[Gllug] Extremely strange disk imaging problem.

[Chris Bell]

On Fri 21 Jan, James Courtier-Dutton wrote:
> 
> On 20 January 2011 14:58, general_email at technicalbloke.com
> <general_email at technicalbloke.com> wrote:
> >
> > Fdisk output before:
> >
> > Disk /dev/sde: 320.1 GB, 320072933376 bytes
> > 255 heads, 63 sectors/track, 38913 cylinders, total 625142448 sectors
> > Units = sectors of 1 * 512 = 512 bytes
> > Sector size (logical/physical): 512 bytes / 512 bytes
> > I/O size (minimum/optimal): 512 bytes / 512 bytes
> > Disk identifier: 0x00000000
> >
> >
> > Fdisk output after:
> >
> > Disk /dev/sde: 78.5 GB, 78518522880 bytes
> > 255 heads, 63 sectors/track, 9546 cylinders, total 153356490 sectors
> > Units = sectors of 1 * 512 = 512 bytes
> > Sector size (logical/physical): 512 bytes / 512 bytes
> > I/O size (minimum/optimal): 512 bytes / 512 bytes
> > Disk identifier: 0xe686f016
> >
> >
> 
> Now, I assume that you are happy to wipe all the data on this new
> 320GB HD as way to test.
> If not, do NOT try this test.
> 
> My guess is that there are multiple partition table types and the
> partition table that you have copied from the old HD is limiting the
> size of partitions.
> Try erasing the first sector on the 320GB HD, and thus wipe its partition table.
> 
> Take a backup of the first sector first.
> dd if=/dev/sde of=mbr-backup.dat bs=512 count=1
> 
> dd if=/dev/zero of=/dev/sde bs=512 count=1
> 
> Then see what fdisk says.  My guess is it will still say 78.5 GB, but
> the test at least demonstrates that the problem has nothing to do with
> the data stored in the MBR or partition table.
> 
> HDs have a programmable feature where you can make a large HD look
> like it has different number of heads, sectors, cylinders etc.
> This is mainly so that you can put new HDs into old machines and the
> old machine can still work with them.
> Think of it as a special "cripple" feature.
> 
> My guess is that you have updated you drive imaging program recently,
> and it has implemented a new feature whereby it "cripples" the HD to
> look exactly like the old one.
> 
> Another possibility could be that it has created a "hidden" partition,
> that is normally used for recovery partitions. It is possible to
> entirely hide these partitions from the BIOS. There are ways to undo
> these "hidden" partition and one program I know that can do it is
> "hdderase
> http://cmrr.ucsd.edu/people/Hughes/SecureErase.shtml
> 


   I am not an expert on this, but I have recently seen that, although the
first sector is generally known as the MBR, the first "track" is normally
undefined, with over 60 sectors ignored by many file systems. These other
sectors are gradually being used by both Microsoft and Linux for additional
boot data.

-- 
Chris Bell www.chrisbell.org.uk (was www.overview.demon.co.uk)
Microsoft sells you Windows ... Linux gives you the whole house.

--
Gllug mailing list  -  Gllug at gllug.org.uk
http://lists.gllug.org.uk/mailman/listinfo/gllug