Reply #22 - Nov 14th, 2002 at 12:20pm
 
So I've started looking around for some support to the modified KangRad theory.  Just doing a google search on the MBR right now.  From this, check out this highlight from what this guy discovered:

"* Although I'd still like to know exactly how these mystery bytes are used by the Windows OS, their meaning is no longer a mystery to me. Rather than looking for answers on the Net, I simply started doing some tests on my own hard drives. In a short time, I came up with all the data I needed to remove the mystery. Most people think the same six bytes are always written to everyone's hard disks at these locations. NOT true! I purposely used a string of ZERO-bytes in the diagram above, because that's how they're hard coded in all the FDISK.EXE utilities for Win 95B, 98, 98SE and ME. As a matter of FACT, if you use FDISK from one of these OSs with the /MBR switch on any drive, all of its original "mystery bytes" will be overwritten with zeros! The FDISK program never writes anything but zeros to these locations. So, what does change these bytes? The Windows OS itself (most likely some little routine burried deep inside a .DLL file) changes the last four of these six bytes!

After discovering this, my first guess was that these bytes might be used during the initial OS setup to let Windows know if it has ever been booted for the first time. But it seems really odd that it keeps looking at these bytes in the MBRs every single boot-up! At some point during the booting of the Windows GUI system, it looks at these six bytes on each drive, and if they are all zeros, it changes the last four bytes to reflect the MBR's drive number and the current time when these bytes are written:"


That, my friend, is what I call pay dirt.  Obviously this little phenomenon is not limited to the NT OS's but is a Windows trademark characteristic.

Cheers, CK
 
 
IP Logged
 
Citizen_Kang
Radmeister
**
Offline



Posts: 53


Back to top
Re: Sysprep v1.1
Reply #23 - Nov 14th, 2002 at 12:47pm
 
The modified KangRad gets modified:

Quote:
Does reformatting wipe the MBR?

Not exactly.  I believe just the 6 byte "signature" in the MBR that the OS reads from (and writes to when needed) gets written over with zeroes during the format process.  

CK

PS. This should be obvious to even the most dimwitted individualwho holds an advanced degree in hyperbolic topology  Wink
 
 
IP Logged
 
ketamine
Dude
*
Offline


I love YaBB 1G - SP1!

Posts: 12


Back to top
Re: Sysprep v1.1
Reply #24 - Nov 28th, 2002 at 7:15am
 
Talk about being at the right place at the wrong time... actually im just a few hours late from visiting here coz I think if got to know about Sysprep v1.1,  it might've saved me the trouble of reinstalling the OS on drive C: coz CleanSweep has this thing of unistalling everything in the program files directory when u uninstall an app THAT u installed while running several windows(or tasks) at the same time.  I finished the OS install just a couple of hours ago.

If only i got here sooner...  Sad
 

Destiny Cable and ISP sucks
 
IP Logged
 
Pages: 1 2 
Send Topic Print