| Author | Message | ||
     Philippe Auphelle Username: filofel Registered: N/A |
Hi, I just discovered the existence of WinHex and after a couple of hours of serious use, I got a Pro license and (unanimously  ) promoted it to my primary toolbox, along with BootIt NG, IDA Pro and a very little number of others. Thanks for a great tool. Now for the question: I'm snooping around on a Vista-formatted HD. I'm using an USB 2.0 to IDE & SATA cable connected to the drive, and that works fine - drive is seen just as any regular drive, both physically and logically. When Vista installed itself on that disk, it decided to create the first (primary and bootable) partition at sector 2048, leaving a full 1 meg (- 512 bytes of MBR) of space unused. The MBR is where it should be, CHS 0,0,1, first sector. Now when I grab that physical drive, connect it with the USB cable and WinHex open the physical drive, WinHex doesn't recognized the MBR and following sectors as "Start sectors" like it does on other disks. Instead, it shows them as 'Unpartitioned space'. If I look at 'Unpartitioned space', I can see my MBR, located at CHS 0,0,1 like it should, and that 'Unpartitioned space' is just 1 meg like expected. That's not a real problem, but I'm just curious: What prevents WinHex from recognizing those 2048 sectors as "Start Sectors"? | ||
| Stefan Fleischmann Username: admin Registered: 1-2001 |
> What prevents WinHex from recognizing those 2048 sectors as "Start Sectors"? Nothing, and who says that these sectors should be called "Start sectors"? Simply a matter of definition: If an area on a disk that does not belong to any partition is larger than 1 MB, WinHex considers it unpartitioned space because a partition could be created in there (e.g. FAT12) theoretically, whether such a partition would be useful or not. Extreme example: Imagine the first partition began only 10 GB into the disk. Should all these 10 GB before that partition be designated "start sectors"? Certainly not, would rather be suspicious. The exact limit, the amount of data where "start sectors" should be called "unpartitioned space", is debatable, I think (although I don't have the time for such a debate). | ||
| Philippe Auphelle Username: filofel Registered: N/A |
Stefan, OK, point well taken. One of the reasons I asked was also that I was wondering whether WinHex exercised some kind of heuristics to recognize an MBR sector before deciding to label "start sectors". And disassembly of the Vista MBR shows that it has slightly changed from previous MBRs (they added a couple of TCG BIOS calls to log a code checksum that will presumably be checked later by the starting OS, presumably in order to check the integrity of the whole boot chain). Thus without getting into a debate, then ;-) : Shouldn't the fact that the aforementioned 'Unpartioned space" starts precisely at CHS 0,0,1 and is located before the first partition strongly suggest that these are indeed, "start sectors"? Specially if it were confirmed that Vista now defaults to creating the first partition at sector 2048 rather than the previous 63... So the "unpartioned space" is not even "over one megabyte", it is now precisely one megabyte (minus the MBR sector, one could argue). IOW, if it is confirmed that Vista now routinely defaults to allocating the first partition at sector 2048 - my test sample is not large enough at this point to insure this -, I suggest increasing at some point the 1MB limit to 1MB + 512 bytes. Another way to put it could be to say that this limit could be periodically adjusted to keep up with the current drive space inflation ;-) Thanks for your answer and for a great piece of software, anyway! /Ph. |