Partitions on a USB...
 
Notifications
Clear all

Partitions on a USB Drive

11 Posts
6 Users
0 Likes
810 Views
(@nathan_84)
Posts: 31
Eminent Member
Topic starter
 

Hi could somebody please point me in the right direction….

I have a 1gb usb stick which I have partitioned. The primary partition is around 850 MB and remaining free space was used for the extended partition.

I wish to hide the second partition. I've used both the registry "NoDrive" DWORD value and DiskPart - Both methods worked fine.

However I suddenly thought to myself, "let me see if the extended partition is hidden when the usb drive is plugged into another PC. Obviously the drive appeared!

Now I tried using Partition Magic 8.0, which worked perfectly fine. However I really would like to know if there is another way of doing this. I'm trying to improve my own knowledge and feel somehow I'm cheating myself by applying a click "hide partition" with Partition Magic.

Thanks

Nathan

 
Posted : 08/04/2010 7:08 am
(@athulin)
Posts: 1156
Noble Member
 

I wish to hide the second partition. I've used both the registry "NoDrive" DWORD value and DiskPart - Both methods worked fine.

Hide from whom?

The 'NoDrive' method does not hide partitions/volumes – it hide drive letters. Volumes on a USB drive need not be assigned to the same drive letters for ever – if another drive ges the 'hidden' letters, the partition you are trying to hide will be given another, possibly non-hidden one.
This method clearly only is useful for users on the same computer, or users who on the network who access shared drives on that computer, and for fixed drives. Also, the hidden drives still appear in FileManager, so they're not hidden very well.

The DiskPart method probably (as you haven't described it) flags the partition as hidden, which should prevent it from being assigned a drive letter – at least to systems following that convention. Not all do. That doesn't mean it won't be visible to users who know how to use DiskPart. I'm not clear on why it failed, though. A guess is that the change didn't make it to the drive.

However I really would like to know if there is another way of doing this. I'm trying to improve my own knowledge and feel somehow I'm cheating myself by applying a click "hide partition" with Partition Magic.

Begin by defining who you want to hide the partition from and why. It's pretty clear that any tool that reads the partition table off the stick will 'see' that there is a partition entry. (Try PartInfoNT that comes with PartitionMagic.) And if you can run DiskPart then so can anyone else.

If you want to prevent access (to some undefined degree), you may want to consider the protection mechanisms built into NTFS. Those can be bypassed without too much of a bother, though, so you may need to go for solutions based on encryption.

 
Posted : 08/04/2010 12:00 pm
(@farmerdude)
Posts: 242
Estimable Member
 

Hi Nathan,

If you want to hide it you could approach it from a few angles - one of which is to simply enter a TYPEID that your operating system doesn't support (such as Minix, Solaris, ETC.).

Cheers!

farmerdude

www.onlineforensictraining.com

www.forensicbootcd.com

 
Posted : 08/04/2010 8:58 pm
(@nathan_84)
Posts: 31
Eminent Member
Topic starter
 

Hi athulin,

I am just playing around with the USB drive and have no intention of hiding it from anyone. I'm simply doing this activity for my own educational purposes.

I'm basically trying to hide random data on this USB drive using numerous techniques such as ADS, Stenography, Slack Space, etc.

I was keen to hide the partition on the USB drive permanently regardless of which PC the device is inserted into.

I discovered the "NoDrive" would only be appropriate for that particular PC.

I then used Partition Magic to hide the drive. Using DiskPart I was able to confirm the drive was not visible at all. Whist using the NoDrive method the partition was still available.

Sorry for not being clear in my original post.

Thanks for your response.

 
Posted : 09/04/2010 6:08 am
(@nathan_84)
Posts: 31
Eminent Member
Topic starter
 

Hi Farmerdude,

Can you explain abit more about TYPEID as I'm slightly confussed (

Thanks!

 
Posted : 09/04/2010 6:21 am
(@twjolson)
Posts: 417
Honorable Member
 

What about using a hidden fat32 partition? Partition hex flag 1C. I'm sure if you b*m around the net for a little bit you can find programs that create such partitions.

 
Posted : 09/04/2010 12:12 pm
(@farmerdude)
Posts: 242
Estimable Member
 

Hi Nathan,

Sure - what are you confused about? Try setting the tag to something that your Windows environment doesn't support, attach the thumb drive, and see what Windows does.

Cheers!

farmerdude

Get SMART
www.onlineforensictraining.com

www.forensicbootcd.com

 
Posted : 12/04/2010 8:24 pm
keydet89
(@keydet89)
Posts: 3568
Famed Member
 

Nathan,

A little Googling will net you…

http//www.win.tue.nl/~aeb/partitions/partition_types-1.html
http//www.partitionwizard.com/help/change-partition-type-id.html
…etc…

 
Posted : 12/04/2010 8:27 pm
(@nathan_84)
Posts: 31
Eminent Member
Topic starter
 

Farmerdude I understand what you mean now. Sorry for being so slow!

Keydet89 thank you for the links, there very helpful.

I'm just experimenting right now to find a type id which both Windows XP and Ubuntu 9.10 don't support.

Thanks again for your help guys! D

Nathan

 
Posted : 13/04/2010 3:00 am
(@farmerdude)
Posts: 242
Estimable Member
 

Hi Nathan,

No worries! Good to hear ya understand my dribble better now! )

You'll find that Linux will recognize many more types than Windows. Feel free to update us with what you find.

Cheers!

farmerdude

Get SMART!
www.onlineforensictraining.com

www.forensicbootcd.com

 
Posted : 13/04/2010 5:59 pm
Page 1 / 2
Share: