Overview

DiskProbe2 is an editor that allows you to view and modify the contents of storage devices such as hard drives. These devices can be viewed as either physical or logical devices.

DiskProbe2 allows you to view the raw data on a device as partition tables, boot sectors or as raw bytes. Each of the views allows you to edit the data fields to repair corrupt information. This is a powerful feature that allows you to read and edit raw data on any part of the disk.

Since DiskProbe does not check or validate the data you enter, it is possible to enter inappropriate data that can make it difficult or impossible to regain access to the files on that device. Extreme care must be used editing the fields on these critical disk structures. Always make a backup by saving the disk structure you are about to edit as a file. The file should be saved to a floppy diskette or other safe place.


Using DiskProbe

When to use DiskProbe

DiskProbe is designed to help troubleshooting and repairing damage to corrupt disk structures. Corrupt low-level disk structures can be caused by many things. Viruses, bad driver code and failing hardware can cause this type of damage. In order to successfully troubleshoot these problems the user must have a comprehensive knowledge of how these systems operate.

It is strongly advised that a backup be made of any low-level disk structure before editing the information it contains.

Limitations

  • DiskProbe cannot be used to view or edit remote physical or logical drives.

  • Opening a handle to a physical drives requires the user to be logged in to machine with Administrator rights.

  • Once data is written to a physical or logical drive, the previous data cannot be recovered.

  • DiskProbe does very limited or no checking to validate that the data you are entering makes sense in the context of the current view. If you are not sure, do not write the data to disk. Writing incorrect or inappropriate data to these low-level disk structures can make the files on that volume permanently inaccessible.

  • DiskProbe does very limited or no checking to validate the view being used makes sense in terms of the current location on the disk, or in terms of the data contained in the current sector. Use extreme care in selecting an appropriate view for the data. Misinterpreting the data and using a incorrect view to edit the data can make the files on the volume permanently inaccessible.


Operations

Volume Operations

Operations are actions that can be performed on a volume or the data it contains. A volume must first be opened for most operations to be enabled.

Open / Close | Opens or closes a volume
Read Sectors | Reads a range of sectors into the volume node’s buffer.
Writer Sectors | Writes the contents of the volume nodes’ buffer to the physical or logical volume.
Lock / Unlock | Allows the volume to be locked or unlocked for write access.
Search | Allows the volume or a range of sectors within the volume to be search for a text string.
Wipe | Allows the volume or a range of sectors within the volume to be wiped or erased. Each sector is over written with zeros. It will not be possible to recover any data from sectors that have been wiped.


OpenDevice

Open Volume

Before any operations can be performed on a volume it must first be opened. For physical volumes only one application can have a volume open at a time. For example, if Disk Manager or Disk Defragmenter has a volume open, DiskProbe’s open operation may fail.

To open a volume, select ‘Open’ from the volume node’s context menu. If there is an error during the attempt to open the volume a dialog will be displayed with the error message returned by the operating system.

If the volume was successfully opened, the other available operations for that volume will be enabled.


Closing a device

Closing a Volume Handle

The Close Handle option will only be available on a node’s context menu if the volume is currently open. When a volume’s handle is closed, any sector data in the volume node’s buffer is saved. Data cannot be read from or written to the volume unless a handle to that volume is currently open. The options to Read Sectors, Write Sectors and Lock Volume will be grayed out.

If DiskProbe is closed, or if the Node Type view is switched (the left pane view) any data stored in the current view’s nodes is freed.


Locking Devices

Locking a Volume

Selecting this option from the volume node’s context menu locks the volume for write access by other processes. This operation may not always work. For example, you may not be able to lock the system volume (the volume where the operating system is located) because other processes may be using it.

If the current handle has already locked the volume, the menu option will be ‘Unlock’. When a volume handle is closed, any locks are automatically freed.


Reading Sectors

Select this option from a volume node’s context menu to read sectors. From the Read Sectors dialog, enter the starting sector and number of sectors to read. Select the Read button to copy the run of sectors into the volume nodes’ buffer.

In order to read sectors the volume must have first been opened with the “Open Handle” command. The number of sectors that can be read is limited by the amount of available memory.


Writing Sectors

Writing sectors copies the data in the current volume buffer to the selected sectors. When this option is selected the ‘Write Sectors’ dialog is displayed. Enter the starting and ending sector to write to and select the ‘Write’ button.

It is valid to enter a range of sectors smaller that number of sectors in the volume buffer. In this case the write will stop when the user-entered number of sectors has been written to the volume.

If a range of sectors greater than the number of sectors in the buffer is entered, the write will stop when the end of the data in the buffer is reached.

Always use extreme care when writing sectors to a volume. Once the operation is completed it will not be possible to recover the data that was previously stored on the over written sectors.


Searching

Searching Sectors

DiskProbe can search a range of sectors or a complete volume for text strings. The Search for Data dialog allows the user to configure the search with options for search type and string type.

If a match is found a dialog will be displayed asking if the search should be continued. If the user chooses not to continue, the sector where the match was found is read into the node’s buffer and the Search dialog is terminated. If the user chooses to continue, the search resumes using the same search criteria until another match is found or until the last sector in the range is searched.

Search Options

‘Search at offset’ Radio button | As sectors are read into memory, only the byte at the offset specified in the Offset (hex) control is examined for a match. If the data at that offset matches the first character in the search string, the rest of the string comparison is done. This type of search is much faster than a complete search.
‘Search all data’ Radio button | Every byte in every sector is compared for a match. This is a more complete search, but takes considerably longer.
‘Ascii’ Radio button | The string to search for is considered an ascii string, or single byte character string.
‘Unicode’ Radio button | The string to search for is considered a Unicode, or multibyte string.
‘Ignore case’ Check box | If this box is checked, a non case sensitive search is done. In this case the strings “MYFILE”, “MyFile” and myfile are considered equivalent. This type of search takes longer.
‘Offset (hex)’ Edit box | If the “Search at offset’ radio button is selected this control will be enabled. Enter the offset in the sector to begin the string comparison. Do not preface the number with 0x, just enter ‘2E’ for example. This would start the comparison 46 bytes from the beginning of each sector.
’Start Sector’ Edit box | Enter the first sector to search in decimal. The current sector is displayed by default.
‘End Sector’ Edit box | Enter the last sector to search in decimal. The last sector on the volume is displayed by default.
‘Data to search’ Edit box | Enter the text string to search for. A maximum of 16 characters is allowed. The string will be interpreted as Ascii or Unicode depending on the state of the Ascii / Unicode radio buttons.
Start Search button | Select this to begin the search. When a search is in progress the text on the button will change to cancel the search. Selecting this stop the search at the current sector in memory.
Close button | Stops the search and terminates the dialog.


Wiping Sectors

Wiping sectors provides the user with a fast way to permanently erase data in a sector or range of sectors.

When this option is selected, the ‘Write Sectors’ dialog will be displayed. Enter the starting and ending sectors to wipe and select the ‘Write’ button.

All data in the range of selected sectors will be over written with zeros. Use care to insure that the selected volume and the range of sectors selected is correct.

This operation cannot be canceled and all data in the range of selected sectors will be permanently lost.


Understanding Views

Views

Views are simply a way of looking at data. In DiskProbe, any sector or file data can be viewed in any of the available views. No checks are done to validate that the view the user has selected is appropriate for the data. This is because some or all the fields may be corrupt. In this case any validation scheme could fail.

DiskProbe has a view for most of the critical disk structures. Corruption or inappropriate data in the data fields of these structures may prevent the volume from mounting, or from being seen by the operating system correctly.

When editing data in any view, it is critical that the sectors are saved first. There must always be a way to get back to a known starting point, even if that starting point contained bad data. To save a run of sector data before editing, first read the data, then from the file menu, select ‘Save as’. Then chose a safe location to save the image file of the sector data.


Physical Volume Views

Physical Volume View

The Physical Volume View displays all the available physical volumes in the left pane. DiskProbe populates this view by attempting to open all the possible drives. In Windows NT there is a limit of 32 physical drives.

Drives that are part of hardware RAID sets will not be seen as individual drives. The hardware drive controllers present these drives to the operating system as a single physical drive. That physical drive may be partitioned by the operating system into logical drives.

Drives that are part of software controlled RAID sets will be seen as separate physical drives. Software controlled RAID sets are only available on Windows NT Server and Advanced Server.

Any physical disk that is off-line when the view is created will not be displayed.

Only local disks will be displayed. It is not possible to view or modify remote drives in DiskProbe.

Removable media devices will not be displayed as local physical disk volumes.


Logical Volume Views

Logical Volume View

The Logical Volume View displays all the available logical volumes in the left pane. DiskProbe populates this view by attempting to open all the possible drive letters, ‘A’ through ‘Z’. Any logical volume that is off-line when the view is created will not be displayed.

Removable media devices will be displayed and it will be possible to open a handle to the device, but of course read and write operations will fail. If media is loaded into the drive, the volume must be closed and then reopened before read or write operations can be performed.


Byte View

This view displays the current contents of a node’s buffer as hexadecimal data. The view has three columns to aid in interpreting the data.

  • The left column is the offset from the beginning of the current sector. This is displayed in hexadecimal format.

  • The center column is a hex display of the sector. There are 16 bytes per row.

  • The right column displays the same data as ASCII text.

The caret can be moved either with the mouse or by using the arrow keys on the keyboard. Each time the caret is moved to a new location the status bar window on the far right will display the new offset information.

The size of the data display is automatically set to sector size of the node the data was read from. When the application is first started, a default sector size of 512 bytes is used.

If changes are made to the sector data, they will not be saved unless Write Sectors is selected from the node’s context menu. If DiskProbe is closed without writing the changes back to the node, the user will be prompted to save the changes before DiskProbe closes.


Legacy Partition Table

Legacy Partition Table View

The standard or legacy partition tables have been used to organize hard disks into logical drives since the early days of MS-DOS. Legacy partition tables may still be contained in EFI partitions.

Many of the fields in the legacy partition tab refer to the CHS (Cylinder-Head-Sector) method of addressing disks. This addressing scheme was used by early PC BIOS to read and write to the disk. Even though modern disk and file system drivers no longer use this addressing scheme, the data fields in the legacy partition table may still be used. In some circumstances corrupt data my cause problems in mounting or interpreting the drive.

The Partition Table begins at offset 0x1BE in the Master Boot Record. This is always located in sector 0 of the drive. The first portion of the Master Boot Record (MBR) contains bootstrap code. The computer’s BIOS executes this code to determine if there is a bootable drive. If a partition is marked bootable, then the fields in that partition entry are read to locate the boot record for that logical drive. The BIOS then jumps to that location and attempts to execute the code there.

Each partition entry is 16 bytes long and defines a primary partition. The partition table is an array of 4 or these 16 byte partition entries.

A partition entry can also define an extended partition. In this case the partition entry points to a CHS address on the drive that contains another partition table that defines a logical drive. That partition table may also contain a partition entry that points to another partition table. These structures form a linked list of partition tables defining logical drives.

The last two bytes of the MBR should always be 0x55AA. This value is used to mark the end of the MBR.

Data Fields in a Partition Entry

Boot Indicator | Not used by EFI. The high bit is set to mark the partition as bootable. The value is 0x80 for a bootable partition, and 0x00 for a non bootable partition.
Start Side (Head) | Head component of the CHS address for the start of the partition.
End Side (Head) | Head component of the CHS address for the end of the partition.
Start Sector | Sector component of the CHS address for the start of the partition.
End Sector | Sector component of the CHS address for the end of the partition.
Start Cylinder | Cylinder component of the CHS address for the start of the partition.
End Cylinder | Cylinder component of the CHS address for the end of the partition.
Relative Sector | Starting LBA of the partition. This field is used by the EFI firmware.
Total Sectors | Total number of sectors (blocks) in the partition. This field is used by the EFI firmware.
File System Type | A value of 0xEF is used for an EFI system partition.


GUID Partition Table Header

GUID Partition Table Header View

The GUID Partition Table Header (GPTH) defines the range of logical block addresses that are usable by partition entries. The First Usable LBA and Last Usable LBA fields determine area on the volume that can be used by the file system.

Each GPTH has a GUID that uniquely identifies it and it’s associated storage.

Data Fields for the GUID Partition Header

Signature | Identifies the GPTH as EFI compatible. This field should contain the string “EFI PART”.
Revision | For version 1.0 the value should be 0x00010000.
Header Size | Size in bytes of the GPTH.
Header CRC | The checksum for the GPTH structure.
Reserved1 | Must be zero for a version 1.0 GPTH.
This LBA | The LBA that contains the GPTH structure.
Alternate LBA | LBA of the alternate or backup GPTH.
First Usable LBA | The first block address that may be used by a GUID. Partition Entry
Last Usable LBA | The last block address that may be used by a GUID Partition Entry.
Partition Entry LBA | Starting LBA of the GUID Partition Entry array.
Partition Count | Number of GPEs in the GUID Partition Entry array.
Partition Entry Size | Size in bytes of each GUID Partition Entry. This value must be a multiple of 8.
Partition Array CRC | CRC of the GUID Partition Entry Array.
Disk GUID | Unique identifier for this disk.

Note that size of the GUID Partition Header structure is less than 512 bytes, the block size of most hard drives. The remaining portion of the block should be zeroed out.


GUID Partition Entry

GUID Partition Entry View

This view displays sector data as an EFI GUID Partition Table Entry (GPE). The fields describe the starting Logical Block Address (LBA) and ending LBA of the partition as well as its name, attributes and unique identifiers. An array of GPEs begins after the GUID Partition Table Header (GPTH). The size of each entry is defined in the GPTH. For the first version the size should be 128 bytes. If a GPE is not in use, all fields should be set to zero.

GUID Partition Entry Fields

Partition Type GUID | Unique ID that identifies the type of this partition. A value of 0 indicates this entry is not in use.
Partition Unique GUID | A unique ID that is assigned when the partition is created.
Starting LBA | Starting LBA of the partition defined by this record.
Ending LBA | Last LBA of the partition defined by this record.
Attributes | All bits in this field are reserved by EFI.
Partition Name | A Unicode string 36 characters in length.

There are jump buttons for the Starting and Ending LBA fields. Selecting these buttons will cause DiskProbe to read in the sector pointed to by the field and load it into the volume node’s buffer.


Fat 16 Boot Record

FAT 16 Boot Record View

This view interprets the first 512 bytes of data in volume’s buffer as a FAT 16 Boot Record. FAT 16 was the file system used by MS-DOS and similar PC operating systems. It is still used for some other storage devices and floppy diskettes, and may be used for disk partitions less than 2 GB in size.

The boot record is the first sector on a logical volume and is used by the operating system to mount the drive. If the data in a boot record is corrupt the volume may not mount or may seen by the operating system with an incorrect size. If there is a possibility that some data in the boot record is corrupt or inaccurate, no attempt should be made to write files to that volume.

The data in a boot record consists of three sections.

  • Starting at offset 0x11 is the BIOS Parameter Block (BPB). The data fields in the BPB help the file system driver interpret the layout and configuration of the volume’s file system.

  • Starting at offset 0x24 is FAT 16 Extended Data. This is data such as the volume label, system string and volume ID. The OEM string is displayed in this section as well although it is located from offset 3 to offset 10.

  • The remainder of the boot record is executable code that is used load the operating system loader or kernel if the volume is a bootable volume. For example, there may be text “NTLDR is missing”. That would indicate the volume was formatted with a version of Windows NT. “MSDOS.SYS” and “IO.SYS” may alternately be visible, indicating the volume was formatted with a version of MS-DOS.

The last two bytes of a boot record should always be 0x55AA. This value is a marker to indicate the end of the boot record. The file system drive may use this value to check the validity of the boot record.


FAT 32 Boot Record

FAT 32 Boot Record View

This view interprets the first 512 bytes of data in volume’s buffer as a FAT 32 Boot Record. FAT 32 was introduced by Windows 95 to overcome the 2 GB limit on partition size.

The boot record is the first sector on a logical volume and is used by the operating system to mount the drive. If the data in a boot record is corrupt the volume may not mount or may seen by the operating system with an incorrect size. If there is a possibility that some data in the boot record is corrupt or inaccurate, no attempt should be made to write files to that volume.

The data in a boot record consists of three sections.

  • Starting at offset 0x11 is the BIOS Parameter Block (BPB). The data fields in the BPB help the file system driver interpret the layout and configuration of the volume’s file system. These data fields are the same for FAT 16 and FAT 32

  • Starting at offset 0x24 is FAT 32 Extended Data. Some of this is data, such as the volume label, system string and volume ID, is the same as similar data in a FAT 16 boot record, but located at a different offset. The other fields are specific to FAT 32 and are used by the file system driver to interpret the configuration of the file system.

  • The remainder of the boot record is executable code that is used load the operating system loader or kernel if the volume is a bootable volume. For example, there may be text “NTLDR is missing”. That would indicate the volume was formatted with a version of Windows NT. “MSDOS.SYS” and “IO.SYS” may alternately be visible, indicating the volume was formatted with a version of MS-DOS.

The last two bytes of a boot record should always be 0x55AA. This value is a marker to indicate the end of the boot record. The file system drive may use this value to check the validity of the boot record.


NTFS Boot Record

NTFS Boot Record View

This view allows the user to display the current sector as an NTFS Boot Record. All data fields may be edited. The only checks done are to insure the new data is within the range allowed by the underlying data type.

An NTFS boot record consists of 3 parts. The first is the BIOS Parameter Block that is identical to the same fields used in FAT 16 and FAT 32 boot records. The second is the NTFS specific data. The remainder of the sector is code that is used to load NTLDR if the volume is a bootable volume. The last section can only be edited in byte view since it does not contain any data fields.

In addition to the data fields, there are four buttons that can be used to quickly jump to other critical disk structures on an NTFS volume.

Find MFT | Loads the sector specified in the Clusters to MFT field into the volume node’s buffer. This sector should contain the start of the Master File Table. The calculation to find this sector is: Current Sector + (BPB Sectors per Cluster * Clusters to MFT)
Find MFT2 | Loads the sector specified in the Clusters to MFT2 field into the volume node’s buffer. This sector should contain the start of the Master File Table Mirror. The calculation to find this sector is: Current Sector + (BPB Sectors per Cluster * Clusters to MFT2)
Volume Center | Loads into the volume node’s buffer, the sector in the middle of the volume. Some versions of NTFS stored a backup boot record in this location. The backup boot record can be used to replace a corrupt boot record. The calculation to locate this sector is: Current Sector + (NT Total sectors / 2 )
Volume End | Loads the last sector in the volume into the volume node’s buffer. More recent versions of NTFS store the backup boot record in this location. Note that if you have opened the NTFS volume as a logical volume you may not be able to reach this sector. You can open the physical volume the NTFS volume resides on, locate the boot record and then jump to this location. When loaded as a logical volume NTFS makes this sector unavailable to the file system to prevent unintentional overwriting. The calculation used to locate this sector is: Current Sector + NTFS Total Sectors