Sign in to follow this  
PhilGURU

Revealing Hidden Partitions

Recommended Posts

Conrats Sivar on the first "5" post on a slashdot article! You 'da man!

Share this post


Link to post
Share on other sites
I don't normally post on SR, but I tried it and it appears to work.

i don't normally go to mcdonald's, but make sure to go there this weekend! i'll be selling my own food in the parking lot.

Did you actually read what I wrote on SF, honold? Let me re-iterate for you:

Unlike 99% of the people who are talking about this, I have actually tried it. I used a 20GB drive. It turned into a "30GB" drive. My initial disk load was around 90% of the capacity of the 20GB drive, and when I was done, I loaded ~10GB of AVIs.

I played the AVIs (which are sensitive to data corruption), booted the drive, played some games, and played the AVIs some more.

If data is being corrupted, I haven't encountered any errors from it yet. That doesn't mean I don't believe it isn't happening, just that I have yet to find any evidence of it.

Someone with a 500MB drive with Windows 98 loaded on it would have a much better chance of finding said corruption.

While I'm at it: it takes about 10 minutes to ghost a working windows install, about a minute to boot up, 15 seconds to start ghost, 15 more seconds to switch the drives, another minute to boot again, and maybe a minute to start disk management and check the drive capacity. You guys who have some old, crappy disk laying around can try it for yourself in about 15 minutes. That's what I did.

Share this post


Link to post
Share on other sites
I have a feeling that some sort of compressing is used, it would be interesting to see a full compressed disk being cloned by ghost to a new target . ;)

Yepp, I've checked it to be 5:2 compression on

ANY randomized data ; )

/casa

Share this post


Link to post
Share on other sites

This is simply futzing around with the partition table. No extra space gained. Long gone are the days of getting 10% more space magically by adjusting the drives interleave with spinrite.

Thank you for your time,

Frank Russo

Share this post


Link to post
Share on other sites
By the way rfarris, apparently I used your example in a post on that same sight. I hadn't even read this thread until the /. article reminded me of this topic, but you posted it first, so you can keep the copyright. :)

I have an example? You mean the areal density thing?

-- Rick

Share this post


Link to post
Share on other sites
Did you actually read what I wrote on SF, honold? Let me re-iterate for you:

Unlike 99% of the people who are talking about this, I have actually tried it. I used a 20GB drive. It turned into a "30GB" drive. My initial disk load was around 90% of the capacity of the 20GB drive, and when I was done, I loaded ~10GB of AVIs.

I played the AVIs (which are sensitive to data corruption), booted the drive, played some games, and played the AVIs some more.

If data is being corrupted, I haven't encountered any errors from it yet. That doesn't mean I don't believe it isn't happening, just that I have yet to find any evidence of it.

Someone with a 500MB drive with Windows 98 loaded on it would have a much better chance of finding said corruption.

While I'm at it: it takes about 10 minutes to ghost a working windows install, about a minute to boot up, 15 seconds to start ghost, 15 more seconds to switch the drives, another minute to boot again, and maybe a minute to start disk management and check the drive capacity. You guys who have some old, crappy disk laying around can try it for yourself in about 15 minutes. That's what I did.

Given the above explainations, I would say that 10GB of your original data is corrupt. You have been checking the wrong data (yes I know you checked some of it, but not all of it). The new 10GB of avi's should be fine of course. Given that you can no longer check this drive with any disc apps is also a strong indicator that it is buggered.

I am now most interested if you can at all recover the drive to original condition.

Share this post


Link to post
Share on other sites
Long gone are the days of getting 10% more space magically by adjusting the drives interleave with spinrite.

Yep, I agree and add.. And also long gone the days of getting 60% more space by using a MFM drive hooked to a RLL controller.. I did this in '86 with an original 10Mb disk to get 16Mb!....

Share this post


Link to post
Share on other sites

Merc,

If you read my posts above I think you'll see that I agree with you that with some drives you could access more capacity. Possibly...

This only works with drives that have unused platter space. I.E. they have been shortstroked by the manufacturer to meet a certain capacity point.

However, the inner data could easily be used by the manufacturer to remap bad sectors (most commonly) or to store crucial drive information (like firmware, especially updated firmware).

Do well.

Jonathan Guilbault.

Share this post


Link to post
Share on other sites

PS.

I've read your post elsewhere and I agree that you seem to have pulled it off successfully.

Do well.

Jonathan.

Share this post


Link to post
Share on other sites

Of course the only way I can see it physically working is with short-stroked platters.

I wonder if you could post the actual model number of the drive you're using. Here or there...

Share this post


Link to post
Share on other sites

Even then I dont think it would work gilbo. This method described in the article uses a partitioning trick. You're at the wrong level of the "storage model". The drive knows it's last sector and hence it's total capacity. This number is programmed into the drive and can be changed, but not through partitioning.

I suspect if your partition went from sector 0-1,000,000 on a drive with only 500,000 and you tried to access past sector 500,000 that the drive would return an error.

This partitining trick probably specifies that the 1st partition goes from say sector 0-1,000,000 and partition 2 goes from sector 100-1,000,000 and so on, so that it never goes beyond the bounds of the drive.

This could easily be determined by using a partition manager that can show the actual data without sugar coating/simplifying it... for instance the ranish partition manager.

Share this post


Link to post
Share on other sites
This could easily be determined by using a partition manager that can show the actual data without sugar coating/simplifying it... for instance the ranish partition manager.

Could anyone who's done the Stupid Ghost Trick download findpart and report what findpart tables outputs? That should settle it.

Share this post


Link to post
Share on other sites

Well I won't be making any judgements on whether this is possible or not, but I will be doing a *comprehensive* test on this probably Saturday or Sunday (unless someone else beats me to it...). Now if only someone could guide me to a copy of Ghost 2003 Build 2003.775...

BTW - test will be on both one short-stroked and one non-short stroked drive, with proper CRC checks, and filling the entire drive. Only problem will be the four hours taken to fill a 160GB drive and another to verify it all again... hmpf,,,,,,,,,

Share this post


Link to post
Share on other sites

Blakewry,

Personally I agree with you entirely. Especially when you point out that you shouldn't be able to un-shortstroke a drive because it's firmware is coded that way. As you say, all this technique does is mess with partition tables.

I was really only trying to point out that it's physically possible in a only a couple rare cases.

Of course Merc's findings posted elsewhere, while initially supporting the claim, seem now to debunk it --in his latest post. His findings were the only reason I thought it might be possible. I am currently satisfied on the processes ridiculousness.

Do well.

Jonathan Guilbault.

Share this post


Link to post
Share on other sites

I have performed this procedure on a 40 gig WD hard drive. Windows 2K shows 2 partitions more or less doubling the drive space. Both partitions are usable, however I have not done enough testing to determine if they are in fact seperate partitions and not a goobered partition table. I have performed findpart and here are the results, though I don't know what it means. Any help with this info would be appreciated.

Findpart, version 4.41 - for Windows 95/98/ME/NT/2000/XP.

Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: Windows 5.0.2195 Service Pack 3 All

Disk: 1 Cylinders: 782 Heads: 128 Sectors: 63 MB: 3079

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS

0 - 0B 63 6297921 3075 0 1 1 780 127 63 B OK

153 1 0B 63 5072193 2476 153 1 1 781 127 63 OK OK

0 - 07 63 6297921 3075 0 1 1 780 127 63 BU OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB

0 1 33 6139 4* 2 6139 0 0 0 020710 1414

153 1 33 4949 4 2 4949 0 0 0 971231 918

Partitions according to partition tables on first harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS

0 1*0B 63 6297921 3075 0 1 1 780 127 63 OK OK

Disk: 2 Cylinders: 4865 Heads: 255 Sectors: 63 MB: 38162

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS

0 - 0C 63 78156162 38162 0 1 1 4864 254 63 B OK

1 1 07 63 78124032 38146 1 1 1 4863*254 63 OK OK

0 - 04 1076355 16065 7 67 0 1 67 254 63 B OK

0 - 07 1092420 77063805 37628 68 0 1 4864 254 63 B OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB

0 1 33 9540 32* 2* 6511 0 1575 1454 492

67 0 2 32 1 512 32 0 0 0 020710 2

67 0 34 Second FAT not found.

Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS CHS

0 1 0F 16065 78124095 38146 1 0 1 4863*254 63 OK

0 2*07 1092420 77063805 37628 68 0 1 4864*254 63 OK OK

1 1 07 63 78124032 38146 1 1 1 4863*254 63 OK OK

Share this post


Link to post
Share on other sites

I took the liberty of cleaning it up for him.

Findpart, version 4.41 - for Windows 95/98/ME/NT/2000/XP.
Copyright Svend Olaf Mikkelsen, 1999-2004.

OS: Windows 5.0.2195 Service Pack 3 All

Disk: 1  Cylinders: 782  Heads: 128  Sectors: 63  MB: 3079

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS  CHS
   0 - 0B 63       6297921   3075    0   1  1 780 127 63  B   OK
 153 1 0B 63       5072193   2476  153   1  1 781 127 63  OK  OK
   0 - 07 63       6297921   3075    0   1  1 780 127 63  BU  OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0      1 33  6139  4*   2    6139   0      0     0   020710 1414
153    1 33  4949  4    2    4949   0      0     0   971231 918

Partitions according to partition tables on first harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS  CHS
0     1*0B 63       6297921   3075    0   1  1 780  127 63 OK  OK

Disk: 2  Cylinders: 4865 Heads: 255  Sectors: 63  MB: 38162

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS  CHS
   0 - 0C 63       78156162 38162    0   1  1 4864 254 63 B   OK
   1 1 07 63       78124032 38146    1   1  1 4863*254 63 OK  OK
   0 - 04 1076355  16065        7   67   0  1   67 254 63 B   OK
   0 - 07 1092420  77063805 37628   68   0  1 4864 254 63 B   OK

-----FAT CHS -Size Cl --Root -Good -Rep. Maybe --Bad YYMMDD DataMB
0      1 33   9540 32*  2*    6511  0     1575  1454        492
67     0 2      32 1   512      32  0        0     0 020710 2
67     0 34  Second FAT not found.

Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS  CHS
   0 1 0F 16065    78124095 38146    1   0  1 4863*254 63 OK
   0 2*07 1092420  77063805 37628   68   0  1 4864*254 63 OK  OK
   1 1 07 63       78124032 38146    1   1  1 4863*254 63 OK  OK

Share this post


Link to post
Share on other sites

For those who missed my previous post:

Testing has been done elsewhere and confirmed that there was unpredictable file corruption.

Do well.

Share this post


Link to post
Share on other sites

Partitions according to partition tables on second harddisk:

-PCyl N ID -----Rel -----Num ---MB -Start CHS- --End CHS-- BS  CHS
  0 1 0F 16065    78124095 38146    1   0  1 4863*254 63 OK
  0 2*07 1092420  77063805 37628   68   0  1 4864*254 63 OK  OK
  1 1 07 63       78124032 38146    1   1  1 4863*254 63 OK  OK

This shows two overlapping partitions, Cylinder 1-4863 and 68-4864. The first 500MB of the first part would seen no corruption.

Note that findpart correctly reports 38GB as the size, but disk managment has a bug because it shows more.

Share this post


Link to post
Share on other sites

Here is the conclusive answer!!! I started over with an 8 gig drive, after the ghost procedure I was left with a 7.85 gig partition(the original) and a 6.18(supposed hidden partition) gig partition. I filled the 6.18 gig partition with one video file, the video file played without error. I then filled the 7.85 gig partition with various zip files, once complete I could no longer access the video file on the 6.18 gig partition. THIS PROCESS DOES NOT WORK. All is not lost with the hard drive. If poth partitions are deleted, the "hidden" partition dissapears and the original partition is available for creation. Once formated it works fine.

Share this post


Link to post
Share on other sites

:rolleyes:

:ph34r:

:blink:

Anyone with moderate knowledge of harddrives and partitioning should have figured the answer half way reading the 'article'. Come on Double Space with Every hdd? About as likely as sun going supernova.. if you get what i mean

Share this post


Link to post
Share on other sites
About as likely as sun going supernova.. if you get what i mean

IIRC, it's not massive enough, is it? I can't be bothered to find out what the minimum mass for a star to (eventually) go supernova is, and whether our sun is heavy enough, but I recall that it's not big enough to do anything really exciting when it dies, in another 5 billion years or so.

Share this post


Link to post
Share on other sites

And yes, pedants, I shouldn't have used 'heavy' in that context. You know what I meant.

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

Sign in to follow this