If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
COLLECTED hard drive usage after XP NTFS
SYNOPSIS:
This is a collected discussion concerning XP hard drive re-use, in which I have personally participated, per [there may be others which I have missed]: " IBM T22 and Win 98se"; " New post, ms Everest report"; " Hangs on POST screen"; " win 98 installation" " Updates for Win9X's & reason/logic" " No hard drive?" " Unable to install Win98 SE" " PC100 v PC133 ram" GENERAL REFERENCE and SEARCH TERMS: XP NTFS hard drives, tools used to test and/or recover hard drives, NTFS recovery tools, forensic tools for analysis of hard drives, securely deleting hard drives, removing XP NTFS from hard drives. Present participants in this technical discussion: Ron Badour, MS MVP for W98; Jeff Richards MS MVP (Windows - Shell/User); Gary S. Terhune MS MVP Shell/User PCR; Franc Zabkar; and myself - Maurice Edward, Brahier; others who may wish to participate. BACKGROUND: I have presented apparent issues with the re-use of former XP NTFS hard drives for other use or re-use. Tools and techniques normally used for fdisking and formatting, wiping and other activities, apparently do not completely remove XP NTFS from hard drives. Disks used for testing: Samsung (no longer an issue as it is toast, completely un-accessible) Maxtor 87000AB - Hard Disk Family DiamondMax 1750A (per Everest) originally used for XP NTFS testing purposes (the OS), fully configured, idled as a firewall only. After Samsung loss, normal "old" removal techniques used to re-use the drive as 32bit, then additional testing. Per early test (WinHex) on the Maxtor: Hard disk 1 Total capacity: 7,003,586,560 bytes = 6.5 GB Number of cylinders: 851 Number of heads: 255 Sectors per track: 63 Bytes per sector: 512 Sector count: 13,678,880 Surplus sectors at end: 7,565 Partition 1 Sectors 63 - 13,655,249 Partition table: Sector 0 File system: FAT32 Total capacity: 6,991,455,744 bytes = 6.5 GB Sector count: 13,655,187 Usable sectors: 13,628,528 First data sector: 26,652 Bytes per sector: 512 Bytes per cluster: 4,096 Free clusters: 1,537,767 !FSInfo mismatch! = 90% free Total clusters: 1,703,566 Unused inter-partition space: Sectors 1 - 62 (31.0 KB) Sectors 13,655,250 - 13,678,879 (11.5 MB) = 11.6 MB A recent test shows: Hard disk 1 Total capacity: 7,003,586,560 bytes = 6.5 GB Number of cylinders: 851 Number of heads: 255 Sectors per track: 63 Bytes per sector: 512 Sector count: 13,678,880 Surplus sectors at end: 7,565 Partition 1 Sectors 63 - 13,639,184 Partition table: Sector 0 File system: ? Total capacity: 6,983,230,464 bytes = 6.5 GB Sector count: 13,639,122 Bytes per sector: 512 Unused inter-partition space: Sectors 1 - 62 (31.0 KB) Sectors 13,639,185 - 13,678,879 (19.4 MB) = 19.4 MB Using GetBack Data for NTFS (an excerpt) |TREE INFO| Tree statistic: 395 directories, 579 files, 831 KB can still be attempted at recovery (and yes, many CAN be viewed, except for the encrypted/compressed files) [Don't bother pointing out the errors shown above, this discussion wouldn't be continuing if there were no errors.] Tools tested so far: hd-util [Samsung]; SH-diag [Samsung]; Sutil [Samsung]; Meandisk; DBan; Wipe; Zap; HDAT2; AEFDISK; GDISK (Symantec); Killdisk; BootitNG; MBRWork; PowerMax [Maxtor]; Maxtor MaxBlast; Super FDisk; MHDD; OnTrack Data Advisor; Seagate SeaTools; Eraser; Testdisk; WinHex. (may already have used several others) Microsoft tools used: CHKDISK (and its autochkdsk - XP versions); Recovery Console; Delpart; fdisk; format; ISSUES: There are hundreds (thousands) of web pages which appear to claim XP NTFS is capable of being removed via old techniques and tools. My testing (to date) shows this in not true. Several hundred megabytes of hard drive space (on these small hard drives, who knows how much on larger drives) still contain files and folders from an XP NTFS installation after its removal. My personal testing shows that initially, and in particular after continually trying to remove the XP NTFS, the disk will be reduced in size. The Maxtor (a 7 gig) now has 5.6 gigabytes of usable space available. Each attempt to remove XP has added some amount to the original total of unusable space (less some sensitive data manually removed via disk editor (so I don't inadvertently place it on the eventual web pages)). MBR has been replaced several times, drive has been "hardware" reset, and dozens of other like activities have been tried unsuccessfully. This has been verified NTFS recovery tools for DOS, Windows and Linux; and disk editors/viewers of varying quality and ability. These hidden/restricted areas are ignored or marked as bad sectors by most tools. These areas may cause potential severe errors to occur when disk scanning software is used on the disk, depending on its abilities and/or configuration. PRESENT ACTIVITIES IN THREADS WITH REPLY FROM MEB: IBM T22 and Win 98se "Franc Zabkar" wrote in message ... | On Mon, 25 Sep 2006 16:56:13 -0400, "MEB" meb@not | put finger to keyboard and composed: | | I'm sorry Ron, the only thing I can presently direct you too, are the tools | which will expose that they don't. | If you wish me to re-post them here I will. They're NTFS recovery tools | (DOS and Linux), and forensic tools. | | Are these the kinds of tools you are referring to? | http://www.hdat2.com/ | http://vidstrom.net/stools/taft/ First yes, second will look at it. | | Regretfully, I'm on my second hard drive during my testing (first, a | Samsung which is no longer accessible after using several techniques and | tools, the bios no longer recognizes it) | | What did you do? AFAIK, even a "low level format" cannot harm a modern | drive because the drive ignores the command. | | See http://www.ariolic.com/activesmart/l...el-format.html I'll check this info. | | Other than that, meddling with the HPA would, AFAICS, only render a | portion of the drive inaccessible, unless you set a password which you | subsequently forgot, or unless you deliberately chose to make the | whole drive invisible. In any case, I would expect that either of the | above utilities should be able to remove any capacity "clipping". | | Otherwise here is Samsung's own Hutil utility: | http://www.samsung.com/Products/Hard...ties/hutil.htm Been there done that, didn't get the t-shirt. | | "If you want to recover to the original size of drive, perform RECOVER | NATIVE SIZE by pressing Enter Key. DISPLAY CURRENT STATUS represents | the current size of drive. If you set 32GB Clip due to capacity | limitation of system, remove the 32GB clip to adjust the LBA or SIZE." | | Of course if your BIOS can no longer see the HD, then your options may | be limited ... There are no more options for the Samsung, its toast. | | ... a Maxtor, which is presently also | on the verge of loss unless I can find the proper info soon, which I'm | having difficulty locating. That would be information on what exactly XP | changes in its use of HPA and other changes to the hard drive. | | I found these links informative: | http://polya.computing.dcu.ie/wiki/i..._why_bother%3F | http://polya.computing.dcu.ie/wiki/i...s_on_Harddisks | http://www.win.tue.nl/~aeb/linux/Large-Disk-11.html Will check these links also. Maxtor tools will not work (or at least what is publicly available). | | I can't see why Windows XP would be interfering with the drive's HPA, | though. In fact, a search for "Host Protected Area" or "Device | Configuration Overlay" at the MSKB produces no hits at all for *any* | MS product. YEAH SO did you really expect any info there.. like I didn't check, come on... | | I'm beginning to suspect this may be a possible reason for Vista not having | a new file system as it was supposed to (or at least that's what I have | heard or read). | | -- | MEB | | "Ron Badour" wrote in message | ... | | | Everything I can find says they do work with NTFS--do you have a source | for | | your statement? | | | | -- | | Regards | | | | | | Ron Badour, MS MVP for W98 | | | "MEB" meb@not wrote in message | | ... | | | Sorry, Zap and Wipe will not remove XP NTFS completely and may severely | | damage the hard drive. | | | | -- | | MEB | | - Franc Zabkar | -- | Please remove one 'i' from my address when replying by email. IBM T22 and Win 98se "Jeff Richards" wrote in message ... | ZAP and WIPE do not remove the NTFS file system completely. They remove | enough of it to allow something like W98 FDISK, which can't understand NTFS | and refuses to do anything to a drive it can't understand, to work so that | the user can create a FAT or FAT32 partition. Agreed, but at what cost? The drive is NOT actually wiped and ready for use. It just APPEARS that it is. | | Forensic tools will still be able to recover data, and it's possible that a | good NTFS recovery tool will be able to rebuild the file system These | utilities were not promoted on the basis that they removed NTFS, only that | they enabled FDISK to start over with a disk that was 'clean enough'. | | While it is technically possible for something like ZAP or WIPE to damage a | drive, I have used these utilities many, many times and I have never had an | issue. If your diagnostics are telling you that the drive is faulty then I | would be confident that the problems were there before you used ZAP or WIPE. | | I would have no hesitation in recommending these utilities to someone who | needs to get rid of an unknown file system so that FDISK can be used. | -- | Jeff Richards | MS MVP (Windows - Shell/User) Well, that may be fine for Microsoft and acceptable to you, however, I doubt that if the people effected knew what had been done to their drives, and that XP NTFS is unremovable by any standard means, and unless my testing is faulty (which it might be since its unfinished), then all of these drives are automatically headed for the dump once XP NTFS is installed. If there is no way to adequately remove XP NTFS, then any resale of an old computer or it's hard drive: can not be guaranteed as safe; has protected the seller; or has protected the buyer. "Ron Badour" wrote in message ... | I've used and recommended these tools for several years and I have never | heard of anyone having damage occur to their hard drives from using them | although I guess it could be possible. If the NTFS partition is large | enough, there would be remnants since these tools only clean out enough of | the partition so fdisk can be used. | | I am not clear about what you are trying to test. Are you trying to recover | data on a failing drive? | | -- | Regards | | | Ron Badour, MS MVP for W98 No, not trying to recover anything except the full hard drive and remove XP NTFS completely. Consider it like returning the hard drive to it's pristine state without the contamination and loss of space, and potential failures which may be caused pursuant the corruption. -- MEB http://peoplescounsel.orgfree.com/ BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real world" "Most people, sometime in their lives, stumble across truth. Most jump up, brush themselves off, and hurry on about their business as if nothing had happen." Winston Churchill Or to put it another way: Morpheus can offer you the two pills; but only you can choose whether you take the red pill or the blue one. _______________ |
#2
|
|||
|
|||
COLLECTED hard drive usage after XP NTFS
On Tue, 26 Sep 2006 16:28:12 -0400, "MEB" meb@not
put finger to keyboard and composed: BACKGROUND: I have presented apparent issues with the re-use of former XP NTFS hard drives for other use or re-use. Tools and techniques normally used for fdisking and formatting, wiping and other activities, apparently do not completely remove XP NTFS from hard drives. Disks used for testing: Maxtor 87000AB - Hard Disk Family DiamondMax 1750A (per Everest) Per early test (WinHex) on the Maxtor: Hard disk 1 Total capacity: 7,003,586,560 bytes = 6.5 GB Number of cylinders: 851 Number of heads: 255 Sectors per track: 63 Bytes per sector: 512 Sector count: 13,678,880 This is the drive's native capacity in LBA mode. Surplus sectors at end: 7,565 This is the drive's unusable capacity when it is configured in CHS mode. 13678880 = (851 x 255 x 63) + 7565 LBA mode = CHS mode + surplus Partition 1 Sectors 63 - 13,655,249 13655250 = 850 x 255 x 63 = total CHS capacity - one cylinder It appears that Fdisk (?) reserves the last cylinder, probably for compatibility purposes. Some older systems placed a defect map there. See http://www.tldp.org/HOWTO/Large-Disk-HOWTO-6.html Partition table: Sector 0 File system: FAT32 Total capacity: 6,991,455,744 bytes = 6.5 GB Sector count: 13,655,187 Usable sectors: 13,628,528 First data sector: 26,652 Bytes per sector: 512 Bytes per cluster: 4,096 Free clusters: 1,537,767 !FSInfo mismatch! = 90% free Total clusters: 1,703,566 Unused inter-partition space: Sectors 1 - 62 (31.0 KB) This is the first track. It is unused because FAT partitions must start and finish on a track boundary. Sectors 13,655,250 - 13,678,879 (11.5 MB) = 11.6 MB = capacity of last reserved cylinder + surplus sectors = (255 x 63) + 7565 sectors A recent test shows: Hard disk 1 Total capacity: 7,003,586,560 bytes = 6.5 GB Number of cylinders: 851 Number of heads: 255 Sectors per track: 63 Bytes per sector: 512 Sector count: 13,678,880 Surplus sectors at end: 7,565 Partition 1 Sectors 63 - 13,639,184 This is reduced from the previous case by 16065 (= 255 x 63) sectors. This amounts to a loss of one additional cylinder. Has Fdisk become confused by the existing partition table and erroneously reserved an extra track? Partition table: Sector 0 File system: ? Total capacity: 6,983,230,464 bytes = 6.5 GB Sector count: 13,639,122 = 13639185 - 63 Bytes per sector: 512 Unused inter-partition space: Sectors 1 - 62 (31.0 KB) Sectors 13,639,185 - 13,678,879 (19.4 MB) = 19.4 MB = capacity of 2 reserved cylinders + surplus sectors I don't think you are seeing any NTFS/Win XP issue. Instead it appears that the drive's capacity is being reduced by some combination of "soft" events. - Franc Zabkar -- Please remove one 'i' from my address when replying by email. |
#3
|
|||
|
|||
COLLECTED hard drive usage after XP NTFS
|
#5
|
|||
|
|||
COLLECTED hard drive usage after XP NTFS
"Jeff Richards" wrote in message ... | "MEB" meb@not wrote in message | ... | snip | | There are hundreds (thousands) of web pages which appear to claim XP NTFS | is capable of being removed via old techniques and tools. | My testing (to date) shows this in not true. Several hundred megabytes of | hard drive space (on these small hard drives, who knows how much on larger | drives) still contain files and folders from an XP NTFS installation after | its removal. | | You are addressing an issue completely different than the original topic. No | part of that discussion referred to removing all trace of NTFS. The point | of recommending ZAP or WIPE was to enable Windows 98 FDISK to work. Nothing | you have mentioned here indicates in any way that ZAP or WIPE will not work | for that purpose, or will damage the disk in any way. Check the description | for these utilities - they both clearly specifiy exactly how much of the | disk gets overwritten. In terms of current disk sizes, it's not much. But it | is enough to enable FDISK to partition the disk as FAT32, which was the | point of the original query. | | The fact that recovery utilities can see part of the old NTFS data after | running something like ZAP or WIPE is simply not relevant. They will | probably still be able to see the data after FDISK has partitioned the | drive, and possibly even after it's formatted (depending on the options | used). This old, recoverable data has absolutely no impact on subsequent | use of the disk. It will get overwritten as the disk fills up. | | I suspect the problems you are seeing are due to data recovery or disk | inspection tools you are using which are somehow protecting data that | appears to be recoverable. Without knowing the exact sequence of utilities | you used it's impossible to say what has happened. But I have many disks | scattered around many different clients that have had NTFS removed as part | of the process of reconditioning second hand-machines, and I have never had | any problems getting access to the full capacity of the disk. Provided, of | course, I configured them correctly and used a file system that was capable | of accessing that capacity. | | And to suggest that no results to your searching proves that there's a | conspiracy to keep the problem quiet is just nonsense. | -- | Jeff Richards | MS MVP (Windows - Shell/User) | | | | I note you state you have disks laying around which have been wiped for re-use. Could you use forensic tools to look for compressed and encrypted files on those disks? I know that's a lot to ask, your day is probably full, but it would be instrumental in my research, and this thread. Make sure the tool or tools have access to the full disk and are NOT limited by supposed $ BAD SECTOR $ classifications, such as would be created during fdisking and formatting, and scandisking after a "wipe". -- MEB http://peoplescounsel.orgfree.com/ BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real world" "Most people, sometime in their lives, stumble across truth. Most jump up, brush themselves off, and hurry on about their business as if nothing had happen." Winston Churchill Or to put it another way: Morpheus can offer you the two pills; but only you can choose whether you take the red pill or the blue one. _______________ | | |
#6
|
|||
|
|||
COLLECTED hard drive usage after XP NTFS
All that was interesting and please continue to provide links [good
information on http://www.win.tue.nl/~aeb/linux/ BTW, though it's too soon for Linux in this discussion; other was known or already used/viewed; one page was not yet created]; However you fail to address: | Free clusters: 1,537,767 !FSInfo mismatch! = 90% free That's a 10% differential of disk space. Let's see where it might be: "Tree statistic: 395 directories, 579 files, 831 KB (the kb is the directories, not total file kb) can still be attempted at recovery (and yes, many CAN be viewed, " except for the encrypted/compressed files)"" INTACT files which show their original untouched names, in their original directories (now corrupt), and holding their same locations on the hard drive. Unmovable, unremovable - they are apparently protected from erasure. -- MEB http://peoplescounsel.orgfree.com/ BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real world" "Most people, sometime in their lives, stumble across truth. Most jump up, brush themselves off, and hurry on about their business as if nothing had happen." Winston Churchill Or to put it another way: Morpheus can offer you the two pills; but only you can choose whether you take the red pill or the blue one. _______________ "Franc Zabkar" wrote in message ... | On Tue, 26 Sep 2006 16:28:12 -0400, "MEB" meb@not | put finger to keyboard and composed: | | BACKGROUND: | I have presented apparent issues with the re-use of former XP NTFS hard | drives for other use or re-use. Tools and techniques normally used for | fdisking and formatting, wiping and other activities, apparently do not | completely remove XP NTFS from hard drives. | | Disks used for testing: | | Maxtor 87000AB - Hard Disk Family DiamondMax 1750A (per Everest) | | Per early test (WinHex) on the Maxtor: | Hard disk 1 | Total capacity: 7,003,586,560 bytes = 6.5 GB | Number of cylinders: 851 | Number of heads: 255 | Sectors per track: 63 | Bytes per sector: 512 | Sector count: 13,678,880 | | This is the drive's native capacity in LBA mode. | | Surplus sectors at end: 7,565 | | This is the drive's unusable capacity when it is configured in CHS | mode. | | 13678880 = (851 x 255 x 63) + 7565 | | LBA mode = CHS mode + surplus | | Partition 1 | Sectors 63 - 13,655,249 | | 13655250 = 850 x 255 x 63 = total CHS capacity - one cylinder | | It appears that Fdisk (?) reserves the last cylinder, probably for | compatibility purposes. Some older systems placed a defect map there. | | See http://www.tldp.org/HOWTO/Large-Disk-HOWTO-6.html | | Partition table: Sector 0 | File system: FAT32 | Total capacity: 6,991,455,744 bytes = 6.5 GB | Sector count: 13,655,187 | Usable sectors: 13,628,528 | First data sector: 26,652 | Bytes per sector: 512 | Bytes per cluster: 4,096 | Free clusters: 1,537,767 !FSInfo mismatch! = 90% free | Total clusters: 1,703,566 | Unused inter-partition space: | Sectors 1 - 62 (31.0 KB) | | This is the first track. It is unused because FAT partitions must | start and finish on a track boundary. | | Sectors 13,655,250 - 13,678,879 (11.5 MB) = 11.6 MB | | = capacity of last reserved cylinder + surplus sectors | = (255 x 63) + 7565 sectors | | A recent test shows: | Hard disk 1 | | Total capacity: 7,003,586,560 bytes = 6.5 GB | | Number of cylinders: 851 | Number of heads: 255 | Sectors per track: 63 | Bytes per sector: 512 | Sector count: 13,678,880 | Surplus sectors at end: 7,565 | | Partition 1 | Sectors 63 - 13,639,184 | | This is reduced from the previous case by 16065 (= 255 x 63) sectors. | This amounts to a loss of one additional cylinder. Has Fdisk become | confused by the existing partition table and erroneously reserved an | extra track? | | Partition table: Sector 0 | File system: ? | Total capacity: 6,983,230,464 bytes = 6.5 GB | Sector count: 13,639,122 | | = 13639185 - 63 | | Bytes per sector: 512 | | Unused inter-partition space: | Sectors 1 - 62 (31.0 KB) | Sectors 13,639,185 - 13,678,879 (19.4 MB) | = 19.4 MB | | = capacity of 2 reserved cylinders + surplus sectors | | I don't think you are seeing any NTFS/Win XP issue. Instead it appears | that the drive's capacity is being reduced by some combination of | "soft" events. | | - Franc Zabkar | -- | Please remove one 'i' from my address when replying by email. |
#7
|
|||
|
|||
COLLECTED hard drive usage after XP NTFS
Why? I know that the forensic tools will be able to find data - I've used
them to do just that. I know that some tools will be able to identify the original partitioning as NTFS, because they can recognise certain signatures. But I also know, because I've already done it, that when the disk is partitioned I will get full access. And I also know that after using ZAP or WIPE and then FDISK and Format I will sometimes get bad sectors reported. That's what I expected, since in those cases the reason for rebuilding the disk was that the manufacturer's diagnostic told me that there were bad sectors developing. And that's why some of these disks are lying around here (including a near new Maxtor 80Gb that's going back under warranty). But the bad sectors had nothing to do with the attempts that I made at recovery. They were there before I started, although not always reported to the operating system as such. -- Jeff Richards MS MVP (Windows - Shell/User) "MEB" meb@not wrote in message ... "Jeff Richards" wrote in message ... | "MEB" meb@not wrote in message | ... | snip | | There are hundreds (thousands) of web pages which appear to claim XP NTFS | is capable of being removed via old techniques and tools. | My testing (to date) shows this in not true. Several hundred megabytes of | hard drive space (on these small hard drives, who knows how much on larger | drives) still contain files and folders from an XP NTFS installation after | its removal. | | You are addressing an issue completely different than the original topic. No | part of that discussion referred to removing all trace of NTFS. The point | of recommending ZAP or WIPE was to enable Windows 98 FDISK to work. Nothing | you have mentioned here indicates in any way that ZAP or WIPE will not work | for that purpose, or will damage the disk in any way. Check the description | for these utilities - they both clearly specifiy exactly how much of the | disk gets overwritten. In terms of current disk sizes, it's not much. But it | is enough to enable FDISK to partition the disk as FAT32, which was the | point of the original query. | | The fact that recovery utilities can see part of the old NTFS data after | running something like ZAP or WIPE is simply not relevant. They will | probably still be able to see the data after FDISK has partitioned the | drive, and possibly even after it's formatted (depending on the options | used). This old, recoverable data has absolutely no impact on subsequent | use of the disk. It will get overwritten as the disk fills up. | | I suspect the problems you are seeing are due to data recovery or disk | inspection tools you are using which are somehow protecting data that | appears to be recoverable. Without knowing the exact sequence of utilities | you used it's impossible to say what has happened. But I have many disks | scattered around many different clients that have had NTFS removed as part | of the process of reconditioning second hand-machines, and I have never had | any problems getting access to the full capacity of the disk. Provided, of | course, I configured them correctly and used a file system that was capable | of accessing that capacity. | | And to suggest that no results to your searching proves that there's a | conspiracy to keep the problem quiet is just nonsense. | -- | Jeff Richards | MS MVP (Windows - Shell/User) | | | | I note you state you have disks laying around which have been wiped for re-use. Could you use forensic tools to look for compressed and encrypted files on those disks? I know that's a lot to ask, your day is probably full, but it would be instrumental in my research, and this thread. Make sure the tool or tools have access to the full disk and are NOT limited by supposed $ BAD SECTOR $ classifications, such as would be created during fdisking and formatting, and scandisking after a "wipe". -- MEB http://peoplescounsel.orgfree.com/ BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real world" "Most people, sometime in their lives, stumble across truth. Most jump up, brush themselves off, and hurry on about their business as if nothing had happen." Winston Churchill Or to put it another way: Morpheus can offer you the two pills; but only you can choose whether you take the red pill or the blue one. _______________ | | |
#8
|
|||
|
|||
COLLECTED hard drive usage after XP NTFS
|
#9
|
|||
|
|||
COLLECTED hard drive usage after XP NTFS
Well fine, then you do have disks available, use a quality forensic tool on
them. Now we're getting somewhere. Merely finding full hard drive space means relatively little, since there are reserved sectors for S.M.A.R.T. activity AND other scandisk/fdisk/format like activities. The disk will use these areas attempting to replace inaccessible areas of the disk. That does NOT mean they are bad, just inaccessible. -- MEB http://peoplescounsel.orgfree.com/ BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real world" "Most people, sometime in their lives, stumble across truth. Most jump up, brush themselves off, and hurry on about their business as if nothing had happen." Winston Churchill Or to put it another way: Morpheus can offer you the two pills; but only you can choose whether you take the red pill or the blue one. _______________ "Jeff Richards" wrote in message ... | Why? I know that the forensic tools will be able to find data - I've used | them to do just that. I know that some tools will be able to identify the | original partitioning as NTFS, because they can recognise certain | signatures. But I also know, because I've already done it, that when the | disk is partitioned I will get full access. | | And I also know that after using ZAP or WIPE and then FDISK and Format I | will sometimes get bad sectors reported. That's what I expected, since in | those cases the reason for rebuilding the disk was that the manufacturer's | diagnostic told me that there were bad sectors developing. And that's why | some of these disks are lying around here (including a near new Maxtor 80Gb | that's going back under warranty). But the bad sectors had nothing to do | with the attempts that I made at recovery. They were there before I started, | although not always reported to the operating system as such. | -- | Jeff Richards | MS MVP (Windows - Shell/User) | "MEB" meb@not wrote in message | ... | | | "Jeff Richards" wrote in message | ... | | "MEB" meb@not wrote in message | | ... | | snip | | | | There are hundreds (thousands) of web pages which appear to claim XP | NTFS | | is capable of being removed via old techniques and tools. | | My testing (to date) shows this in not true. Several hundred megabytes | of | | hard drive space (on these small hard drives, who knows how much on | larger | | drives) still contain files and folders from an XP NTFS installation | after | | its removal. | | | | You are addressing an issue completely different than the original | topic. | No | | part of that discussion referred to removing all trace of NTFS. The | point | | of recommending ZAP or WIPE was to enable Windows 98 FDISK to work. | Nothing | | you have mentioned here indicates in any way that ZAP or WIPE will not | work | | for that purpose, or will damage the disk in any way. Check the | description | | for these utilities - they both clearly specifiy exactly how much of the | | disk gets overwritten. In terms of current disk sizes, it's not much. | But | it | | is enough to enable FDISK to partition the disk as FAT32, which was the | | point of the original query. | | | | The fact that recovery utilities can see part of the old NTFS data after | | running something like ZAP or WIPE is simply not relevant. They will | | probably still be able to see the data after FDISK has partitioned the | | drive, and possibly even after it's formatted (depending on the options | | used). This old, recoverable data has absolutely no impact on | subsequent | | use of the disk. It will get overwritten as the disk fills up. | | | | I suspect the problems you are seeing are due to data recovery or disk | | inspection tools you are using which are somehow protecting data that | | appears to be recoverable. Without knowing the exact sequence of | utilities | | you used it's impossible to say what has happened. But I have many | disks | | scattered around many different clients that have had NTFS removed as | part | | of the process of reconditioning second hand-machines, and I have never | had | | any problems getting access to the full capacity of the disk. Provided, | of | | course, I configured them correctly and used a file system that was | capable | | of accessing that capacity. | | | | And to suggest that no results to your searching proves that there's a | | conspiracy to keep the problem quiet is just nonsense. | | -- | | Jeff Richards | | MS MVP (Windows - Shell/User) | | | | | | | | | | I note you state you have disks laying around which have been wiped for | re-use. | Could you use forensic tools to look for compressed and encrypted files on | those disks? | I know that's a lot to ask, your day is probably full, but it would be | instrumental in my research, and this thread. | Make sure the tool or tools have access to the full disk and are NOT | limited by supposed $ BAD SECTOR $ classifications, such as would be | created | during fdisking and formatting, and scandisking after a "wipe". | | -- | MEB | http://peoplescounsel.orgfree.com/ | BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real | world" | | "Most people, sometime in their lives, stumble across truth. | Most jump up, brush themselves off, and hurry on about their business as | if | nothing had happen." Winston Churchill | Or to put it another way: | Morpheus can offer you the two pills; | but only you can choose whether you take the red pill or the blue one. | _______________ | | | | | | | | | | |
#10
|
|||
|
|||
COLLECTED hard drive usage after XP NTFS
On Tue, 26 Sep 2006 16:28:12 -0400, "MEB" meb@not
put finger to keyboard and composed: Hard disk 1 Total capacity: 7,003,586,560 bytes = 6.5 GB Number of cylinders: 851 Number of heads: 255 Sectors per track: 63 Bytes per sector: 512 Sector count: 13,678,880 Surplus sectors at end: 7,565 Partition 1 Sectors 63 - 13,655,249 Partition table: Sector 0 File system: FAT32 I've checked two of my PCs. Neither has ever seen NTFS or Win XP, yet the hard drives in both machines show a usable capacity that is slightly less than their native capacity. In all cases it is the BIOS (not Fdisk, sorry) that reserves the last cylinder for its own use, whatever that may be. In addition, there is the loss of the surplus sectors that result from the translation to CHS mode. This is because the BIOS tries to fit the drive's geometry into 1024 cylinders or less. In so doing, the last cylinder is often only partially filled, so its surplus sectors are discarded. The next full cylinder is then reserved. In short, I see the same behaviour in a DOS/Win9x system, so it is clearly not an XP/NTFS phenomenon. BTW, I'm using MBRtool to view the MBR and partition table, both in raw hex mode and in decoded mode. http://www.diydatarecovery.nl/downloads/MBRtool.zip - Franc Zabkar -- Please remove one 'i' from my address when replying by email. |
Thread Tools | |
Display Modes | |
|
|
Similar Threads | ||||
Thread | Thread Starter | Forum | Replies | Last Post |
win 98 installation | rc | General | 21 | September 6th 06 09:04 PM |
registry problem. | Mark Garron | General | 13 | May 18th 05 03:38 PM |
WIN98SE BOOT PROBLEM | R.L. Barnhart | Disk Drives | 2 | May 12th 05 10:25 PM |
hard drive problems | Mark Garron | General | 28 | May 11th 05 04:08 PM |
Operating System not found | Greg Clift | Setup & Installation | 10 | April 24th 05 09:49 PM |