Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Partitions puzzle

20 Jul 2014   #11
Slartybart

x64 (6.3.9600) Win8.1 Pro & soon dual boot x64 (6.1.7601) Win7_SP1 HomePrem
 
 

I don't think there's an issue with the encrypted parts
See: Recover a TrueCrypt Volume - CGSecurity
Because presence of a TrueCrypt volume can not be verified without the password, disk and filesystems utilities may report the filesystem as unformatted or corrupted that may lead to data loss after incorrect user intervention or automatic "repair".

TestDisk might give you more information as Autopsy did, but I wouldn't take any action if you use TestDisk, just look.
I suggest the dos version since it reads the Disk directly - the windows version depends on the OS.

Don't repair the encrypted parts!

Now why is the unallocated space the same size as the encrypted part? Dunno

I'd have to have a full history of how TrueCrypt was implemented and drive information before TrueCrypt.
The only thing I can think of is that the twins are a hidden encryption with an inner and outer envelope - that's just a guess.

Bill
.


My System SpecsSystem Spec
.
20 Jul 2014   #12
Slartybart

x64 (6.3.9600) Win8.1 Pro & soon dual boot x64 (6.1.7601) Win7_SP1 HomePrem
 
 

I'll try again:
TeraByte Unlimited Knowledge Base
Quote:
TrueCrypt Non-system Partition Encryption
•A standard non-system partition on an internal or external drive. These partitions are seen as RAW/unformatted.
•Standard partition labels cannot be viewed and displayed system type (format) may be incorrect.
Interesting though, researching your issue I came across the demise of TrueCrypt :
TrueCrypt Is Back, But Should It Be? - Forbes
GRC: Final TrueCrypt, Release Repository
TrueCrypt.sourceforge.net: Migrating from TrueCrypt to BitLocker
So the question is ... do you migrate to Bitlocker?
Bill
My System SpecsSystem Spec
20 Jul 2014   #13
Anshad Edavana

Windows 7 Ultimate x64
 
 

Quote:
So am I correct to say that Diskpart shows only currently allocated volumes and that Disk Management shows allocated/ unallocated volumes?

Yes, that is correct. As far as i know "DISKPART" won't list the details of unpartitioned space but "Disk management" will. The small unallocated space between partitions ( 2 MB etc ) is called "Slack Space" in Cyber forensics. Both "Autopsy" and "WinHex" are primarily used for forensic purposes. As these Slack spaces may contain data from previous file systems ( partitions deleted and recreated to destroy evidence ), it is the duty of a forensic investigator to search for evidence in "Slack Spaces" also. That is why "WinHex" and "Autopsy" listed those spaces as volumes - you will be able to create RAW sector by sector images and investigate just like a normal partition.

Quote:

What puzzles me is that Z shows up as the exact same size as unallocated space.
You can permanently decrypt "Z" drive and use "Extend Partition" function of "Disk Management" to add that unallocated space to "Z". Then re-encrypt the new 156 Gb sized "Z" using "TrueCrypt" - plain and simple. I don't get what is confusing you.

My System SpecsSystem Spec
.

20 Jul 2014   #14
Slartybart

x64 (6.3.9600) Win8.1 Pro & soon dual boot x64 (6.1.7601) Win7_SP1 HomePrem
 
 

Thanks Anshad, your post cut to the chase re: unallocated space.

I might be the cause of confusion if there is any. I answered a question that wasn't asked and provided citations on the RAW parts. The citations were only posted to show that some applications make the parts appear RAW to Windows or other utilities.

I might have confused the issue by including the source of the citation (TestDisk and Terabyte imaging) - the citations were important, not the source.

I did not mean to suggest that TestDisk or Terabyte were needed to answer the original question.

Hope that clears up why I posted the two cited works.

Bill
.
My System SpecsSystem Spec
20 Jul 2014   #15
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
Confusion cleared up

Thanks Bill and Anshad. I've decided to remove those encrypted partitions and then use a partition manager to re-order the remaining partitions.

Here's what I see now:

Partitions puzzle-disk-management.jpg

Partitions puzzle-winhex-hard-disk-0-_2.jpg

Autopsy and WinHex both find zero trace of any deleted files. What concerns me is possible data recovery if my machine gets stolen rather than analysis by forensics investigators!

However I will attempt to learn something from Anshad's comments and see if I can work out how to create a RAW Disk Image and inspect it. I'll need to purchase another drive for that though!


My System SpecsSystem Spec
20 Jul 2014   #16
Slartybart

x64 (6.3.9600) Win8.1 Pro & soon dual boot x64 (6.1.7601) Win7_SP1 HomePrem
 
 

Chris, there's no reason not to use encryption.

I suggest creating a extended partition using all of the available space in the unallocated region.
You'll have to use Diskpart.
Diskpart
lis dis
sel dis 0
cre par ext
exit
exit
Quote:
DISKPART> help cre par ext

Creates an extended partition on the disk with focus.
Applies to master boot record (MBR) disks only.

Syntax: CREATE PARTITION EXTENDED [SIZE=<N>] [OFFSET=<N>] [ALIGN=<N>] [NOERR]

SIZE=<N> The size of the partition in megabytes (MB).
If no size is given, the partition continues until there is no more free space in the extended partition.

OFFSET=<N> The offset, in kilobytes (KB), at which the partition is created. If no offset is given, the partition will start at the beginning of the first free space on the disk that is large enough to hold the new partition.

ALIGN=<N> Typically used with hardware RAID Logical Unit Number (LUN) arrays to improve performance. The partition offset will be a multiple of <N>. If the OFFSET parameter is specified, it will be rounded to the closest multiple of <N>.

NOERR For scripting only. When an error is encountered, DiskPart continues to process commands as if the error did not occur.
Without the NOERR parameter, an error causes DiskPart to exit with an error code.

After the partition has been created, the focus automatically shifts to the new partition. Only one extended partition can be created per disk. This command fails if you attempt to create an extended partition within another extended partition. You must create an extended partition before you can create logical partitions.

A basic MBR disk must be selected for this operation to succeed.

Example: CREATE PARTITION EXTENDED SIZE=1000
Then you can use Disk Mgmt. to create your partitions and volumes.

I don't use encryption, so you might have to use the application to create the volumes - not sure of the order.

Bill
.
My System SpecsSystem Spec
20 Jul 2014   #17
gregrocker

 

You would have had the perfect sizing of C and D if you'd followed my original advice to extend each into the deleted RAW partitions space. Now you have a tiny OS partition followed by a big data partition and all your deleted space on the right of it.

Use the Partition Wizard Extend feature to reallocate the Unallocated space into C and then D as desired: How to extend partition easily with Partition Wizard - video help.
My System SpecsSystem Spec
21 Jul 2014   #18
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
Partition size

Hi gregrocker,

I don't see the need to extend the windows partition as I try to keep as much non windows data as possible on the other partition like downloads, documents, music, video and so on. The windows partition I try to keep just for windows along with installed programs. Is there any benefit in extending partitions to use all available space? I find that wiping free space and other maintenance takes less time on smaller partitions.

Thanks!

My System SpecsSystem Spec
21 Jul 2014   #19
gregrocker

 

No prob if you had a different idea of what you wanted. I thought you might have missed the suggestion.
My System SpecsSystem Spec
21 Jul 2014   #20
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
TestDisk

Quote   Quote: Originally Posted by Slartybart View Post
TestDisk might give you more information as Autopsy did, but I wouldn't take any action if you use TestDisk, just look.
.
Thanks Bill, TestDisk doesn't find anything much that's been deleted - it finds only very recently deleted files and that's good to know. I'm still using encryption on external drives.
My System SpecsSystem Spec
Reply

 Partitions puzzle




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Puzzle By This
Was watching my computer and the gadget show high CPU usage. Click on it expecting many one of my programs was running in the background but noticed the following screen shot. Does anyone know what DSD_5996 is?
General Discussion
Forum puzzle
I was trying out how a picture as a link would work. I tried with 2 identical strings. The first one would not work and the second worked. Go figure - as far as I can see they are exactly the same. Does anybody see a difference. If you copy/paste them from the script into a Notepad or Wordpad, they...
Chillout Room
Monitor Puzzle
Re: 7 o/s. During running of a system test, a pop-up appeared saying the following; Current input timing is not supported by the monitor display. Change input timing to 1600x900 60Hz. Because I was stuck and it wouldn't go any further, no matter what buttons I pushed on my monitor, I shut it down...
Graphic Cards
Today's Puzzle
There are three discs, Each on has a "7" on one side and an "8" on the other side. If thrown up radomly, how many combinations of numbers is possible. (Example "777" "888" etc)
Chillout Room
Network puzzle
Can anybody help before I become even more hairless! I've been trying to sort out this for many hours. I have - a recently purchased Windows 7 Pro Lenovo T420 laptop which is wireless an XP Pro IBM T43 wireless laptop a Dell XP Home desktop connected to my wireless router by Ethernet...
Network & Sharing
slow internet puzzle
hi every1, I had win 7(32 bit) ultimate installed and while downloading from sites like mediafire, megaupload I used to get transfer rate upto 300 Kb/sec (my broadband speed is 128b KBPS) then due to some problem I had to format my HD and install vista which came along with my PC. Now the...
Network & Sharing


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 06:17.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App