Read/Edit Hard Drive Details

IMPORTANT NOTES RE VISTA AND EFI BIOS: There are many anomolies that apply to (a) Vista and the way it treats both HDD geometry and the boot process - as well as (b) how EFI based BIOS will affect this area as they become more commonplace. There is much good information about such issues in general and multibooting in particular at the Goodells Site and with particular respect to Vista at the Multibooters Site. There is also a Microsoft paper ' Boot Configuration Data (BCD) in Windows Vista' and ' The Windows NT 6 boot process' which are both, for those interested in this area, worth reading.

In short we advise "multibooters" to only let Vista partition a drive that it will use exclusively - otherwise use 3rd Party or legacy partitioning methods. For an example of just why, see MSKB 931854. Vista is probably moving towards the day when drives may have the current sector size of 512 bytes increased to 4096 bytes (4kB). Vista has changed the "Hidden Sectors" legacy value of 63 (one track) to 2048 (1 MB) when it does the partitioning, even though it will happily use legacy-formatted partitions. Vista's partitions now dont start or end on traditional cylinder boundaries and this can make, for example, WinXP and Vista's partitions invisible to each other.

Introduction and other Misc Programs

There are times when it can be extremely helpful to be able to read, understand, pass on and even edit information relating to one's hard drives, their partitions and other data that they contain. It is often necessary to do this from outside the hard drive in question and typically from another operating system altogether. With the right tools at one's disposal, it is often possible to regain access to an unbootable system or to access/recover apparently deleted data.

The use of a disk hex editor on a boot CD is another approach and we have covered this in some detail on our TinyHexer and BartPE page. A superb and more elaborate program for looking into these murky waters is the shareware WinHex - but this has to be run from a Windows interface. The program TestDisk can also dig out certain basic information and is good at recovering "lost" partitions but is not user-friendly for newbies. The TBU program BiNG, covered on another of our own pages, can also search unallocated space for lost partitions and facilitate the rebuilding of partition tables. The two main PowerQuest utilities and some other utilities are described in greater detail below.

The RAMdrive in the compiled boot floppies was obtained from The TBU Knowledgebase. You may well want to edit the autoexec.bat file to customise it for you own use. The TBU link and the ramdrive.zip download have instructions on how to modify the use of XMSDSK should that be desired or needed.

PartitionInfo

If you haven't used one of the utilities mentioned in the Quick Start to make a bootable medium, you can still download and unzip the stand-alones PartIn9x.zip (for Win9X/ME) or PartInNT.zip (for Win2K/XP and "Vista-ish") as well as partinfo.zip (the DOS version which only gives a text output). The Windows GUI has more or less run OK from Vista. We did experience some problems displaying all the information in its Windows but it did correctly display the correct text output when previewed or saved as a file.

Fig 1.

Two basic sorts of information may be displayed, copied, printed, etc. Firstly there is the sort of information shown in Fig 1, which is fairly straightforward and is a translation of the information in the partition tables found in the MBR and in each Logical Partition's EPBR scattered throughout the disk. Secondly there is the information relating to any specific partition's boot sector. If specific partitions are highlighted in the upper window then clicking on the [Boot Record] button will open a secondary display outlining the relevant translated metadata contained in its PBS as shown in Fig 2. for the C: drive highlighted in Fig 1. The various FAT and NTFS partitions will show on slightly different templates from one another.

Fig 2.

If you really want to edit the PBS without having to edit the hex with a hex editor then there are a couple of fairly easy ways to do this. One is with WinHex's Boot Sector Template (accessed as per Fig 3 after the relevant "logical drive" has been opened - such as C: in the above example). The opened template looks essentially just like that of the one from PartitionInfo (Fig 2) but is writable. You will need to have actually purchased WinHex for you to be able to do this. Such direct disk-access write functions are disabled while it is just on trial. The second is to use the Boot Sector Template Window from PTEdit as described in the next section.

Fig 3.

PTEdit

As with PartitionInfo, you can either use one of the utilities in the Quick Start or you can download and unzip the stand-alones PTEDIT32.zip (for Windows) or ptedit.zip (for DOS) from the Symantec public FTP folder. When the application is first opened (as in Fig 4) you should see four main lines of values. Each line is translated from the corresponding 16bytes of code in the MBR into a comprehensible form for us humans to read (and to edit). Any interim changes one makes appear in red until the changes are saved/written to disk. Don't save any such changes UNLESS YOU REALLY MEAN IT and know what you are doing. If you have more than one hard drive or array in your system ensure that you choose the correct one in the drop down list at the top. We recommend that you write down any original values on a piece of paper before committing any changes to disk; it will only take you a moment or two.

Fig 4.

Familiarisation and Usage

• Putting the cursor in any of the four rows allows the basic Partition Information to show up. If the cursor is in the Type Box then [Set Type] should become available and the actual type can be displayed/edited. If the type is a formatted partition (not an Extended or an ExtendedX partition) then the [Boot Record] button should become available. Clicking it should open a record just like that in Fig 2 (from Partition Info) but also with a second [Write] button. The Boot Menu template window can be edited in the same manner as the main PTEdit Window and the changes written/saved to disk if that is what is wanted. The Type ExtendedX (0F) may show as just one entry out of these four primary partitions. The type Extended (05) shows as one of the two entries in each EPBR (except the last one).
• The Boot values can set a Partition as Active; that is the partition that the MBR will attempt to boot up. There are only two possible values 80 and 00. 80 (which is the hexadecimal value for 128) marks the partition as active. Only one partition should ever be active at one time and an extended partition should never be marked as Active. 80h (128) is, incidentally, often the legacy designation for the first enumerated hard drive. The second being 81h (129) and so on. In the example shown the second partition table is the Active partition; a 10gig NTFS partition as it happens.
• One moves on or back through the "daisy-chain" of logical partitions by choosing the [Goto Parent] and [Goto EPBR] buttons. Each EPBR (Extended Partition Boot Record) is very, very like the MBR in its structure and in particular regarding its partition tables. These records are spread around the hard drive and each one is referenced from the previous one and marks the start of a new logical partition. They all (except the last one which only has one record for itself) contain two records; the first to find its own boot sector and the second with which to find the next logical partition in the chain. Putting the cursor in the first record of each logical/EPBR record allows the [Boot Record] button to become available to allow viewing/editing of its boot sector. The third and fourth rows are not used in EPBR partition tables. The first table's hidden sectors standard value has been 63 for a very long time. Vista creates 2048 hidden sectors! which is one of the reasons for partitions going missing when multibooting another OS and Vista.
• Idenifying sectors on a hard drive is done in legacy fashion by CHS (Cylinder/Head/Sector) values and also by LBA (Logical Block Address) values. The last two boxes in each row are the LBA values and on modern systems these are basically the only values that need concern us. In Fig 4 it will be seen that the CHS values in most of the records have the same values; start values of 1023/0/1 and end values of 1023/254/63. These are actually meaningless values but need to be there for legacy reasons even though legacy software wont be able to make use of them. Once a partition is beyond the 8.4 gig point it is beyond that legacy threshold and so most partitioning software will insert these values rather than fill them with zeros or something else. One anomaly with CHS values worth noting is that the first sector is sector 1, whereas the first sector with LBA is 0. To exemplify much of this you can open the boot record of a primary partition and read the value in the title bar of the template window. In Fig 2 above you will see that it reads "Starting Sector 64260". This is actually the 64261st Sector and this is confirmed by the "Sectors Before" value of that same record in its Partition Table record entry which reads 64260 sectors before.
• There is a potential nasty "gotcha" in the EPBR records because, unlike the MBR records, the "Sectors Before" values don't refer to the very start of the hard drive. This can be demonstrated by going to an EPBR and reading its "Sectors Before" values. The first table's value is a reference from the start of the same partition and the second table's value is different once again by being referenced from the start of the the extended partition proper. It gives the distance to the next logical partition in the daisy chain (from the beginning of the extended partition). If you now go to that partition's own boot record you can see that the Boot Sector's Title bar gives a very different (and absolute) LBA value of just exactly where on the the drive that sector begins. The boot sector itself also stores these "Sectors Before" values (which are called "Hidden Sectors" when viewed in PTEdit's boot sector template). One of the "tricks" to make Windows capable of being booted directly from logical partitions is to edit this PBS "Hidden Sector" value from 63 to its absolute value. The value (usually 63) in the EPBR should always be left unchanged. If multibooting is your prerogative then you can read further about this on Goodells excellent page and use the back button at the end of that page to take you the body of the subject there.
• Another area of great confusion can be caused when the partition tables are not in the same order as the physical positions of the partitions on the drive. Both the primary and the logical partitions "normally" mirror the order of the same partitions that they reference. BUT IT IS NEITHER MANDATORY NOR UBIQUITOUS for then to do so. Legacy BIOS couldn't care a jot what the order is but NT and Linux OSes care a great deal and so changing the order (but not the content) of partition tables can cause such systems to fail to boot. We have gone into this in greater detail (including examples) on our Partiton Referencing Page.

Manual Editing, "Zeroing" and Backup using PTEdit

• PTEdit has some very easy-to-use as well as some very powerful functions and although one can back-up the primary partition tables' information by simply backing-up the MBR this doesn't back-up the information in the EPBRs of any logical partitions. To keep all of this information backed-up either simply write down the values (especially the LBA values) on paper or store the output from the PartitionInformation  utility  somewhere  off-line. We particularly advise that you write down the values of any records that you intend to manually edit. If everything goes belly-up after you reboot you can then re-access PTEdit from another drive or CD or diskette and simply manually write the original values back in. That is one of the beauties of PTEdit; you are given manual control of it.
• Any records in the MBR, the EPBRs and the boot sector templates that you do edit turn from black to red before you commit those changes to disk. The point to emphasise is that if nothing else is written to the hard drive in the interim, any changes made to the partition tables will not affect any of the data or metadata on the hard drive.
• If you want to quickly "effectively zero" a hard drive then all you need to do is to change all the values in the main partition table to zero. The BIOS will now find neither an active partition nor any partition tables so DOS, Windows and Linux will treat it as a new hard drive and want to rewrite new boot code to the MBR as well as to partition and format the drive for normal use. This is not a method for removing a boot sector virus and boot managers that have information on the EMBR (the remaining 62 sectors of track 0) such as BootIt-NG will usually be capable of reinstalling themselves and the original MBR.
• Multi-booting geeks who don't want to use any third party tools nor use any logical partitions use PTEdit in this way to access and use any number of primary partitions. They keep a written-down ledger of the entries they have made to ensure that none of the partitions nor their LBA values overlap. A primary partition is then created anywhere on the drive, marked active, formatted and an OS installed onto it. They then rub-out all its partition table values with PTEdit and repeat - using, of course, another "virgin" area of the drive. In this way they can install any number of primary partitions but have to go through the bother of backing-up and restoring each new MBR to boot the different OSes or to manually edit the values back to the correct ones using PTEdit.

HD_Tune

HD Tune comes in both Pro and Free Versions. There are some screenshots on the webpage that give you a good idea of its interface. It is a generic hard drive tester, performance analyser and information gatherer. The most comprehensive analysis will be from internally connected IDE or SATA drives not configured into any RAID, since for such drives it can dig out much information directly from the drive's firmware. It can access RAID volumes as if they were "hard drives" and can access drives in USB enclosures - but the listed information will not be as complete. At this time we have only used the free version. Using a hard drive manufacturer's own diagnostics (most of the big names except for Toshiba provide them on their websites) from another boot medium, other that the hard drive, may be wise if you think your drive may be compromised or is inaccessible by normal means.

HD_Info

HD Info is a trialware windows utility from 48bitLBA.com. It provides less information than HD_Tune and only shows information about internally fixed IDE drives. It has certain limited uses in determining whether a motherboard or hard drive controller card supports 48bit LBA.

Appendix 1. Links to Hard Drive Maker's Diagnostic Utilities and Hard Drive Tools.

• Fujitsu
• Hitachi and IBM
• Maxtor and Seagate
• Samsung
• Toshiba; (no direct utilites so maybe try the Hitachi/IBM ones or a generic test such as the Windows program HD_Tune or the rather expensive and elaborate HD_Tool SpinRite).
• Western Digital

Appendix 2. What is a partition table and what does it look like?

Specific areas of hard drives have different uses and one such area is known as a partition. Partitions come in different formats but also need to be capable of having their boundaries defined. These definitions are stored in what are called Partition Tables. A normal MBR (or EPBR) contains four such tables with each having 16 bytes of information written within the 512 (0-511) bytes of its hexadecimal offsets 1BE-1CD, 1CE-1DD, 1DE-1ED and 1EE-1FD (or in decimal 456-461, 462-477, 478-493, and 494-509) respectively.  If  we examine just the first one with a hex editor it could have the following appearance:

Offset       0  1  2  3  4  5  6  7   8  9  A  B  C  D  E  F

0000001B0                                              00 01                 ..
0000001C0   01 00 04 FE 3F 03 3F 00  00 00 C5 FA 00 00         ...þ?.?...Åú..

If we just look at these sixteen bytes in a row they have the following sequence:

00 01 01 00 04 FE 3F 03 3F 00 00 00 C5 FA 00 00

It is possible to show exactly how these translate into values that are meaningful to us humans (TheStarman and others on the web will show you how this is done if you really want to find out but it involves reversing some sequences and using only parts of some of the bytes). The four-byte "d-word" for the number of sectors in the first partition is obtained by first reversing its sequence of bytes on disk from "CF FA 00 00" to the hexadecimal number "00 00 FA CF". The leading zeros are dropped and one can then quite easily convert the hexadecimal number FACF to the decimal one of 64197, using a calculator. The translated output of this whole example is shown in Partition Table 1 in Fig 5. It actually references a non-active 31MB FAT16 partition at the start of a hard drive. PTEdit (Fig 4) has the same values but with the columns in a slightly different order. Fig 5 shows the entries in the same sequence that they are written in the partition tables. Excepting when legacy geometry is needed on old systems, the CHS values become virtually meaningless once the 8.4 gig threshold is traversed and when all CHS values then begin with "1023 Cylinders".

Fig 5: (MBR = LBA Sector 0).

"Hidden Sectors" is a synonym for "Sectors Before". These are sectors that span a defined area prior to any partition's actual PBS. Primary partitions define it from the start of the hard drive. A logical partition's first partition table defines it from its own EPBR and its second partition table (when there is one) is a reference from the start of the containing extended partition to where the next logical partition's EPBR will be found. Confusing? Indeed it can be!

Fig 6: (1st EPBR = LBA Sector 20547135 ).

The first of three logical partitions within the extended partition (referenced by Partition Table 3 in Fig 5) is shown in Fig 6. The first partition table references its own PBS and the second one references the next EPBR in the daisy chain. The next EPBR is displayed in Fig 7.

Fig 7: (2nd EPBR = LBA Sector 30732345).

The middle one of three logical partitions is shown in Fig 7. It is referenced from the first logical in Fig 6 and is itself referencing the third one in Fig 8.

Fig 8: (3rd and last EPBR = LBA Sector 45078390)

The last of these three logical partitions is shown in Fig 8 and so only references its own PBS. Each EPBR's partition tables are in the same position as those in a standard MBR and have the same general structure. The rest of the EPBR does not normally, unlike the MBR, contain any bootstrap code.