|
Posted by nemo_outis on August 13, 2005, 3:25 pm
If you were Registered and logged in, you could reply and use other advanced thread options
> Apologies for not having mentioned the cloning software used; I don't
> recall (it was done half a year ago); it was not Norton Ghost.
> The OS is Win2K and the BIOS recognizes 200MB drives fine.
>
> The issue is "now what?" Are there some bytes in some sector that I
> can find with a disk editor and change them so that the disk will now
> "know" its true size? Is there any other fix other than a complete
> re-installation?
> If I were to clone the present 200GB drive (which thinks it is an 80GB
> one) to a third drive, say, a 200GB one, which software would you
> recommend to use so that this third drive will not "think" it is an
> 80GB one?
>
> And, by the way, this IS a security issue in the following sense:
> Could one hide data in the seemingly inaccessible 200-80 GB space, and
> access it with some other software? Would Encase see it?
As a WAG the problem may arise from:
1. Your ghosting, if done in sector-by-sector mode, copied - and later
restored - the "original" partition table. If so, that table will have
"old" information about partition cylinder boundaries, etc. (or the
equivalent re LBA).
2. Some NTFS partitions/drives implicitly contain metadata about the
drive size in the MFT and related structures.
The first is reasonably easy to fix - edit the table directly if you
know what you're doing, or find a partition mamager/resizer that will
handle it (most should?).. I don't have a clue about the second problem
except to know it exists and that there are several Norton Ghost
switches to handle it (e.g., -ntexact, -ntiid, etc.).
Regards,
| 
XML site map