Re: Cloned disk "thinks" it is much smaller than it is.

Discussion in 'Computer Security' started by Nomen Nescio, Aug 12, 2005.

  1. Nomen Nescio

    Nomen Nescio Guest

    Apologies for not having mentioned the cloning software used; I don't
    recall (it was done half a year ago); it was not Norton Ghost.
    The OS is Win2K and the BIOS recognizes 200MB drives fine.

    The issue is "now what?" Are there some bytes in some sector that I can
    find with a disk editor and change them so that the disk will now "know"
    its true size? Is there any other fix other than a complete
    re-installation?
    If I were to clone the present 200GB drive (which thinks it is an 80GB
    one) to a third drive, say, a 200GB one, which software would you
    recommend to use so that this third drive will not "think" it is an 80GB
    one?

    And, by the way, this IS a security issue in the following sense: Could
    one hide data in the seemingly inaccessible 200-80 GB space, and access
    it with some other software? Would Encase see it?
    Nomen Nescio, Aug 12, 2005
    #1
    1. Advertising

  2. Nomen Nescio

    bellaw Guest

    Nomen Nescio wrote:
    > Apologies for not having mentioned the cloning software used; I don't
    > recall (it was done half a year ago); it was not Norton Ghost.
    > The OS is Win2K and the BIOS recognizes 200MB drives fine.
    >
    > The issue is "now what?" Are there some bytes in some sector that I can
    > find with a disk editor and change them so that the disk will now "know"
    > its true size? Is there any other fix other than a complete
    > re-installation?
    > If I were to clone the present 200GB drive (which thinks it is an 80GB
    > one) to a third drive, say, a 200GB one, which software would you
    > recommend to use so that this third drive will not "think" it is an 80GB
    > one?
    >
    > And, by the way, this IS a security issue in the following sense: Could
    > one hide data in the seemingly inaccessible 200-80 GB space, and access
    > it with some other software? Would Encase see it?

    my suggestion would be to format a another drive using partion magic
    magic then clone the 200/80 gb onto that with norton ghost then
    re-format the 200/80 gb drive to the size of 200 gb
    lawrie
    bellaw, Aug 13, 2005
    #2
    1. Advertising

  3. Nomen Nescio

    nemo_outis Guest

    Nomen Nescio <> wrote in
    news::

    > Apologies for not having mentioned the cloning software used; I don't
    > recall (it was done half a year ago); it was not Norton Ghost.
    > The OS is Win2K and the BIOS recognizes 200MB drives fine.
    >
    > The issue is "now what?" Are there some bytes in some sector that I
    > can find with a disk editor and change them so that the disk will now
    > "know" its true size? Is there any other fix other than a complete
    > re-installation?
    > If I were to clone the present 200GB drive (which thinks it is an 80GB
    > one) to a third drive, say, a 200GB one, which software would you
    > recommend to use so that this third drive will not "think" it is an
    > 80GB one?
    >
    > And, by the way, this IS a security issue in the following sense:
    > Could one hide data in the seemingly inaccessible 200-80 GB space, and
    > access it with some other software? Would Encase see it?




    As a WAG the problem may arise from:

    1. Your ghosting, if done in sector-by-sector mode, copied - and later
    restored - the "original" partition table. If so, that table will have
    "old" information about partition cylinder boundaries, etc. (or the
    equivalent re LBA).

    2. Some NTFS partitions/drives implicitly contain metadata about the
    drive size in the MFT and related structures.

    The first is reasonably easy to fix - edit the table directly if you
    know what you're doing, or find a partition mamager/resizer that will
    handle it (most should?).. I don't have a clue about the second problem
    except to know it exists and that there are several Norton Ghost
    switches to handle it (e.g., -ntexact, -ntiid, etc.).

    Regards,
    nemo_outis, Aug 13, 2005
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Matthew Melbourne
    Replies:
    0
    Views:
    740
    Matthew Melbourne
    Nov 11, 2003
  2. DL

    Powerpoint 2000 file saved much smaller

    DL, Dec 24, 2003, in forum: Computer Support
    Replies:
    2
    Views:
    368
    Mellowed
    Dec 24, 2003
  3. Geshu Iam
    Replies:
    7
    Views:
    844
    Roland Karlsson
    Aug 17, 2004
  4. Nomen Nescio

    Cloned disk "thinks" it is much smaller than it is.

    Nomen Nescio, Aug 12, 2005, in forum: Computer Security
    Replies:
    5
    Views:
    467
    Jim Watt
    Aug 12, 2005
  5. =?Utf-8?B?dGhhbmt5b3U=?=

    font of the active title bar appears smaller and smaller automatic

    =?Utf-8?B?dGhhbmt5b3U=?=, Oct 12, 2005, in forum: Windows 64bit
    Replies:
    1
    Views:
    627
    Tony Sperling
    Oct 12, 2005
Loading...

Share This Page