[vox-tech] rescuing winxp? (resolved)

[Rick Moen]

Quoting Peter Jay Salzman (p at dirac.org):

> One of the things I was considering before the inspiration of looking at the
> boot flag hit me was to use Partition Magic to shave off a bit off the D
> drive to form a new partition, and use Knoppix to install lilo.
> 
> And then let lilo boot XP.   :)

You probably already realise this, but please let the pedant do his
thing, here:   ;->

_Technically_, I'm pretty sure lilo (unaided) cannot boot XP, because
there's some dark magic that has to get done in loading the NT kernel
and associated claptrap that lilo doesn't know how to do.  However, you
can have lilo load sector zero of the filesystem where NT lives, and
thereby transfer control to NT's OS Loader, which in turn _does_ know 
how to start NT.

> I didn't know the numbers, but I'm thinking maybe this is something I should
> either memorize or write down.  Let me see if I get this straight.  At the
> beginning of the hard drive:
> 
> 
> bytes         offset       Description
> 
> 1   - 446     0   - 445    MBR / zeroth order boot loader
> 447 - 510     446 - 509    partition table
> 511 - 512     510 - 511    NT Disk Administrator flags

Exactly right.

> On Linux, are the last 2 bytes unused?

To my knowledge, no.

> Most systems default to 1024 byte blocks, right? 

512 bytes.  The above is all of sector zero.

(You may be think of SCSI data-handling, which I vaguely recall tends to
be in units of 1024 bytes.  But I may be misremembering, myself.  Like,
maybe that's 4096 bytes?  Can't recall.)

> Also, I should know this at this stage in the game, but how can I use dd to
> make a backup of just the 64 bytes of the partition table?

You know, I used to widely recommend exactly that, and got flamed for
it, so I'm going to say "Yes" but be cagey about it.  ;->

1.  It is potentially extremely useful to, say, do
# dd  if=/dev/hda of=satan-mbr-2004-09-24.img  bs=512  count=1
...and put that file on a FAT-formatted floppy or CDR or flash drive,
carefully visually labelled as to date.  Why?  Because, if you ever do
something that clobbers your partition table, booting a maintenance disk
and dd'ing the contents back to /dev/hda can instantly save your ass.
However:

2.  Beware of restoring an _outdated_ partition table, which would be
somewhat worse than useless.  

The possibility of the 446-byte program space portion being outdated is 
less worrisome, because whatever first-stage bootloader you put there
(nameless Microsoft code, first state of lilo, first stage of GRUB,
whatever) is easily replaced.

Ancillary note for other readers:   As if the foregoing wasn't
complexity enough, other boot schemes aside from the one described are
possible on x86 architecture -- e.g., the BSD/Solaris "slice" aka
"disklabel" scheme.  The above-described map of sector zero, and the 
familiar four-entry partition table characteristic of the IBM/Microsoft
boot scheme, simply aren't present in those cases.