Jump to content











Photo
- - - - -

disk signature written by diffrent tools or grub4dos (partnew)


  • Please log in to reply
14 replies to this topic

#1 tjung

tjung

    Member

  • Members
  • 37 posts
  •  
    Germany

Posted 12 August 2010 - 08:08 AM

Hello,

Somewhere I found the information that 0xff 0xff 0xff 0xff
(4 bytes, offset 440 in MBR) is the disk signature if a new disk is
portioned by/within Windows NT. Is that right?

I have found different entries at my disk. e.g.:
7A 28 6A DD or F0 8F E6 5E

Does anybody know if there is an overview which application or
OS write which disk identifier/signature or does anybody knows
what apps wirte these signatures above?

I assume Partition Magic and freedos fdisk, but not sure and
don't know which one belongs to which application.

Does anybody know what signature GParted and/or parted write
to the harddisk?

And what disk signature would grub4dos write, if i use partnew
etc. and configure the disk within grub4dos?

T.

#2 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 10,481 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 12 August 2010 - 09:35 AM

Hello,

Somewhere I found the information that 0xff 0xff 0xff 0xff
(4 bytes, offset 440 in MBR) is the disk signature if a new disk is
portioned by/within Windows NT. Is that right?

YES. :mellow: EDIT: (which means NO, see post by dog after mine :unsure: )

I have found different entries at my disk. e.g.:
7A 28 6A DD or F0 8F E6 5E

Sure, that's the idea of a signature, each disk on the same system MUST have a different signature, in order for the OS to "distinguish" them.

Does anybody know if there is an overview which application or
OS write which disk identifier/signature or does anybody knows
what apps wirte these signatures above?

YES. :mellow:
http://homepages.tes...no-answers.html

Now if the question had been:

WHAT writes the disk signature in the MBR?


I could have told you:

ANY NT based operating system

and could have pointed you to here:
http://mirror.href.c.../mbr/index.html
http://mirror.href.c...br/Win2kmbr.htm

I assume Partition Magic and freedos fdisk, but not sure and
don't know which one belongs to which application.

Do not assume too much. :mellow:
(see above)

Does anybody know what signature GParted and/or parted write
to the harddisk?

And what disk signature would grub4dos write, if i use partnew
etc. and configure the disk within grub4dos?

Wrong questions :) (see above).

More interesting things about disk signature:
http://www.911cd.net...showtopic=19960
http://www.911cd.net...showtopic=21242

:unsure:
Wonko

#3 dog

dog

    Frequent Member

  • Expert
  • 233 posts

Posted 12 August 2010 - 11:57 AM

Somewhere I found the information that 0xff 0xff 0xff 0xff
(4 bytes, offset 440 in MBR) is the disk signature if a new disk is
portioned by/within Windows NT. Is that right?

No, the length and offset is right, but the values will be random(ish) if NT set up the drive - you can however set them that way if you prefer :mellow:
Grub4dos partnew doesn't touch the signature.

#4 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 10,481 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 12 August 2010 - 01:32 PM

No, the length and offset is right, but the values will be random(ish) if NT set up the drive - you can however set them that way if you prefer :unsure:
Grub4dos partnew doesn't touch the signature.

Thanks, I edited my previous post, I didn't understand fully the question. :mellow:

:mellow:
Wonko

#5 tjung

tjung

    Member

  • Members
  • 37 posts
  •  
    Germany

Posted 12 August 2010 - 03:53 PM

Hello,

Thank you for your posts and help.
After removing the disk ID I get
a message from Windows (Win 7) that
the disk must be first "initalized"?

See:
http://www.tjung.lim...e/win/ldm/init/

Does this "init" mean, a reformat/repartition
of the entire disk with Logigacl Disk Manager
or just to write a new disk ID to that disk?


T.

#6 dog

dog

    Frequent Member

  • Expert
  • 233 posts

Posted 12 August 2010 - 03:59 PM

I expect it'll wipe everything - especially if you go for GPT.
What was on the disk before, and what did you wipe?

#7 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 10,481 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 12 August 2010 - 04:23 PM

I expect that you need to experiment yourself - of course NOT on a disk that contains any meaningful data.

Anyway, to simply "initialize" the disk (admitted that the disk was already partitioned and contained a MBR, and you ONLY 00ed out the Disk Signature), run MBRFIX:
http://www.sysint.no...ting/mbrfix.htm
or mbrwiz:
http://mbrwizard.com/
and write a signature to it (or use any disk editor and do it manually.

A disk is "initialized" (according to the NT conventions) when it's first sector:
  • contains a non-zero signature value at offset 440
  • contains the magic bytes 55AA at offset 512 510

Then, IF one or more of the four partitin entries contain valid data, it will mount the partitions allright.

The fact that first sector contains MBR code or not is irrelevant (the disk won't be bootable if the CODE is missing, of course).

So, what in theory the "init" should do is to write the Disk Signature, verify that the sector magic bytes are allright (in case write them) leaving the partition table DATA untouched.
At the most it could write the Windows 7 MBR CODE.

DON'T EVEN THINK of using GPT for the moment.

:mellow:
Wonko

#8 dog

dog

    Frequent Member

  • Expert
  • 233 posts

Posted 12 August 2010 - 04:30 PM

The thing is, xp will just give the disk a new signature if the 4 bytes are set to 0x00, I've only seen xp give this kind of prompt if there is no partition table either...

#9 dog

dog

    Frequent Member

  • Expert
  • 233 posts

Posted 13 August 2010 - 02:06 PM

I wiped the signature of a non-system disk on win7, and there were no "initialize" prompts, so I suspect more than just the signature has been wiped.
Wiping the first 440 bytes had the same (lack of) effect, only after wiping 512 bytes did diskmgmt offer to "initialize".
If there was data on the drive you could try testdisk but you really ought to do experimenting on disks that don't matter (or a VM).

#10 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 10,481 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 13 August 2010 - 02:09 PM

Wiping the first 440 bytes had the same (lack of) effect, only after wiping 512 bytes did diskmgmt offer to "initialize".

....including the magic bytes 55AA at offset 510 ....

Try wiping just the 55AA :mellow:

:mellow:
Wonko

#11 dog

dog

    Frequent Member

  • Expert
  • 233 posts

Posted 13 August 2010 - 03:38 PM

Try wiping just the 55AA :mellow:

Yep that worked too :mellow:
Letting win7 "initialize" it wiped the partition table, and I couldn't get testdisk to recover it.
Nasty...

#12 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 10,481 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 13 August 2010 - 05:02 PM

Letting win7 "initialize" it wiped the partition table...

Another good reason to check things by hand the good ol' way before letting the stoopid "automagical" programs take choices instead of you.....:mellow:


... and I couldn't get testdisk to recover it.

Hmm :mellow:

Nasty...

Yes. ;)

;)
Wonko

#13 tjung

tjung

    Member

  • Members
  • 37 posts
  •  
    Germany

Posted 13 August 2010 - 09:49 PM

Hello dog and wonko,

Thank you for your experiences and sharing
you knowledge

It really deleted only the four bytes of
the disk signature, but the day before I
wiped out the sixth hard disk entirely with zeros
and worked the rest of the whole day and
yesterday with linux. :)

So I thought first this message
was related to my first hard disk which holds
no data, just a simple freedos. Will setup
that disk and using it, when I finished my
first tests with grub4dos :mellow:

Was first "slightly" in panik ;) , because I never
have seen such an information/dialog in Windows. I always
use other tools to setup my disks.

But if that message appears, when starting
the disk manager, it seems to be safe to press
cancel and win does not write any code to the disk.
The message comes up again, if starting the disk manager
the next time.

Today I tested that again and there is some
data in the MBR only. Looks like a bootloader,
but not sure if this is the bootloader
of windows 7, but I think so.

T.

#14 xpt

xpt

    Frequent Member

  • Advanced user
  • 105 posts
  •  
    Canada

Posted 14 August 2010 - 01:03 AM

After removing the disk ID I get
a message from Windows (Win 7) that
the disk must be first "initalized"?


I bet if you wipe/change the disk ID of Win 7 boot disk, Win 7 won't able to boot any more. At least that's true for my Win XP.

#15 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 10,481 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 14 August 2010 - 01:45 PM

I bet if you wipe/change the disk ID of Win 7 boot disk, Win 7 won't able to boot any more. At least that's true for my Win XP.

Sure it doesn't :), that's EXACTLY the reason why the Disk Signature is there to begin with, giving an ID to a disk in order to make sure it gets the (right booting) drive letter.

BUT if you delete contents of the
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
key in the Registry, it should boot again (with another signature)

Additionally, you can try using the "XP Kansas City Shuffle":
http://www.911cd.net...showtopic=21242
on Win7 too...

:mellow:
Wonko




1 user(s) are reading this topic

0 members, 1 guests, 0 anonymous users