Partitions puzzle

Here's a few screenshots all from the same machine.

Diskpart shows:



Disk Management shows:



Autopsy shows:



So am I correct to say that Diskpart shows only currently allocated volumes and that Disk Management shows allocated/ unallocated volumes? What puzzles me is that Z shows up as the exact same size as unallocated space.

Autopsy shows 8 volumes (4 unallocated) although it can only read the data on two of them. That's Drive C Windows and Drive D Data (Volumes 2 & 5 in the Autopsy screenshot).

As far as I can work out the following actually exist - 4 NTFS partitions:

Drive C Windows
Drive D Data
Drive X Encrypted
Drive Z Encrypted

Then there's a Virtual Disk that doesn't appear to show up in Diskpart or Disk Management.

Does that mean that Disk Management shows all unallocated space in "one" block?

You have 4 partitions and that's what diskpart and disk management show. Disk management also showa 78GB of unallocated space.

Callender said:

.....
So am I correct to say that Diskpart shows only currently allocated volumes and that Disk Management shows allocated/ unallocated volumes? What puzzles me is that Z shows up as the exact same size as unallocated space.

Autopsy shows 8 volumes (4 unallocated) although it can only read the data on two of them. That's Drive C Windows and Drive D Data (Volumes 2 & 5 in the Autopsy screenshot).

As far as I can work out the following actually exist - 4 NTFS partitions:

Drive C Windows
Drive D Data
Drive X Encrypted
Drive Z Encrypted

Then there's a Virtual Disk that doesn't appear to show up in Diskpart or Disk Management.

Does that mean that Disk Management shows all unallocated space in "one" block?

Diskpart and Disk Mgmt. really only know Windows file systems (FAT, FAT32, NTFS).
They both show the exact same information, except Disk Mgmt. gives you a little more on the bottom panel (unallocated space). Diskpart gives you the ability to use the unallocated space, but I don't know if you can display the information - you have to do the math when adding or creating parts/vols.

Is the Virtual Disk mounted? If it is, Disk Mgmt. should show it... I think

Many programs can and do utilize raw parts/vols - I'm guessing that because those parts/vols are encrypted that both Diskpart and Disk Mgmt. sees them as RAW.

Disk Mgmt. does not show all unallocated space (free space on logical drive) in one block. I've had different disk schemas where there was allocated, unallocated, allocated, unallocated while I was unravelling OEM use of the four parts.

I don't know anything about Autopsy so I can't address what it shows. It is most likely showing some history of the drive, where parts/vols were added or deleted. The information is still around and most recovery utilizes will display all of the part addressing schemas. This takes doing the math to sort it out, I'm being lazy on a Saturday :)

Bill
.

Thanks very much for the explanations! I wasn't sure what it all meant. Further research appears to show that virtual drives won't show up in disk management anyway.

Just in case anyone else has a similar question - WinHex makes it pretty clear.

Thanks Gregrocker. Those two partitions are encrypted and work fine if mounted after entering passwords.

Thanks for the tip on deleting Logical Partitions. It's good to learn something that I might need to know in future!

I run Disk Checks at least once every week and sometimes more often if I've been installing/ removing lots of software or making other major changes.

:)

You didn't say what encryption software you're using :)

Taking a second look, I would caution against trying to create a new part/vol in the unallocated space

You have 4 parts/vols - the limit for MBR initialized disks. I'm not sure how encrypted disks apply to that limit though.

You might get the dynamic warning - which if not declined causes boot issues.
The Diskpart command retain mentions dynamic volumes, but that's all I can tell you... I've never used it to prepare a dynamic disk for boot.


DISKPART> help retain

Prepares an existing dynamic simple volume to be used as a boot or system volume.

Syntax: RETAIN

This command creates a partition entry for the dynamic simple volume with focus.
A dynamic simple volume must be selected for this operation to succeed.

Example:

RETAIN

Slartybart said:

You didn't say what encryption software you're using :)

Taking a second look, I would caution against trying to create a new part/vol in the unallocated space

Thanks Bill, I tried to rep you but can't! I'm also wary of the unallocated space as it appears to be exactly the same size as the Truecrypt encrypted volume. Looking again at those screenshots I notice that:

Windows (Disk Management) shows those encrypted partitions as RAW. (When unmounted). If I mount them they show up as NTFS.

Autopsy shows the same drives as NTFS. (When unmounted). About the only difference that I can think of is that Autopsy is run with admin rights.

WinHex can't detect the format. (When unmounted).

As far as I know windows has always shown those encrypted partitions as RAW and attempting to mount them or access them with windows has always resulted in the "You Need To Format This Drive" message. It's been like that for a couple of years. I never thought that this was a problem. If I mount those partitions they do indeed then show up as NTFS until they're dismounted. I have full backups on an external drive and those backups are also encrypted and they also show up as RAW until they're actually mounted.