It may happen when you disconnect the storage device (flash drive) without using "safely remove hardware" option, then, when you connect the drive the OS will say "You need to format the disk in drive X: before you can use it.".
Typically such a behavior means that you have a RAW file system. Obviously, initial filesystem on your drive was corrupted because the data stored in the buffer during disconnection of the drive was lost due to inappropriate disconnection.
You can quickly solve the problem by simply formatting the drive, but be aware that the data would be gone forever according to the format level you use. If the data is important you need to retrieve data first and only then format the drive. Data recovery in case of RAW filesystem is like unformat and easy to do - just download some data recovery software.
Sunday, April 10, 2011
Monday, March 28, 2011
Make a software RAID bootable?
Can one create a bootable software RAID0, RAID5, or JBOD containing a Windows installation?
The answer is No. One cannot run an operating system from a software RAID0, RAID 5, or spanned volume.
A hardware RAID controller is required to be able to make a RAID bootable.
It is not possible to boot off the software RAID because the RAID is not readable until the operating system is fully loaded, and the OS itself is on the RAID.
One can only start an OS from a software RAID1, and even that is not trivial. To boot from a "second" hard drive of a software RAID1, you probably need to manually copy the MBR first.
The answer is No. One cannot run an operating system from a software RAID0, RAID 5, or spanned volume.
A hardware RAID controller is required to be able to make a RAID bootable.
It is not possible to boot off the software RAID because the RAID is not readable until the operating system is fully loaded, and the OS itself is on the RAID.
One can only start an OS from a software RAID1, and even that is not trivial. To boot from a "second" hard drive of a software RAID1, you probably need to manually copy the MBR first.
Tuesday, March 8, 2011
Hard Drives with Full Encryption
Certain modern hard drives have built-in a hardware-based 256-bit AES encryption.
Surprisingly though, the content on these is encrypted even if no password was set. If the encryption chip quits, the cipher key is lost and hence data cannot be recovered despite the fact the storage itself is OK. Considering that in real life a failure of the encryption chip is higher probability even than the drive getting into enemy hands, the continuous encryption is likely not a very bright idea.
Why the heck did they do that in such a way? The rationale behind such a decision is a speed of a password change. If there is a policy of "no password = no encryption", once the password is set or changed, the full capacity of the disk needs to be re-encrypted, taking some hours. And this even before we start looking into other complications like multiple consequent power failures during reciphering. The same consideration exists when the password is removed.
So the engineers implement the faster option. The master encryption key which is actually used to encrypt the data is initialized during the production and flashed into controller's NVRAM. All the data on the disk is encrypted using this master key, regardless if the user sets the password. If user requests a password to be set, the master key is encrypted with that password. The contents of the drive being encrypted from the start, you cannot read data not having the master key, and the key is not accessible unless you have the correct password.
Now if the encryption module burns, the data is not accessible at all.
These drives are often used in external enclosures and laptops (anticipating a higher probability of actually losing the drive compared to an internal desktop hard drives), forming a special class of devices in addition to this list. These external drives are fairly hard to recover.
Surprisingly though, the content on these is encrypted even if no password was set. If the encryption chip quits, the cipher key is lost and hence data cannot be recovered despite the fact the storage itself is OK. Considering that in real life a failure of the encryption chip is higher probability even than the drive getting into enemy hands, the continuous encryption is likely not a very bright idea.
Why the heck did they do that in such a way? The rationale behind such a decision is a speed of a password change. If there is a policy of "no password = no encryption", once the password is set or changed, the full capacity of the disk needs to be re-encrypted, taking some hours. And this even before we start looking into other complications like multiple consequent power failures during reciphering. The same consideration exists when the password is removed.
So the engineers implement the faster option. The master encryption key which is actually used to encrypt the data is initialized during the production and flashed into controller's NVRAM. All the data on the disk is encrypted using this master key, regardless if the user sets the password. If user requests a password to be set, the master key is encrypted with that password. The contents of the drive being encrypted from the start, you cannot read data not having the master key, and the key is not accessible unless you have the correct password.
Now if the encryption module burns, the data is not accessible at all.
These drives are often used in external enclosures and laptops (anticipating a higher probability of actually losing the drive compared to an internal desktop hard drives), forming a special class of devices in addition to this list. These external drives are fairly hard to recover.
Monday, February 14, 2011
Recovery of the laptops supplied without a recovery disc
Laptop makers are divided into those who users a recovery CD (which often gets lost) and those makers who do not provide. Vendors who don't provide the recovery disc to their consumers usually place the original installation of Windows to the special invisible partition along with a program that can deploy this OS installation.
Such a partition is placed in the end of the drive and it becomes invisible to the operating system by the means of HPA.
The recovery process in case of a laptop containing Host Protected Area can be the following:
Such a partition is placed in the end of the drive and it becomes invisible to the operating system by the means of HPA.
The recovery process in case of a laptop containing Host Protected Area can be the following:
- you press certain set of keys when the system starts up
- the BIOS discards HPA
- the OS is loaded from the appeared recovery partition
- a factory reset utility runs from this partition. Such a tool reformats the hard disk and copies the original copy of Windows to the drive.
- As the recovery process is finished, HPA is set again.
Sunday, January 16, 2011
What is hard drive capacity clipping?
This post deals mostly with legacy hardware, something you regret not having tossed into the garbage years ago.
The maximum size restrictions on a hard drive did exist because the older LBA standard called LBA28 only allowed 28 bits to address a sector. Therefore, there was a limit of 228 sectors on a hard disk. Given the sector size of 512 bytes, the maximum number of sector addresses is 268435456 sectors, which is precisely 128 gigabytes.
Note that 128 GB (137,438,953,472 bytes) is in fact a little bit more than 137 billion bytes. The drive makers, unlike programmers, use decimal size units speaking about the hard disk size. Because of this, drive vendors can sell a 128GB drive as having size of 137GB (see, e.g., this post).
You can come across a 128GB limit if the mobo is old (something 2002-ish), or while using an OS which is not up to date (similar to Windows 2000 or XP prior to Service Pack 2).
The corrective actions are
The HPA is a feature of a hard drive allowing the OS hide a part of the capacity of the hard drive.
This provides some compatibility for legacy computers, because one can use hard disk in an old PC which cannot handle large hard disks.
If turned on inadvertently, the HPA fools the operating system to believe that the hard drive is smaller than it should be. If this is not desired, you can reset the HPA, usually with some vendor-supplied software.
The maximum size restrictions on a hard drive did exist because the older LBA standard called LBA28 only allowed 28 bits to address a sector. Therefore, there was a limit of 228 sectors on a hard disk. Given the sector size of 512 bytes, the maximum number of sector addresses is 268435456 sectors, which is precisely 128 gigabytes.
Note that 128 GB (137,438,953,472 bytes) is in fact a little bit more than 137 billion bytes. The drive makers, unlike programmers, use decimal size units speaking about the hard disk size. Because of this, drive vendors can sell a 128GB drive as having size of 137GB (see, e.g., this post).
You can come across a 128GB limit if the mobo is old (something 2002-ish), or while using an OS which is not up to date (similar to Windows 2000 or XP prior to Service Pack 2).
The corrective actions are
- Flashing the latest possible mobo BIOS. This may or may not work, depending on the specific mainboard.
- Updating the OS. If other components are up to speed, that in most cases solves the problem.
The HPA is a feature of a hard drive allowing the OS hide a part of the capacity of the hard drive.
This provides some compatibility for legacy computers, because one can use hard disk in an old PC which cannot handle large hard disks.
If turned on inadvertently, the HPA fools the operating system to believe that the hard drive is smaller than it should be. If this is not desired, you can reset the HPA, usually with some vendor-supplied software.
Subscribe to:
Posts (Atom)