Slashdot Mirror
Recovering Secret HD Space
An anonymous reader writes "Just browsing hardocp.com and noticed a link to this article.
'The Inquirer has posted a method of getting massive amounts of hard drive space from your current drive. Supposedly by following the steps outlined, they have gotten 150GB from an 80GB EIDE drive, 510GB from a 200GB SATA drive and so on.' Could this be true? I'm not about to try with my hard drive." Needless to say, this might be a time to avoid the bleeding edge. (See Jeff Garzik's warning in the letters page linked from the Register article.)
Sorry, but this is complete bullshit.
Did aureal density technology increase to 200GB/platter overnight? No.
Please refer to this thread on StorageReview.com for more information.
Computer Science is no more about computers than astronomy is about telescopes. --E. W. Dijkstra
I'm a Ghost developer.
This is just a method of corrupting your partition table so the same disk sectors appear more than once. If you try this, don't ask Symantec for help afterwards.
So either the whole thing is a hoax, or, more likely, the OS is looking at a damaged drive (damaged partition table, at least) and seeing the same partition in multiple ways. Try to write on that shiny new partition and you'll be overwriting data on the old one. Guaranteed.
Some drives are known to short stroke their platters. This raises the more serious problem of this idiocy... The problem is modern drives store important information on those hidden inner areas of their platters (firmware, disk information, reallocated bad sectors), who knows what you could be overwriting whenever you use that space. Put something down in the wrong place and the drive will never start again or corrupt data at certain sectors. It's a lottery ticket everytime you write data in that partition. That's not what I call useable capacity.
Don't believe me? Go ahead and try it. You'll lose all those Buffy episodes you've downloaded on KaZaA, and instead you'll have to spank it to the Portman pictures your mom doesn't know you have stashed under your bed.
The theory of relativity doesn't work right in Arkansas.
Then what kind of disks did you use? I did that to literally hundreds of disks more than 10 years ago, and they still work perfectly today; I've used some in the past week.
New news forum for Canadians - CanadaSpeaks
'A representative for large hard drive distributor Bell Micro said: "This is NOT undocumented and we have done this in the past to load an image of the original installation of the software. When the client corrupted the o/s we had a boot floppy thatopened the unseen partition and copied it to the active or seen partition. It is a not a new feature or discovery. We use it ourselves without any qualms' Which, having worked for a PC sales company, I can confirm is true. And certainly, while earlier models had partitions you could wipe with partition software, later PC builds had this hidden space. But the space was 1GB at most - there's no way there was the kind of 40GB plus hidden space the article claims.
I think posting in the "letters" linked article sums it up pretty well:
About the "recover unused space on your drive" article:
Working for a data-recovery company I know a thing or two about harddisks....
One is that if the vendors would be able to double the capacity for just about nothing, they would.
All this probably does is to create an invailid partition table which ends up having:
|*** new partition ***|
|*** old partition ***|
overlapping partitions. So writing either partition will corrupt the other. It probably so happens that whatever situation people tried it, it just so happened that the (quick) format of the "new" partition didn't corrupt the other partition to make it unbootable.
And the 200G -> 510Gb "upgrade" probably has ended up with three overlapping partitions....
Roger
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
In 1994 I bought a box of 720K single-density floppies by TDK. After discovering that making this extra hole could double the disk capacity, I crudely bashed the holes in them with the end of scissors.
These floppies were used almost daily for 3 years. (no hard disks available at that time). They were reformatted countless times.
Not single one of them ever failed. About a year ago, when failed to reformat and make a boot disk from several fresh-brought floppies I digged up one of them, reformatted again and succeeded in making a reliable boot disk.
Quality of todays media just makes me cry.
but in case you are not:
HD are sold in GB with GB "defined" as 1,000,000,000 bytes, which is ~7.4% less than a real GB (2^30 bytes). After formatting, (depending on your FS) a extra few percent goes away for your file table, sector marker, directory structure, etc. so in real GB (in units of 2^30 bytes), it'll be a lot less than 160, or whatever your "bought" size.
Don't expect to recover those.
RAM is sold with truthful advertising. 128MB = 128*2^20 bytes, which is like 134,217,728 bytes - despite the 134, it's still 128MB.
My life in the land of the rising sun.
Back in the day of MFM and RLL controllers, the hard drive controller did much of what the drive electronics and firmware do in modern hard drives, that's why you could have MFM or RLL controllers. Hard drives still use RLL encoding today.
Disks of today have no direct mapping from head, cylinder and track number to physical location on the platter. Rather there is an internal table of the mapping with room for remapping potential weak sectors to unused space. When the head signal is getting close to be inconclusive the just read sector is written at a spare sector, the mapping table is updated, and the old one is marked as bad.
If this article had show how to manipulate the disk so a number of the spare sectors could be used for enlarging the disk it would have been interesting...
:-) = I am happy
:^) = I am happy with my big nose
C:\> = I am happy with my OS
The only saving grace of this article it that even the most intelligent person would have trouble following the Computurs-Fer-Nascar-Dads style instructions. From the article:
...
It has worked completely fine with no loss before and it has also lost the data on the drive before. (so it obviously WILL 'lost' your data)
Do not try to delete both partitions on the drive so you can create one large partition. This will not work. (this is because they are overlapping and you won't see 'extra' space if you delete the overlap)
You have to leave the two partitions separate in order to use them. Windows disk management will have erroneous data (again alluding to the error in reporting space)
in that it will say drive size = manus stated drive size and then available size will equal ALL the available space with recovered partitions included.
The IBM Thinkpad (R-series atleast) has 4 Gb of hidden diskspace that you can enable for ordinary usage in BIOS.
It sounds fairly little, but on a 20 Gb drive that's 20%
Usually there is some kind of backup-image there, but it isnt really necessary (especially for us Linux people).
GAAH! MY PRINTER IS ON FIRE!!! PUT IT OUT! PUT IT OUT!
CLV is constant linear velocity and is what the first generation CD players used. That meant the data passed under the head at a constant speed, 150kbytes/second. The further out on the disc the slower the disc turned as each turn had more data than close-in.
Once the speeds went up the manufacturers moved to CAV or constant angular velocity where the disc spins at a predetermined speed and the data comes in at different rates depending on the head position over the disc. What really happens is there's a table of different CAVs stored in the drive's firmware depending on the absolute position on the disc. Close into the hub the disc spins faster, further out it spins slower. If there are a lot of errors it will slow down to try and read the data better. On a 48x drive there might be as many as 12 different CAV speeds available to the firmware.
Er. Except that's not how it works.
Intel tests a sample from each batch of processors to determine which "bin" it goes into. That sample tested reliably at 2.4GHz? Okay, into the 2.4GHz pile. That sample tested at 2.8? Okay, into the 2.8 pile. The trick about processors running faster than labeled isn't because they're mislabeling processors, it's that they only test one processor out of the entire batch. Many processors within either batch could be capable of 3GHz, simply due to vagaries of production - you can give it a shot and find out, but don't be surprised when it develops unacceptable amounts of heat like the processor they tested.
HD manufacturers are quite different. When they release a new line of HDs, they are all based off common technologies, but over a wide range of hard drive sizes - because the NUMBER OF PLATTERS inside each model are different. Got a platter that can hold 100GB? Stick 1 inside, you've got a 100GB drive. 2 inside, 200GB. 3 inside, 300GB. There's three models (though drives typically contain substantially more platters). Now you stick 2 in heads for each platter (unless it's one of those old wacky Barracuda drives, which had 4 heads per platter), and firmware that is designed to control the hardware inside the sealed case - but usually even the controller is identical within a line.
One other important thing to remember is that they test the platters BEFORE the HD is fully assembled. This is very different from a processor, where you can't exact test individual components until the entire thing is built. That said, they certainly design in a certain amount of fudge room certainly, so they can remap bad sectors into the fudge room. No platter is perfect, so they need additional space to remap bad sectors. I would be very, very surprised if there's more than 10GB of available space on a 250GB drive...
Notice how they say an unpatched version of ghost is required:
Ghost 2003 Build 2003.775 (Be sure not to allow patching of this software)
That's because the patched version fixes A BUG that allowed the "ever expanding miracle".
Your information is off. Either you haven't used hard drives for about 15 years, or you are making the whole thing up.
The MBR does not store the bad block information. The MBR hasn't stored bad block information since IDE became popular and people stopped being able to low format your their hard drives (no a zero wipe is not a low level format, it simply gives the firmware a good time to reallocate developed bad sectors)
The bad block information is stored in areas of the drive that are completely unaccessable to the outside world, most probably near the servo information on the same track as the actual bad sector. It is only accessed by the LBA mapper in the drive firmware.
The drive actually keeps count of how many sectors it has had to reallocate in its life, and how many sectors it is waiting for a good moment to reallocate. You can get this info from most drives by inspecting the SMART values. Bad sectors do not ussually develop very often after the drive is shipped. You should not see this value be more then 1 or 2 in a young, properly working hard drive.
When the drive detects a sector is going bad, it does not automaticly reallocate it unless it can be correctly read. (or ECC corrected by the drive) This gives recovery software a slim chance of getting lucky and recoving the data from the bad block. The drive simply notes the sector is going bad. If it is read correctly at some late, the hard drive will automaticly reallocate it somewhere else. Alternatively, if a write is issued to a sector awaiting reallocation, then the drive will it perform then rather then wait for a good read.
Also, manufacturers still use aluminium platters in most drives. The embedded servo infomation is used to keep the drive tracking correctly regardless of the temperature of the drive (within specified limits)
Since you didn't read the article, nor any of the comments prevously written, you are completely wrong about this magical utility. It is simply an exploitation of a bug in Norton Ghost that makes your hard drive look larger then it is by overlapping partitions. Attempt to write data to one partition and you will trash the data on the other.
I can't possibly see how this would work. They're reporting a (more than?) 2x size increase on the largest harddrive they alledgedly did this trick on.
If it works at all, all it really accomplishes is trick windows into thinking the partition really is bigger than it is. There's NO WAY it could get any bigger in reality, since drive capacity is based on the number of sectors the drive reports to the computer, and that is a fixed, hard-coded number that can't be changed by Norton Ghost or any other utility. If you try to address sector maxcapacity+1, you'll just get an error message back from the drive, it won't actually do anything.
This is just a case of someone making sh** up in order to appear on the front page of hardware websites... A bit like participating in a 'reality show' on TV.
You're joking right?
On the subject of the Inquirer article.
The 200JB, or BB or whatever is clearly impossible. There is no hidden space on them to recover at all, let alone 310GB! I can't imagine what kind of idiocy provoked someone to believe that was even possible. Western Digital doesn't make drives with more than 3 platters! The 200GB Western Digitals are only available with 80GB/platters. They only have 5 heads. It's therfore impossible to recover any capacity from them at all (5*40GB=200GB).
Some of the other drives are known to short stroke their platters. This raises the more serious problem of this idiocy... The problem is modern drives store important information on those hidden inner areas of their platters (firmware, disk information, reallocated bad sectors), who knows what you could be overwriting whenever you use that space. Put something down in the wrong place and the drive will never start again or corrupt data at certain sectors. It's a lottery ticket everytime you write data in that partition. That's not what I call useable capacity.
Also, if this was working properly, the 80GB deskstar would yield:
either 90GB (+10GB) if it was a 180GXP (three heads on 60GB platters)
or 80GB (+0GB) if it was a 7K250 (2 heads on 80GB platters)
Anyone with most basic knowledge of hard drives should know that most of the numbers up there are simply impossible, not to mention simply ridiculous.
It's not that there aren't hard drives which are short stroked and sold at a capacity below that available for access in theory, but that something is clearly wrong with this method in that it is simply inventing space that physically can't be there. Perhaps hard drive manufacturers are shortstroking disks to the point that they are formatted with the capacity of drives with fewer platters or heads, but this could never justify the failure of this method on the 200GB Western Digital drive. This drive is a known quantity. No matter what, even if they got a disk that was a shortstroked 6 head drive (which would make no sense), the maximum capacity is 250GB, not 510GB. You would need 7 platters to get that capacity with todays technology!
I would carry your analysis a step further and note that chip and drive manufacturers don't make money by downgrading their product.
I daresay they've a statistical model that has them doing enough sampling to maximize profit, and the means minimizing the amount of irritated customers calling in about problems.
This is not like highway engineering, where they have to figure in weather, vehicles, and Aunt Tillie before posting a speed sign for a curve, so they lowball it heavily.
Get thee glass eyes, and, like a scurvy politician, seem to see things thou dost not.--King Lear
The Host Protected Area is space on your hard drive that your bios, your operating system or even your applications can be set aside for certain management information. I take it that some backup programs (ab)use it to "hide" compressed boot images on hard drives. I wouldn't be very surprised if companies like Dell or IBM stole some of your hard disk so you can restore a windows installation.The "Host Protected Area" has nothing at all to do with the drive-internal handling of bad sectors or other drive-interal.Drive-internal information as well as sectors used for replacing sectors gone bad are not accessible through the ATAPI commandset for accessing the HPA.
The ANSI T13 Standard Document for ATAPI-6 (current) are overprized at $18.00 but you can download a draft of upcoming ATAPI-7 from the T13 working group's site at http://www.t13.org. There you will find in Section 4.9 of the document: "A reserved area for data storage outside the normal operating system file system is required for several specialized applications". Systems may wish to store configuration data or save memory to the device in a location that the operating system cannot change. The optional Host Protected Area feature set allows a portion of the device to be reserved for such an area when the device is initially configured. A device that implements the Host Protected Area feature set shall implement the following minimum set of commands:"
READ NATIVE MAX ADDRESS
SET MAX ADDRESS ... ...
I take it that READ NATIVE MAX ADDRESS tells you how many sectors of user addressable space have been configured on the drive and SET MAX ADDRESS lets you adjust that.
The way I see it there may be a lot of preinstalled hard drives out there with a compressed windows installation images on them "hidden" in the HPA. Maybe a new version of hdparm will allow linux users to reclaim that dead space.
I happen to work in the processor inducstry, and your statement is untrue. Every processor gets tested. The 'bins' are chosen due to 2 factors:
1) The processor passes testing under extreme conditions at this speed. This gaurantees that the part has a high probability of never being returned as a defect (as silicon is used it ages due to electron-igration, which effectively makes it work slower/stop working eventually). The testing gaurantees that the user won't ever see this impact. In this case, a 2.4GHz binned part may work fine for you at 2.8GHz, but perhaps it will die in 3 years. Or perhaps a single instruction in SSE will return the wrong value 1 time in 100,000. Who knows.
2) Parts are binned to meet supply. The company says it will supply 10,000 2.8GHz parts, and 100,000 2.4GHz parts. However of the 110,000 parts, 40,000 ran at 2.8GHz, and the rest at 2.4GHz. To keep the price scale (and meet the contract) 30,000 oparts which are perfectly good at 2.8GHz will get sold as 2.4
The downside: There is no way to tell (1) from (2) as a consumer, so overclocking is all a game of craps.
Also remember that the tests are done under 'extreme' conditions, which means that all parts will likely work slightly faster than the bin they were assigned to.
Caveat: When a new frequency/design is released, it may be very difficult to get to the desired frequency, and the testing is relaxed somewhat to meet the quota (in which case very few parts will be overclockable)
Lastly, no testing is done above the top bin, so if 3.2 GHz is the current fastest sold, some percentage of those may run at 3.4 or 3.6, and they won't have been tested that far.
The parent post is incorrect in regards to chip testing.
Manufacturers test every single chip pretty much identically. Different companies differ in how they determine speed of parts (run some patterns at full speed, measure the delay of some known circuits, etc.) but each part is tested. There is too much variation across the wafer to do much else.
It's always possible to run a chip faster than a manufacturer's testing especially if it is kept cooler than the max spec, voltage is within tighter tolerance than spec, or if the user doesn't care about correct answers. I find the last point is what usually allows the greatest overclocking.
Also, some large manufacturers (Intel, AMD) have marketing needs to sell certain speed grades. So if all parts run at 3.0GHz, but users are demanding the cheaper 2.8GHz parts, then they'll sell some faster parts marked at 2.8GHz. In general, this is a temporary situation since re-pricing to reflect the increased yield will probably move the 3.0GHz price down shortly to increase pressure on the competition.
After a wafer is made a robotic tester probes each circuit before the wafer is cut up. If a circuit fails the basic tests, the probe squirts a little dot of red paint on that circuit. The "known defects" get a red dot without even being tested. After this initial probe test, the circuits are cut apart, the ones with red dots are discarded and the rest are mounted on carriers.
It is possible that a slight mask defect or wafer imperfection might cause a performance problem rather than a total functional failure. This could also be caused by a slightly out-of-spec doping or wafer heating. These are sorted out by further testing as mentioned by other posters.If all of the circuits on a wafer get the same doping and same heating, then you can sample one or two and assume that the rest of the circuits from that wafer will have similar performance. If you have a mask problem that causes degraded performance, you can automatically flag that die location as a "known slow" or a "known bad" depending on your criteria.
You were 80% angel, 10% demon. The rest was hard to explain. - Over The Rhine
"Math in a song is good."-Linford
I followed the directions to the letter. I ended up with a 1GB drive! (On a supposedly 540MB drive. In the end, FDISK claimed 965 MB.) I filled up the first partition (with mp3s, naturally.) I then started filling up the second partition...
Surprise, surprise. It crashed halfway through copying the mp3s. Reboot? BZZZT! Windows 98 crashed a quarter of the way through loading. Starting up from a DOS disk, and my directory structure is all frooed up on the C partition. Filenames with random ASCII characters in them, inaccessible directories, all sorts of data corruption goodness. The D partition had correct names, though. (So my second batch of mp3s was probably fine.)
(Or, more specifically, do not try this on a hard drive you want to keep, or with data you want to keep.)
Another non-functioning site was "uncertainty.microsoft.com."
The purpose of that site was not known.
ATI is a perfect example I think. Ya'll remember the various mods to convert their otherwise identical top-of-the-line video card into their top-of-the-line 3D rendering graphics pro card? Sometimes the designs are basically identical for good reason. Cost savings comes to mind. They simply use software and/or a few well-placed jumpers to differentiate between the two.
Maybe in the old full-height drives, but most consumer 3.5" drives nowdays only have 1-3 platters (as have most drives I have disassembled....my platter collection is at about 50), 4 in the ultra-top-of-the-line high-capacity drives. Each platter is about 1mm thick, but has space between the rest of the chassi and other platters for the head assymblies (which is 2 assymblies between platters, one for each). These take up more room, as the arm's design itself is usually thicker than the platter, and it has to be rasied off the platter so that it will not damage it as it swings back and forth rapidly. You also have to add in the case itself and the motor used to spin the platters. Theres not much room to cram in too many platters inside the case. Remeber the dimensions of a half-height 3.5" drive gives only about 1.6" of vertical space total.
You are correct though, in that lower capacity drives just remove platters and head assymblies from a higher capacity model. Specifically, I took apart two older Seagate drives, one had 1 platter, the other had 2 and was rated at almost double capacity, but where otherwise identical. In place of the platters, they just put in spacers on the drive axel.
Tm
ps: on a side note its interesting to see how the design of drives have changed over the years, from heads actuated by stepping motors to voice-coil actuators, and from the full-height monsters with 7 platters to single platter drives with 10x capacity, yet the platters have stayed the exact same radial size on every 3.5" drive I have taken apart. The only notable physical differnece other than color is the thickness. Newer platters are lighter in color and are ALOT thinner.
Support TBI Research: http://www.raisinhope.org