Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.


Windows 7: Partitions puzzle

19 Jul 2014   #1
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
Partitions puzzle

Here's a few screenshots all from the same machine.

Diskpart shows:

Partitions puzzle-diskpart.jpg

Disk Management shows:

Partitions puzzle-computer-management.jpg

Autopsy shows:

Partitions puzzle-autopsy-3.1.jpg

So am I correct to say that Diskpart shows only currently allocated volumes and that Disk Management shows allocated/ unallocated volumes? What puzzles me is that Z shows up as the exact same size as unallocated space.

Autopsy shows 8 volumes (4 unallocated) although it can only read the data on two of them. That's Drive C Windows and Drive D Data (Volumes 2 & 5 in the Autopsy screenshot).

As far as I can work out the following actually exist - 4 NTFS partitions:

Drive C Windows
Drive D Data
Drive X Encrypted
Drive Z Encrypted

Then there's a Virtual Disk that doesn't appear to show up in Diskpart or Disk Management.

Does that mean that Disk Management shows all unallocated space in "one" block?




My System SpecsSystem Spec
.
19 Jul 2014   #2
whs
Microsoft MVP

Vista, Windows7, Mint Mate, Zorin, Windows 8
 
 

You have 4 partitions and that's what diskpart and disk management show. Disk management also showa 78GB of unallocated space.
My System SpecsSystem Spec
19 Jul 2014   #3
Slartybart

x64 (6.3.9600) Win8.1 Pro & soon dual boot x64 (6.1.7601) Win7_SP1 HomePrem
 
 

Quote   Quote: Originally Posted by Callender View Post
.....
So am I correct to say that Diskpart shows only currently allocated volumes and that Disk Management shows allocated/ unallocated volumes? What puzzles me is that Z shows up as the exact same size as unallocated space.

Autopsy shows 8 volumes (4 unallocated) although it can only read the data on two of them. That's Drive C Windows and Drive D Data (Volumes 2 & 5 in the Autopsy screenshot).

As far as I can work out the following actually exist - 4 NTFS partitions:

Drive C Windows
Drive D Data
Drive X Encrypted
Drive Z Encrypted

Then there's a Virtual Disk that doesn't appear to show up in Diskpart or Disk Management.

Does that mean that Disk Management shows all unallocated space in "one" block?
Diskpart and Disk Mgmt. really only know Windows file systems (FAT, FAT32, NTFS).
They both show the exact same information, except Disk Mgmt. gives you a little more on the bottom panel (unallocated space). Diskpart gives you the ability to use the unallocated space, but I don't know if you can display the information - you have to do the math when adding or creating parts/vols.

Is the Virtual Disk mounted? If it is, Disk Mgmt. should show it... I think

Many programs can and do utilize raw parts/vols - I'm guessing that because those parts/vols are encrypted that both Diskpart and Disk Mgmt. sees them as RAW.

Disk Mgmt. does not show all unallocated space (free space on logical drive) in one block. I've had different disk schemas where there was allocated, unallocated, allocated, unallocated while I was unravelling OEM use of the four parts.

I don't know anything about Autopsy so I can't address what it shows. It is most likely showing some history of the drive, where parts/vols were added or deleted. The information is still around and most recovery utilizes will display all of the part addressing schemas. This takes doing the math to sort it out, I'm being lazy on a Saturday

Bill
.
My System SpecsSystem Spec
.

19 Jul 2014   #4
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
Unallocated Space

Thanks very much for the explanations! I wasn't sure what it all meant. Further research appears to show that virtual drives won't show up in disk management anyway.
My System SpecsSystem Spec
19 Jul 2014   #5
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
More info

Just in case anyone else has a similar question - WinHex makes it pretty clear.


Attached Images
Partitions puzzle-winhex-hard-disk-0-.jpg 
My System SpecsSystem Spec
19 Jul 2014   #6
gregrocker

 

No one noticed that two of your partitions are marked RAW which means ruined. If you have data on them I'd try to rescue it now.

Then test your hard drive immediately with the maker's HD Diagnostic extended CD scan, followed by Disk Check.

However before doing the DIsk check I would delete the RAW partitions and extend both C and D to the right. Note that to delete X since it is Logical will require deleting it's Volume first and then Partition - two deletes, one after the other: Partition or Volume - Delete
Partition or Volume - Extend

Then Disk Check C and D.
My System SpecsSystem Spec
19 Jul 2014   #7
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
Delete RAW partitions

Thanks Gregrocker. Those two partitions are encrypted and work fine if mounted after entering passwords.

Thanks for the tip on deleting Logical Partitions. It's good to learn something that I might need to know in future!

I run Disk Checks at least once every week and sometimes more often if I've been installing/ removing lots of software or making other major changes.

My System SpecsSystem Spec
19 Jul 2014   #8
gregrocker

 

I don't know why encrypted partitions would read as RAW. It would concern me enough to want to know the condition of the drive and why they are RAW.

The C partition is way too small for most so I would extend it anyway, deleting Z after moving the data to an extended data partition which you could then encrypt if this is absolutely necessary given that we see a lot of problems with this.
My System SpecsSystem Spec
19 Jul 2014   #9
Slartybart

x64 (6.3.9600) Win8.1 Pro & soon dual boot x64 (6.1.7601) Win7_SP1 HomePrem
 
 

You didn't say what encryption software you're using

Taking a second look, I would caution against trying to create a new part/vol in the unallocated space

You have 4 parts/vols - the limit for MBR initialized disks. I'm not sure how encrypted disks apply to that limit though.

You might get the dynamic warning - which if not declined causes boot issues.
The Diskpart command retain mentions dynamic volumes, but that's all I can tell you... I've never used it to prepare a dynamic disk for boot.


DISKPART> help retain
Prepares an existing dynamic simple volume to be used as a boot or system volume.
Syntax: RETAIN
This command creates a partition entry for the dynamic simple volume with focus.
A dynamic simple volume must be selected for this operation to succeed.
Example:
RETAIN
My System SpecsSystem Spec
19 Jul 2014   #10
Callender

Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
 
 
Create a partition

Quote   Quote: Originally Posted by Slartybart View Post
You didn't say what encryption software you're using

Taking a second look, I would caution against trying to create a new part/vol in the unallocated space
Thanks Bill, I tried to rep you but can't! I'm also wary of the unallocated space as it appears to be exactly the same size as the Truecrypt encrypted volume. Looking again at those screenshots I notice that:

Windows (Disk Management) shows those encrypted partitions as RAW. (When unmounted). If I mount them they show up as NTFS.

Autopsy shows the same drives as NTFS. (When unmounted). About the only difference that I can think of is that Autopsy is run with admin rights.

WinHex can't detect the format. (When unmounted).

As far as I know windows has always shown those encrypted partitions as RAW and attempting to mount them or access them with windows has always resulted in the "You Need To Format This Drive" message. It's been like that for a couple of years. I never thought that this was a problem. If I mount those partitions they do indeed then show up as NTFS until they're dismounted. I have full backups on an external drive and those backups are also encrypted and they also show up as RAW until they're actually mounted.
My System SpecsSystem Spec
Reply

 Partitions puzzle




Thread Tools Search this Thread
Search this Thread:

Advanced Search




Similar help and support threads
Thread Forum
Puzzle By This
Was watching my computer and the gadget show high CPU usage. Click on it expecting many one of my programs was running in the background but noticed the following screen shot. Does anyone know what DSD_5996 is?
General Discussion
Forum puzzle
I was trying out how a picture as a link would work. I tried with 2 identical strings. The first one would not work and the second worked. Go figure - as far as I can see they are exactly the same. Does anybody see a difference. If you copy/paste them from the script into a Notepad or Wordpad, they...
Chillout Room
Monitor Puzzle
Re: 7 o/s. During running of a system test, a pop-up appeared saying the following; Current input timing is not supported by the monitor display. Change input timing to 1600x900 60Hz. Because I was stuck and it wouldn't go any further, no matter what buttons I pushed on my monitor, I shut it down...
Graphic Cards
Today's Puzzle
There are three discs, Each on has a "7" on one side and an "8" on the other side. If thrown up radomly, how many combinations of numbers is possible. (Example "777" "888" etc)
Chillout Room
Network puzzle
Can anybody help before I become even more hairless! I've been trying to sort out this for many hours. I have - a recently purchased Windows 7 Pro Lenovo T420 laptop which is wireless an XP Pro IBM T43 wireless laptop a Dell XP Home desktop connected to my wireless router by Ethernet...
Network & Sharing
slow internet puzzle
hi every1, I had win 7(32 bit) ultimate installed and while downloading from sites like mediafire, megaupload I used to get transfer rate upto 300 Kb/sec (my broadband speed is 128b KBPS) then due to some problem I had to format my HD and install vista which came along with my PC. Now the...
Network & Sharing


Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

Designer Media Ltd

All times are GMT -5. The time now is 10:24.

Twitter Facebook Google+



Windows 7 Forums

Seven Forums Android App Seven Forums IOS App