Need advice with disk partitions; (should D: be NTFS?)

[mrirondream]

Hi Folks

I've got some questions for you clever people regarding the disk partitions on my HP Pavilion G6 laptop. The machine has been running more or less smoothly for probably over a year now - but my question originates from a result given to me by my anti-virus software.

I'm going to separate this post into the key headings for ease of access. My main query is under 'about the partitions', so feel free to skip to here if you just want a quick glance. However the rest will make things clearer for you most likely.


Background:

I am running BtNetprotect + antivirus software, and have had no quarrels with it as such. Upon completing a full system scan, the program returns a list of results that looks something like this;

Items scanned [number]

Issues found 0
Issues fixes 0

Potentially unwanted programs found 0
Potentially unwanted programs fixed 0

Boot records 3

This is likely not exactly how it looks, but you get the idea. Now, it's the 'boot records' field which seems to cause a lot of confusion for people.

My understanding is that all hard drives have a set of commands required to start or boot, and this is what must be meant; the software is recording the number of boot entries on the system.

Now... I'm fairly sure that this always used to read 2. Perhaps 5 months ago this was. But for some time now it's started consistently showing 3.

3 boot records?

I did some research, but struggled to find out exactly how many I should have. (Bear in mind it's just my laptop during these scans, without any additional hardware attached save for the mouse and my charger)

After a while I decided to leave it as unresolved, as nothing suspicious was happening.


Extrapolating

Today however I fell to wondering about the third boot record again. After some research I started wondering if each partition on a hard drive has its own 'boot record' (feel free to tell me yes or no here...still not sure if this is correct?).

So i opened up the disk management window to check my partitions, and here lies my main query.


About the partitions

Here is a screenshot from the disk management window;

The first thing I noticed is that there are 3 partitions in NTFS format. So my first question is;

1) Do i have 3 'boot records' because 3 of my partitions are NTFS format?

I then thought about the fact that (i'm almost certain) my anti-virus software used to only read 2 boot records. If my theory linking NTFS and 'boot records' is correct - which one would have changed? I checked the partitions on my parents new Sony Vaio for comparison.

I was pretty baffled by the results. The brand new laptop runs on windows 8 - and there were about 5 different partitions. What's more, only the C : drive was named. The other 4 were only defined by the other fields. The results were very similar to those obtained at this link:

http://www.pcadvisor.co.uk/forums/1/tech-helproom/4190621/what-are-all-these-partitions-on-my-new-laptops-hdd/

If you don't want to follow the link, another user of windows 8 was wondering what all the partitions were for;

I've just had a look at the 1TB HDD in Disk Management for the first time, and the disk is already littered with partitions! Can anyone please tell me what they're all for?

1000 MB Healthy (Recovery partition) 100% free.
260 MB Healthy (EFI System partition) 100% free
1000 MB Healthy (OEM partition) 100% free
Windows 8 OS (C 884.18 GB Healthy (Boot, Page file, Crash dump, Primary partition) 96% free
Lenovo (D 25 GB NTFS Healthy (Primary partition) 89% free
20 GB Healthy (Recovery partition)


Read more: What are all these partitions on my new laptop's HDD? - Tech Helproom | 29-11-12 - PC Advisor Forums

Anywho, this isn't my main concern - as i'm simply assuming it's windows 8 doing things differently. What did intrigue me is that (as I recall it) the recovery partitions weren't listed as NTFS on my parents new laptop. In fact only the C : drive was I think.

So this leads me to my second question;

2) Is the recovery partition supposed to be NTFS format? Is it possible it used to not be, but at some point it changed and gave me 3 NTFS partitions and subsequently 3 boot record results.


That's all I can think of for now. I'll update you as things develop.

Thanks in advance for your help, :sarc:
MID

 

[mrirondream]

Not sure if i'm supposed to 'bump' threads - but I never did receive a response for this?

 

[gregrocker]

Did you not notice there is no screenshot that you referenced? Use Disk Management - Post a Screen Capture Image.

Then in a few brief sentences summarize what your question is and we will be able to determine from the picture the answer.

 

[mrirondream]

Apologies, there was an image the first time I posted but I have since deleted it.

I will attempt to repost shortly

MID

 

[mrirondream]

Here is the image:

my question is really:

What are these partitions for? (do i need them)
are they linked to 'boot records'. (3 NTFS partitions = 3 boot records?)

thanks,
MID

EDIT: as of today I now have 4 boot records (see next image), but the same partitions. This debunks the theory connecting the number of boot records picked up by McAfee and disk partitions.

 

[whs]

NTFS partitions and bootrecords have no correlation. There will be only one bootmgr (usually in the 100MB active system partition) and that will point to your OS partition (which is usually the C partition).

You can have a large number of NTFS partitions per physical disk (up to appr. 120) but you can only have either 4 primary partitions or 3 primary partitions plus 1 extended partition. All additional partitions have to be simple logical partitions running under the 'control' of the extended partition.

PS: Your image still does not work. Attach it with the paperclip which is on the top of the posting window.

http://www.sevenforums.com/tutorials/9733-screenshots-files-upload-post-seven-forums.html

 

[mrirondream]

Images should (hopefully) be attached now

Above is the '4 boot records' and below is the disk management print screen

 

[whs]

You have a completely normal OEM setup. And don't ever create another partition. That would get you into a lot of trouble with dynamic partitions.

And as I said. You have 1 bootmgr in the first partition (the 100MB system partition) and that points to your C partition.

 

[mrirondream]

Good to know!

Can you provide any further information about having 4 boot records detected?

thanks
MID

 

[pallesenw]

After some research I started wondering if each partition on a hard drive has its own 'boot record' (feel free to tell me yes or no here...still not sure if this is correct?).

That is correct, but only one is used. The boot record stored in the partition marked as "active" will be executed when you boot. This boot record is responsible for executing bootmgr.

 

[mrirondream]

After some research I started wondering if each partition on a hard drive has its own 'boot record' (feel free to tell me yes or no here...still not sure if this is correct?).

That is correct, but only one is used. The boot record stored in the partition marked as "active" will be executed when you boot. This boot record is responsible for executing bootmgr.

Ok thanks.

So any idea why I now have 4, when previously had 3?

I'll refer you now to a post I made today about a possible rootkit...would that register another boot record?

http://www.sevenforums.com/system-security/310557-large-file-named-rootkit-scanned-anti-virus-4-boot-records.html

MID

 

[pallesenw]

I'm not experienced with McAfee, so I cannot really tell you why it scans like it do. But you have four partitions, so you have four boot records that it can scan.

 

[mrirondream]

I'm not experienced with McAfee, so I cannot really tell you why it scans like it do. But you have four partitions, so you have four boot records that it can scan.

Understood, and thank you for your time anyway.

However, i've always been using McAfee and always had 4 partitions - but until today it read 3 boot records.

Any thoughts? :sarc:

MID

 

[pallesenw]

Did you have something attached to your computer while scanning, which it might have scanned also?

Your drive has an additional boot record, your master boot record (MBR). I don't know how your scanner counts that in.

 

[mrirondream]

Did you have something attached to your computer while scanning, which it might have scanned also?

Your drive have an additional boot record, your master boot record (MBR). I don't know how your scanner counts that in.

Not as far as i'm aware no. I've recently been uploading images from an SD card but i've just checked and it's not in there (and I know it wasn't when the scan was run too)

I have your basic optical mouse...but I've always had that during scans before

Would a root kit cause an additional boot record to show? Or would that manifest in an existing one?

Thanks
MID

 

[pallesenw]

Anything is possible. A rootkit can manipulate everyting. Even what you see in disk management.

 

[mrirondream]

Anything is possible. A rootkit can manipulate everyting. Even what you see in disk management.

Ok :huh:

I've had little evidence to suggest my PC is being manipulated by a virus, but reading the thread I linked to earlier will give you a fuller understanding of my current situation.

Doing a windows defender scan now to determine if i might have a rootkit or not. After I may run TDSS killer

MID

 

[gregrocker]

I would not run anything MucAfee which is probably the worst program we have seen here since Win7 release. Uninstall it and install free lightweight recommended Microsoft Security Essentials.

With HP's the best way to add another partition to keep Win7, Recovery and Diagnostics tools partitions bootable is to convert C to Logical and then shrink it to add as many adjacent logical partitions as you want. How to set partition as Primary or Logical.
Partition or Volume - Shrink
Partition Wizard Create Partition - Video Help

But the HP factory preinstalled Win7 is the worst possible install of Win7 one can have anyway, so I'd do what most tech enthusiasts do and Clean Reinstall - Factory OEM Windows 7 following the steps to get and keep a perfect Win7 install. You'll not even experience real Win7 on that PC until you do.

 

[mrirondream]

Okie dokie, thanks for the info Greg

I may well be getting a new laptop sometime soon so I'm going to hold off on fiddling with partitions, but it's good to know anyway!

As for McAfee, it seems to have kept me safe so far (with the possible exception this time) but people have said to me it's not brilliant.

I'll bear that in mind for my new system. Out of interest, what do you guys consider the best anti-virus+malware? (i'm aware that's probably a hard question to answer)

I'll send you the details of my windows defender and TDSS scans when done

Thanks again
MID

 

[mrirondream]

Windows defender came up clean