Do you have a question? Post it now! No Registration Necessary. Now with pictures!
- Posted on
- Nomen Nescio
August 13, 2005, 1:00 am
rate this thread
recall (it was done half a year ago); it was not Norton Ghost.
The OS is Win2K and the BIOS recognizes 200MB drives fine.
The issue is "now what?" Are there some bytes in some sector that I can
find with a disk editor and change them so that the disk will now "know"
its true size? Is there any other fix other than a complete
If I were to clone the present 200GB drive (which thinks it is an 80GB
one) to a third drive, say, a 200GB one, which software would you
recommend to use so that this third drive will not "think" it is an 80GB
And, by the way, this IS a security issue in the following sense: Could
one hide data in the seemingly inaccessible 200-80 GB space, and access
it with some other software? Would Encase see it?
Re: Cloned disk "thinks" it is much smaller than it is.
As a WAG the problem may arise from:
1. Your ghosting, if done in sector-by-sector mode, copied - and later
restored - the "original" partition table. If so, that table will have
"old" information about partition cylinder boundaries, etc. (or the
equivalent re LBA).
2. Some NTFS partitions/drives implicitly contain metadata about the
drive size in the MFT and related structures.
The first is reasonably easy to fix - edit the table directly if you
know what you're doing, or find a partition mamager/resizer that will
handle it (most should?).. I don't have a clue about the second problem
except to know it exists and that there are several Norton Ghost
switches to handle it (e.g., -ntexact, -ntiid, etc.).
- » Possible Remedies Against Anti-Trojan Company DCS re: TDS Program
- — Next thread in » Computer Software Security