Partition size larg...
 
Notifications
Clear all

Partition size larger than reported drive size

13 Posts
4 Users
0 Reactions
2,500 Views
HexDrugsRockNRoll
(@hexdrugsrocknroll)
Trusted Member
Joined: 17 years ago
Posts: 60
Topic starter  

Thanks, Rob.

I'm wondering if perhaps you're right, and that it was a disk restore that failed towards the end.

The weird thing is that the partition entry in the MBR shows 298GB, whereas it actually just stops dead at 279GB, mid-file. Nothing will show me any data after that 279GB - if I look at the data contained within the movie file at the end of the drive, I can scroll right to the end and see 0x00s, however if I switch to Disk View (a la EnCase), it shows me a blank screen and then drops be back to the last viewable sector, which is at the end of the 279GB.

Am I being clear as mud? Sorry. It's just very strange.


   
ReplyQuote
ForensicRob
(@forensicrob)
Eminent Member
Joined: 20 years ago
Posts: 26
 

I think the 0x00s are filler, that your tool is using, to handle when it can't read the disk sector.

If the sticker on the hard drive says the drive is 298GB (or 320GB), then that makes it sound like the drive really does contain those missing sectors but that they are somehow unreachable. If HPA and DCO are ruled out, is there a proprietary drive setting that can affect the drive's accessible size? Do you have a tool that you can use from the vendor of this drive?


   
ReplyQuote
HexDrugsRockNRoll
(@hexdrugsrocknroll)
Trusted Member
Joined: 17 years ago
Posts: 60
Topic starter  

I've identified the computer that this external drive was connected to - there is Buffalo software (the make of the external caddy) installed which allows for file and filesystem encryption. I haven't had a chance to play with it yet, but a read of the manual doesn't state anything about sectioning off part of the drive.

What sticks in my mind is that fdisk -l in Linux shows the drive as 300GB. I find it really hard to get beyond the idea that the cut of point is 300GB (279GB) by accident. 20GB is plenty to hide bad stuff in.


   
ReplyQuote
Page 2 / 2
Share: