Slashdot Mirror
Recovering Secret HD Space
An anonymous reader writes "Just browsing hardocp.com and noticed a link to this article.
'The Inquirer has posted a method of getting massive amounts of hard drive space from your current drive. Supposedly by following the steps outlined, they have gotten 150GB from an 80GB EIDE drive, 510GB from a 200GB SATA drive and so on.' Could this be true? I'm not about to try with my hard drive." Needless to say, this might be a time to avoid the bleeding edge. (See Jeff Garzik's warning in the letters page linked from the Register article.)
Sorry, but this is complete bullshit.
Did aureal density technology increase to 200GB/platter overnight? No.
Please refer to this thread on StorageReview.com for more information.
Computer Science is no more about computers than astronomy is about telescopes. --E. W. Dijkstra
I'm a Ghost developer.
This is just a method of corrupting your partition table so the same disk sectors appear more than once. If you try this, don't ask Symantec for help afterwards.
So either the whole thing is a hoax, or, more likely, the OS is looking at a damaged drive (damaged partition table, at least) and seeing the same partition in multiple ways. Try to write on that shiny new partition and you'll be overwriting data on the old one. Guaranteed.
Some drives are known to short stroke their platters. This raises the more serious problem of this idiocy... The problem is modern drives store important information on those hidden inner areas of their platters (firmware, disk information, reallocated bad sectors), who knows what you could be overwriting whenever you use that space. Put something down in the wrong place and the drive will never start again or corrupt data at certain sectors. It's a lottery ticket everytime you write data in that partition. That's not what I call useable capacity.
Don't believe me? Go ahead and try it. You'll lose all those Buffy episodes you've downloaded on KaZaA, and instead you'll have to spank it to the Portman pictures your mom doesn't know you have stashed under your bed.
The theory of relativity doesn't work right in Arkansas.
Then what kind of disks did you use? I did that to literally hundreds of disks more than 10 years ago, and they still work perfectly today; I've used some in the past week.
New news forum for Canadians - CanadaSpeaks
'A representative for large hard drive distributor Bell Micro said: "This is NOT undocumented and we have done this in the past to load an image of the original installation of the software. When the client corrupted the o/s we had a boot floppy thatopened the unseen partition and copied it to the active or seen partition. It is a not a new feature or discovery. We use it ourselves without any qualms' Which, having worked for a PC sales company, I can confirm is true. And certainly, while earlier models had partitions you could wipe with partition software, later PC builds had this hidden space. But the space was 1GB at most - there's no way there was the kind of 40GB plus hidden space the article claims.
I think posting in the "letters" linked article sums it up pretty well:
About the "recover unused space on your drive" article:
Working for a data-recovery company I know a thing or two about harddisks....
One is that if the vendors would be able to double the capacity for just about nothing, they would.
All this probably does is to create an invailid partition table which ends up having:
|*** new partition ***|
|*** old partition ***|
overlapping partitions. So writing either partition will corrupt the other. It probably so happens that whatever situation people tried it, it just so happened that the (quick) format of the "new" partition didn't corrupt the other partition to make it unbootable.
And the 200G -> 510Gb "upgrade" probably has ended up with three overlapping partitions....
Roger
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
In 1994 I bought a box of 720K single-density floppies by TDK. After discovering that making this extra hole could double the disk capacity, I crudely bashed the holes in them with the end of scissors.
These floppies were used almost daily for 3 years. (no hard disks available at that time). They were reformatted countless times.
Not single one of them ever failed. About a year ago, when failed to reformat and make a boot disk from several fresh-brought floppies I digged up one of them, reformatted again and succeeded in making a reliable boot disk.
Quality of todays media just makes me cry.
but in case you are not:
HD are sold in GB with GB "defined" as 1,000,000,000 bytes, which is ~7.4% less than a real GB (2^30 bytes). After formatting, (depending on your FS) a extra few percent goes away for your file table, sector marker, directory structure, etc. so in real GB (in units of 2^30 bytes), it'll be a lot less than 160, or whatever your "bought" size.
Don't expect to recover those.
RAM is sold with truthful advertising. 128MB = 128*2^20 bytes, which is like 134,217,728 bytes - despite the 134, it's still 128MB.
My life in the land of the rising sun.
Back in the day of MFM and RLL controllers, the hard drive controller did much of what the drive electronics and firmware do in modern hard drives, that's why you could have MFM or RLL controllers. Hard drives still use RLL encoding today.
CHECK IT OUT before you rape your hd
Disks of today have no direct mapping from head, cylinder and track number to physical location on the platter. Rather there is an internal table of the mapping with room for remapping potential weak sectors to unused space. When the head signal is getting close to be inconclusive the just read sector is written at a spare sector, the mapping table is updated, and the old one is marked as bad.
If this article had show how to manipulate the disk so a number of the spare sectors could be used for enlarging the disk it would have been interesting...
:-) = I am happy
:^) = I am happy with my big nose
C:\> = I am happy with my OS
The only saving grace of this article it that even the most intelligent person would have trouble following the Computurs-Fer-Nascar-Dads style instructions. From the article:
...
It has worked completely fine with no loss before and it has also lost the data on the drive before. (so it obviously WILL 'lost' your data)
Do not try to delete both partitions on the drive so you can create one large partition. This will not work. (this is because they are overlapping and you won't see 'extra' space if you delete the overlap)
You have to leave the two partitions separate in order to use them. Windows disk management will have erroneous data (again alluding to the error in reporting space)
in that it will say drive size = manus stated drive size and then available size will equal ALL the available space with recovered partitions included.
I can tell your intelligence by your signature.
..The 120GB hard drive you purchased may have been physically identical to a 250GB hard drive, but simply it only passed qualification at 120GB.
This is possible and is regularly used by HDD manufacturers (if you bothered to read the article)
Intel does the same thing with processors. A 3.0Ghz processor may be sold as 2.4Ghz, simply because it didn't pass qualification at 3.0Ghz but did at a lower clock speed.
all hard drives reserve a certain amount of free space to use for reallocation of bad sectors. These "spare sectors" are free space on your drive... completely unused until your hard drive starts finding problems on the physical media.
The IBM Thinkpad (R-series atleast) has 4 Gb of hidden diskspace that you can enable for ordinary usage in BIOS.
It sounds fairly little, but on a 20 Gb drive that's 20%
Usually there is some kind of backup-image there, but it isnt really necessary (especially for us Linux people).
GAAH! MY PRINTER IS ON FIRE!!! PUT IT OUT! PUT IT OUT!
But yeah more then doubling the HD capacity sounds fishy and there are plenty of letters to the inquirer article explaining how and why it ain't true.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
CLV is constant linear velocity and is what the first generation CD players used. That meant the data passed under the head at a constant speed, 150kbytes/second. The further out on the disc the slower the disc turned as each turn had more data than close-in.
Once the speeds went up the manufacturers moved to CAV or constant angular velocity where the disc spins at a predetermined speed and the data comes in at different rates depending on the head position over the disc. What really happens is there's a table of different CAVs stored in the drive's firmware depending on the absolute position on the disc. Close into the hub the disc spins faster, further out it spins slower. If there are a lot of errors it will slow down to try and read the data better. On a 48x drive there might be as many as 12 different CAV speeds available to the firmware.
Company A gets the business of people who are willing to shell out $200 for a 200 GB HDD. Company A does not get the business who have a budget of less than $200 for their HDD purchase.
Company B get the business of people who are willing to shell out $200 for 200 GB HDD and the business of people who have a smaller budget.
Company A buys company B. The new Company AB sells both 150GB and 200GB drives, so they get money from everybody.
Except, of course, that Company AB is in competition with Company C, which makes a real 150GB drive which costs less to produce than company AB's "150GB" drive because it's not really a 200GB drive with modified firmware. Company C sells their 150GB drive for less, and starts driving company AB's margins down; Company C can keep doing this because their costs are lower.
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;
Notice how they say an unpatched version of ghost is required:
Ghost 2003 Build 2003.775 (Be sure not to allow patching of this software)
That's because the patched version fixes A BUG that allowed the "ever expanding miracle".
Your information is off. Either you haven't used hard drives for about 15 years, or you are making the whole thing up.
The MBR does not store the bad block information. The MBR hasn't stored bad block information since IDE became popular and people stopped being able to low format your their hard drives (no a zero wipe is not a low level format, it simply gives the firmware a good time to reallocate developed bad sectors)
The bad block information is stored in areas of the drive that are completely unaccessable to the outside world, most probably near the servo information on the same track as the actual bad sector. It is only accessed by the LBA mapper in the drive firmware.
The drive actually keeps count of how many sectors it has had to reallocate in its life, and how many sectors it is waiting for a good moment to reallocate. You can get this info from most drives by inspecting the SMART values. Bad sectors do not ussually develop very often after the drive is shipped. You should not see this value be more then 1 or 2 in a young, properly working hard drive.
When the drive detects a sector is going bad, it does not automaticly reallocate it unless it can be correctly read. (or ECC corrected by the drive) This gives recovery software a slim chance of getting lucky and recoving the data from the bad block. The drive simply notes the sector is going bad. If it is read correctly at some late, the hard drive will automaticly reallocate it somewhere else. Alternatively, if a write is issued to a sector awaiting reallocation, then the drive will it perform then rather then wait for a good read.
Also, manufacturers still use aluminium platters in most drives. The embedded servo infomation is used to keep the drive tracking correctly regardless of the temperature of the drive (within specified limits)
Since you didn't read the article, nor any of the comments prevously written, you are completely wrong about this magical utility. It is simply an exploitation of a bug in Norton Ghost that makes your hard drive look larger then it is by overlapping partitions. Attempt to write data to one partition and you will trash the data on the other.
I can't possibly see how this would work. They're reporting a (more than?) 2x size increase on the largest harddrive they alledgedly did this trick on.
If it works at all, all it really accomplishes is trick windows into thinking the partition really is bigger than it is. There's NO WAY it could get any bigger in reality, since drive capacity is based on the number of sectors the drive reports to the computer, and that is a fixed, hard-coded number that can't be changed by Norton Ghost or any other utility. If you try to address sector maxcapacity+1, you'll just get an error message back from the drive, it won't actually do anything.
This is just a case of someone making sh** up in order to appear on the front page of hardware websites... A bit like participating in a 'reality show' on TV.
You're joking right?
On the subject of the Inquirer article.
The 200JB, or BB or whatever is clearly impossible. There is no hidden space on them to recover at all, let alone 310GB! I can't imagine what kind of idiocy provoked someone to believe that was even possible. Western Digital doesn't make drives with more than 3 platters! The 200GB Western Digitals are only available with 80GB/platters. They only have 5 heads. It's therfore impossible to recover any capacity from them at all (5*40GB=200GB).
Some of the other drives are known to short stroke their platters. This raises the more serious problem of this idiocy... The problem is modern drives store important information on those hidden inner areas of their platters (firmware, disk information, reallocated bad sectors), who knows what you could be overwriting whenever you use that space. Put something down in the wrong place and the drive will never start again or corrupt data at certain sectors. It's a lottery ticket everytime you write data in that partition. That's not what I call useable capacity.
Also, if this was working properly, the 80GB deskstar would yield:
either 90GB (+10GB) if it was a 180GXP (three heads on 60GB platters)
or 80GB (+0GB) if it was a 7K250 (2 heads on 80GB platters)
Anyone with most basic knowledge of hard drives should know that most of the numbers up there are simply impossible, not to mention simply ridiculous.
It's not that there aren't hard drives which are short stroked and sold at a capacity below that available for access in theory, but that something is clearly wrong with this method in that it is simply inventing space that physically can't be there. Perhaps hard drive manufacturers are shortstroking disks to the point that they are formatted with the capacity of drives with fewer platters or heads, but this could never justify the failure of this method on the 200GB Western Digital drive. This drive is a known quantity. No matter what, even if they got a disk that was a shortstroked 6 head drive (which would make no sense), the maximum capacity is 250GB, not 510GB. You would need 7 platters to get that capacity with todays technology!
Yeah, its amazing.... I changed the partition table without updating the vfat table and put an ext2 filesystem in the second partition.
The vfat partition stayed the same and the ext2 partition was non-zero size... woah....
Its just pesky random file corruption on both partitions you have to worry about...
In all seriousness:
*THIS IS VERY VERY VERY DANGEROUS* DO NOT DO THIS *PERIOD*. It may give neat apperances at first, and both filesystems may appear fundamentally functional, but it will *CORRUPT DATA* when the first partition is populated enough to creep into the partition overlay.
XML is like violence. If it doesn't solve the problem, use more.
The Host Protected Area is space on your hard drive that your bios, your operating system or even your applications can be set aside for certain management information. I take it that some backup programs (ab)use it to "hide" compressed boot images on hard drives. I wouldn't be very surprised if companies like Dell or IBM stole some of your hard disk so you can restore a windows installation.The "Host Protected Area" has nothing at all to do with the drive-internal handling of bad sectors or other drive-interal.Drive-internal information as well as sectors used for replacing sectors gone bad are not accessible through the ATAPI commandset for accessing the HPA.
The ANSI T13 Standard Document for ATAPI-6 (current) are overprized at $18.00 but you can download a draft of upcoming ATAPI-7 from the T13 working group's site at http://www.t13.org. There you will find in Section 4.9 of the document: "A reserved area for data storage outside the normal operating system file system is required for several specialized applications". Systems may wish to store configuration data or save memory to the device in a location that the operating system cannot change. The optional Host Protected Area feature set allows a portion of the device to be reserved for such an area when the device is initially configured. A device that implements the Host Protected Area feature set shall implement the following minimum set of commands:"
READ NATIVE MAX ADDRESS
SET MAX ADDRESS ... ...
I take it that READ NATIVE MAX ADDRESS tells you how many sectors of user addressable space have been configured on the drive and SET MAX ADDRESS lets you adjust that.
The way I see it there may be a lot of preinstalled hard drives out there with a compressed windows installation images on them "hidden" in the HPA. Maybe a new version of hdparm will allow linux users to reclaim that dead space.
I followed the directions to the letter. I ended up with a 1GB drive! (On a supposedly 540MB drive. In the end, FDISK claimed 965 MB.) I filled up the first partition (with mp3s, naturally.) I then started filling up the second partition...
Surprise, surprise. It crashed halfway through copying the mp3s. Reboot? BZZZT! Windows 98 crashed a quarter of the way through loading. Starting up from a DOS disk, and my directory structure is all frooed up on the C partition. Filenames with random ASCII characters in them, inaccessible directories, all sorts of data corruption goodness. The D partition had correct names, though. (So my second batch of mp3s was probably fine.)
(Or, more specifically, do not try this on a hard drive you want to keep, or with data you want to keep.)
Another non-functioning site was "uncertainty.microsoft.com."
The purpose of that site was not known.
ATI is a perfect example I think. Ya'll remember the various mods to convert their otherwise identical top-of-the-line video card into their top-of-the-line 3D rendering graphics pro card? Sometimes the designs are basically identical for good reason. Cost savings comes to mind. They simply use software and/or a few well-placed jumpers to differentiate between the two.
I used to use the program the parent speaks of, and it really did work. The format tool let you adjust the number of tracks and sectors on a floppy, with the 1.72 Meg combination working well but anything beyond that not working right. The space gains were quite real, back when my hard drive was a mere 40 megs I used this to offload things and make room. It used a small TSR program (i.e., a memory-resident driver) which had to be loaded, or you would get errors trying to read the disks.
I wonder how many slashdotters (including me) hooked their MFM hard drive up to an RLL controller to get that extra 50% out of it?
Now that's kickin' it old school.
60MB out of an ST-251, baybee!
Chris Owens
San Carlos, CA
Once a fab process has had the kinks worked out, they chips undergo much less thorough speed binning. Intel often uses dies near center of the wafer(where focus is more exact) for higher speeds and dies nearer the edge of the wafer for lower speeds. It's a lot simpler than testing every processor at every speed.