[<<]Message[>>]    [<<]Author[>>]    [<<]Subject[>>]    [<<]Thread[>>]

Number   :  4471
Date     :  2003-04-28
Author   :  james sadler
Subject  :  Re: Cloning the WinXP
Size(KB) :  4


 Kan,
This is speculation but I hope you have
tried the Knoppix distro. It's a lovely Linux distro
that lives entirely on a CD. A PC doesn't even need a
hard drive to run Knoppix. The joy of Knoppix is that
Windows file systems that are located on a hard drive
are very transparent to Knoppix. I think if one were
to boot into Knoppix and wished to copy an entire hard
drive's contents to a folder or most anywhere else for
that matter that it would be quite easy. That might be
a very easy way to copy the files that can not be
copied when Windows is running. It also bypasses pass
words with great ease.
--- Kan Yabumoto  wrote:
> Bill:
> 
> Thanks for your reminder that Goeff Hager's post of
> May,2002
> had a lot of interesting material in it (I'm not
> sure if
> I really spent my time reading the message very
> carefully).
> 
> His explanation on how to access the registry files
> without
> a reboot is something quite useful. On the other
> hand,
> I'm not sure about Goeff's assertion that a "FDISK
> /MBR"
> procedure will reassign the physical disk with a new
> partition GUID is applicable to XP's case, or even
> factually
> correct.
> 
> When we examine the system registry data at
> 
> HKLM\SYSTEM\MountedDevices
> 
> we will find two sets of entries. One is listed by
> GUID-identifiers
> and another by the driveletter. The contents of the
> values seems
> identical between the GUID entry and its DriveLetter
> entry counterpart.
> 
> But, I'm not convinced at this moment that FDISK
> /MBR will do anything
> sophisticated as such. For one thing, FDISK is a
> rudimentary 16-bit
> tool which limits its access primarily to the MBR. 
> My understanding
> of FDISK /MBR operation is to initialize the first
> 446 bytes in
> the MBR which is the machine language program for
> bootup. The
> operation would not modify the remaining 66 bytes (4
> entries in
> the partition table plus the signature "AA55" word).
> 
> One interesting that I observed was that the
> contents of the
> registry entry seems to store the partition size and
> the starting
> sector address (an absolute byte-offset value from
> the beginning
> of the partition). We can call it a "signature" of
> the partition
> ---- but only the size of the partition is the
> characteristic
> value that identifies the partition --- the starting
> offset
> is almost always 00007e00 (the 63th sector of the
> drive).
> 
> I will do some more experiments on this.
> 
> BTW, I have written a simple 16-bit tool (I call it
> XXPATCH)
> which patches the various parts of the MBR,
> BootSector, and
> a few other components including the ability to
> change the
> volume serial number --- this may become handy to
> handle
> special tools as you mentioned like Xilinx complier,
> etc.
> I plan to post the utility in the near future.
> 
> 
> Kan Yabumoto
>
=================================================================
> 
> At 2003-04-19 01:33, you wrote:
> >Kan,
> >
> >i had just cloned my win2k server again, but
> somehow i lost the
> >formula. that's when i went searching again, and
> your message 4098
> >was the first i read. i stopped when i got to the
> mention of
> >the "signature" - that's it!! (for my situation)
> >
> >
> >win2k and XP are similar, and i'm no expert, but
> you might benefit if
> >you re-read message number 2157, it's well written,
> quite complete.
> >
> > - here's an excerpt:
> >
> >3) Even if you pull the original physical disk,
> Win2K remembers the
> >previous mapping of drive letters to partition
> GUIDs in the registry
> >(HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices). In
> order to map the
> >cloned partition to C:, you can run 'fdisk /mbr' on
> the physical disk
> >containing the cloned volume, which assigns new
> partition GUIDs,
> >which then forces Win2K to forget the old mapping
> and map the active
> >partition to C: by default, which should then work
> assuming your that
> >your original cloned boot partition was also called
> C:.
> >
> > -
> >
> >it's clear that there's more to making a bootable
> volume than simply
> >copying all the files - at least in an NT-class
> system. win9x is
> >easy by comparison. even when you get it right,
> such things as the
> >volume serial number are used by applications for
> security. MatLab
> >and Xilinx compilers will not run if the vlume
> serial number has been
> >changed...so one has to be prepared to change them
> back.
> >
> >warm regards,
> >bill
> 
> 
> 


__________________________________
Do you Yahoo!?
The New Yahoo! Search - Faster. Easier. Bingo.
http://search.yahoo.com



This message if part of XXCOPY's message Archive.
The archive contains all the messages posted at Yahoo!Groups: XXCOPY.