Partitions puzzle

Page 2 of 3 FirstFirst 123 LastLast

  1. Posts : 6,458
    x64 (6.3.9600) Win8.1 Pro & soon dual boot x64 (6.1.7601) Win7_SP1 HomePrem
       #11

    I don't think there's an issue with the encrypted parts
    See: Recover a TrueCrypt Volume - CGSecurity
    Because presence of a TrueCrypt volume can not be verified without the password, disk and filesystems utilities may report the filesystem as unformatted or corrupted that may lead to data loss after incorrect user intervention or automatic "repair".

    TestDisk might give you more information as Autopsy did, but I wouldn't take any action if you use TestDisk, just look.
    I suggest the dos version since it reads the Disk directly - the windows version depends on the OS.

    Don't repair the encrypted parts!

    Now why is the unallocated space the same size as the encrypted part? Dunno

    I'd have to have a full history of how TrueCrypt was implemented and drive information before TrueCrypt.
    The only thing I can think of is that the twins are a hidden encryption with an inner and outer envelope - that's just a guess.

    Bill
    .
      My Computer


  2. Posts : 6,458
    x64 (6.3.9600) Win8.1 Pro & soon dual boot x64 (6.1.7601) Win7_SP1 HomePrem
       #12

    I'll try again:
    TeraByte Unlimited Knowledge Base
    TrueCrypt Non-system Partition Encryption
    •A standard non-system partition on an internal or external drive. These partitions are seen as RAW/unformatted.
    •Standard partition labels cannot be viewed and displayed system type (format) may be incorrect.
    Interesting though, researching your issue I came across the demise of TrueCrypt :
    TrueCrypt Is Back, But Should It Be? - Forbes
    GRC: Final TrueCrypt, Release Repository
    TrueCrypt.sourceforge.net: Migrating from TrueCrypt to BitLocker

    So the question is ... do you migrate to Bitlocker?

    Bill
      My Computer


  3. Posts : 562
    Windows 7 Ultimate x64
       #13

    So am I correct to say that Diskpart shows only currently allocated volumes and that Disk Management shows allocated/ unallocated volumes?

    Yes, that is correct. As far as i know "DISKPART" won't list the details of unpartitioned space but "Disk management" will. The small unallocated space between partitions ( 2 MB etc ) is called "Slack Space" in Cyber forensics. Both "Autopsy" and "WinHex" are primarily used for forensic purposes. As these Slack spaces may contain data from previous file systems ( partitions deleted and recreated to destroy evidence ), it is the duty of a forensic investigator to search for evidence in "Slack Spaces" also. That is why "WinHex" and "Autopsy" listed those spaces as volumes - you will be able to create RAW sector by sector images and investigate just like a normal partition.


    What puzzles me is that Z shows up as the exact same size as unallocated space.
    You can permanently decrypt "Z" drive and use "Extend Partition" function of "Disk Management" to add that unallocated space to "Z". Then re-encrypt the new 156 Gb sized "Z" using "TrueCrypt" - plain and simple. I don't get what is confusing you.

    Last edited by Anshad Edavana; 20 Jul 2014 at 12:38.
      My Computer


  4. Posts : 6,458
    x64 (6.3.9600) Win8.1 Pro & soon dual boot x64 (6.1.7601) Win7_SP1 HomePrem
       #14

    Thanks Anshad, your post cut to the chase re: unallocated space.

    I might be the cause of confusion if there is any. I answered a question that wasn't asked and provided citations on the RAW parts. The citations were only posted to show that some applications make the parts appear RAW to Windows or other utilities.

    I might have confused the issue by including the source of the citation (TestDisk and Terabyte imaging) - the citations were important, not the source.

    I did not mean to suggest that TestDisk or Terabyte were needed to answer the original question.

    Hope that clears up why I posted the two cited works.

    Bill
    .
      My Computer


  5. Posts : 4,776
    Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
    Thread Starter
       #15

    Confusion cleared up


    Thanks Bill and Anshad. I've decided to remove those encrypted partitions and then use a partition manager to re-order the remaining partitions.

    Here's what I see now:

    Partitions puzzle-disk-management.jpg

    Partitions puzzle-winhex-hard-disk-0-_2.jpg

    Autopsy and WinHex both find zero trace of any deleted files. What concerns me is possible data recovery if my machine gets stolen rather than analysis by forensics investigators!

    However I will attempt to learn something from Anshad's comments and see if I can work out how to create a RAW Disk Image and inspect it. I'll need to purchase another drive for that though!
      My Computer


  6. Posts : 6,458
    x64 (6.3.9600) Win8.1 Pro & soon dual boot x64 (6.1.7601) Win7_SP1 HomePrem
       #16

    Chris, there's no reason not to use encryption.

    I suggest creating a extended partition using all of the available space in the unallocated region.
    You'll have to use Diskpart.
    Diskpart
    lis dis
    sel dis 0
    cre par ext
    exit
    exit
    DISKPART> help cre par ext

    Creates an extended partition on the disk with focus.
    Applies to master boot record (MBR) disks only.

    Syntax: CREATE PARTITION EXTENDED [SIZE=<N>] [OFFSET=<N>] [ALIGN=<N>] [NOERR]

    SIZE=<N> The size of the partition in megabytes (MB).
    If no size is given, the partition continues until there is no more free space in the extended partition.

    OFFSET=<N> The offset, in kilobytes (KB), at which the partition is created. If no offset is given, the partition will start at the beginning of the first free space on the disk that is large enough to hold the new partition.

    ALIGN=<N> Typically used with hardware RAID Logical Unit Number (LUN) arrays to improve performance. The partition offset will be a multiple of <N>. If the OFFSET parameter is specified, it will be rounded to the closest multiple of <N>.

    NOERR For scripting only. When an error is encountered, DiskPart continues to process commands as if the error did not occur.
    Without the NOERR parameter, an error causes DiskPart to exit with an error code.

    After the partition has been created, the focus automatically shifts to the new partition. Only one extended partition can be created per disk. This command fails if you attempt to create an extended partition within another extended partition. You must create an extended partition before you can create logical partitions.

    A basic MBR disk must be selected for this operation to succeed.

    Example: CREATE PARTITION EXTENDED SIZE=1000
    Then you can use Disk Mgmt. to create your partitions and volumes.

    I don't use encryption, so you might have to use the application to create the volumes - not sure of the order.

    Bill
    .
    Last edited by Slartybart; 20 Jul 2014 at 22:40. Reason: logical is the wrong paramter, extended is the correct one
      My Computer

  7.    #17

    You would have had the perfect sizing of C and D if you'd followed my original advice to extend each into the deleted RAW partitions space. Now you have a tiny OS partition followed by a big data partition and all your deleted space on the right of it.

    Use the Partition Wizard Extend feature to reallocate the Unallocated space into C and then D as desired: How to extend partition easily with Partition Wizard - video help.
    Last edited by gregrocker; 21 Jul 2014 at 10:14.
      My Computer


  8. Posts : 4,776
    Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
    Thread Starter
       #18

    Partition size


    Hi gregrocker,

    I don't see the need to extend the windows partition as I try to keep as much non windows data as possible on the other partition like downloads, documents, music, video and so on. The windows partition I try to keep just for windows along with installed programs. Is there any benefit in extending partitions to use all available space? I find that wiping free space and other maintenance takes less time on smaller partitions.

    Thanks!

      My Computer

  9.    #19

    No prob if you had a different idea of what you wanted. I thought you might have missed the suggestion.
      My Computer


  10. Posts : 4,776
    Microsoft Windows 7 Home Premium 64-bit 7601 Multiprocessor Free Service Pack 1
    Thread Starter
       #20

    TestDisk


    Slartybart said:
    TestDisk might give you more information as Autopsy did, but I wouldn't take any action if you use TestDisk, just look.
    .
    Thanks Bill, TestDisk doesn't find anything much that's been deleted - it finds only very recently deleted files and that's good to know. I'm still using encryption on external drives.
      My Computer


 
Page 2 of 3 FirstFirst 123 LastLast

  Related Discussions
Our Sites
Site Links
About Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd
All times are GMT -5. The time now is 01:08.
Find Us