Developing more utilities for disks hiding partitions how the partition becomes hidden format of partition in partition table of MBR file system indicator byte

Data Recovery PRO DATA DOCTOR

Home | Order Online | Downloads | Contact Us | Software Knowledgebase

it | es | pt | fr | de | jp | kr | cn | ru | nl | gr


Chapter – 16

Developing more Utilities for Disks

Introduction

In this chapter we shall discuss, how to use the information of MBR, DBR, FAT and Root Directories to develop utility programs which may help us in managing the data, in optimizing the storage or in may disk troubleshooting tasks.

Usually, these programs are solution to some specific problem. Some utility programs and their programming have been discussed in this chapter.

Hiding Partitions

Generally, the partition hiding utility is used by those users who work on such computer system which is used by users. If there are many users for same the computer, there may be a great possibility, that data of another user may be read, stolen, or deleted.

In such case, where user has some important data or some confidential information in the same computer, he may be willing to hide the partition in which he has his data in such a way that the partition should not be accessed by the Operating system, so that the may not be accessed by other user.

When the user wants to work on the system, he can access the partition back, just by unhiding the partition. Generally these types of events take place in the professional institutions, where the computers are used by many students but senior students are always worried about their important data or project work. As in lack of knowledge, the new student may harm or even delete their data.

How the partition becomes hidden

The following table represents the format of partition in partition table of MBR:

Offset

Meaning

Size

Description

00H

Boot Type Indicator Byte

1 Byte

If Byte is 00H, the Partition is Inactive and if Byte is 80H, The Partition is Active (or Bootable)

01H

Head Number of Beginning of the Partition

1 Byte

Starting Head number of the Partition in Hexadecimal System

02H

Sector and Cylinder Number of Beginning of the Partition

2 Bytes

6 Bits of First Byte make Starting Sector Number and Combination of remaining 2 Bits (as Two Most Significant Bits) plus 8 Bits of another Byte (Rest 8 least Significant Bits of the 10-Bit Number ) make the Starting Cylinder Number of the Partition

04H

File System indicator Byte

1 Byte

File System Indicator Byte in Hexadecimal system (for complete list of partition indicator bytes, refer the chapter “Logical Approach to Disks and OS” discussed earlier in this book)

05H

Head Number of End of the Partition

1 Byte

Ending Head Number of the Partition in Hexadecimal System

06H

Sector and Cylinder Number of End of the Partition

2 Bytes

6 Bits of First Byte make Ending Sector Number and Combination of remaining 2 Bits (as Two Most Significant Bits) plus 8 Bits of another Byte (Rest 8 least Significant Bits of the 10-Bit Number ) make the Ending Cylinder Number of the Partition

08H

Absolute Sector number of Beginning of the Partition

4 Bytes

Number of Sectors Between the MBR and the First Sector in the Partition

0CH

Absolute Sector number of End of the Partition

4 Bytes

Number of Sectors in the Partition

                                       Total = 16 Bytes                   

At the offset 04H, in every partition entry, there is a file system indicator byte. This indicator byte represents the type of file system of that partition. If the value of this byte is changed, the identity of the partition is changed.

For example, the value of partition indicator byte for “DOS 12-Bit FAT” is 0x01. If this value is changed to 0x11, The identity of file system in the partition table entry is changed to “Hidden DOS 12-Bit FAT” (for complete list of partition indicator bytes, refer the chapter “Logical Approach to Disks and OS” discussed earlier in this book).

The table given next shows some more examples of file system indicator byte for some partition types:

Partition type indicator Byte

Description of File System of Partition

0x01

DOS 12–bit  FAT

0x11

Hidden DOS 12–bit  FAT

0x04

DOS 16–bit  FAT (<=32MB)

0x14

Hidden DOS 16–bit  FAT (<=32MB)

0x05

DOS Extended

0x15

Hidden DOS Extended

0x06

DOS 16–bit big (> 32MB)

0x16

Hidden DOS 16–bit big (> 32MB)

0x07

NTFS

0x17

Hidden NTFS

0x0B

Windows FAT32

0x1B

Hidden Windows FAT32

0x0C

Windows FAT32 (LBA)

0x1C

Hidden Windows FAT32 (LBA)

0x0E

Windows FAT16 (LBA)

0x1E

Hidden Windows FAT16 (LBA)

0x0F

Windows Extended

0x1F

Hidden Windows Extended

Here we see that the corresponding hidden partition for any file system is found by adding the value 0x10 to its system indicator byte.

Although it is not the hard and fast rule for hiding the partition yet it works even for most of the file system. The reason behind it is that when we change the value of partition indicator byte, the identity of file system in the partition table entry is changed. And it is very rare that the new file system is also supported by the same operating system.

Sample Chapters from book DATA RECOVERY WITH AND WITHOUT PROGRAMMING by Author Tarun Tyagi
Data Recovery with & without Programming


Publishers of the Book
Number of Pages
ISBN
Price of the Book


BPB Publications, New Delhi, India
540
81-7656-922-4
$69.00 (Including Shipping Charges, Cost of Book and Other expenses, Free Source Code CD included with the Book)





Buy Data recovery Book

 

page 1 | 2 | 3 | 4 | 5 | 6

Next page

 

Chapter 15

 
Previous page

page 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17

 

 

Appendix II

 
 

page 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11

Next page

© Copyright 2002-2005 DataDoctor.Biz

Home | Contact us | Downloads | Services | Terms and conditions | Site map

Website Data Recovery | recuperación de Datos | Récupération de données | Datenrettung | Recupero dati | データ復旧 | 데이터 복구 | 数据恢复 | Восстановление данных | De terugwinning van gegevens | Ανάκτηση δεδομένων
Sitemap Site map1 2 3 4 | Spanish1 2 3 | French1 2 3 | German1 2 3 | Italian1 2 3 | Portuguese1 2 3 | Japanese1 2 3 | Korean1 2 3 | Chinese1 2 3 | Russian1 2 3 | Dutch1 2 3 | Greek1 2 3
Data Recovery Book English | Spanish | French | German | Italian | Portuguese | Japanese | Korean | Chinese | Russian | Dutch | Greek