Hi,

I am working on data recovery software for fat file systems.

Does anyone knows how to prevent windows from writing to specific
drive at boot time, but still allow some sort of direct acces to drive
sectors?

thanks
robby

In NT, you could choose to not assign a drive letter to the
partition. That would certainly keep the average user from
writing to it.

There is syntax in relation to CreateFile that lets you open
a partition as a binary image. ISTR "filenames" that look like
"\\?\Partition0". Type "CreateFile", press F1, read help.

Groetjes,
Maarten Wiltink

thanks Maarten,

this is ok, but the problem I have is to try to prevent windows from
writing on drive I just have connected or the one which I will conect
after a reboot. This drive will certanly have damaged file system, but
problems start when windows still recognize it.

problem is that windows have tendency of writing recycled folder and
maybe some other staf or even check file system and try to repair it.
In my experience this have always done more dmage the it was before.
So the rescuing application I am writing should be plain dos or linux.
As I would prefer 9x and/or xp I should somehow prevent windows to
write on drive, as of users I have no problem I just lock it while I
use it. My ideas were either to disable this drive from BIOS and acces
it via underlying hardware (propably trablesome under nt,xp..) or to
try something else.

any ideas?

thanks
robby

On 19 Feb 2003 16:43:36 -0800, ro...@bankerinter.net (robert aleksic)
wrote:

If you write to the main boot sector and change the file system type
to one that Windows won't recognize, it should leave the disk alone.

Duncan Murdoch

Thanks Dunkan,

I came to same idea, but I would like to treat the disk as read only,
because - who knows what kind of damage and why is already made - even
by trying to write something I could make more damage.

Does anyone knows when and how windows tries to mount volumes and
assign drive letters and are some settings which can be made (it came
to my mind also to change lastdrive to the lastone hard drive, but
that would propably exclude cd's also) to prevent windows to mount
some drive?

thanks
robert

Im Artikel <de7cb45e.0302211600.eb08...@posting.google.com>,
ro...@bankerinter.net (robert aleksic) schreibt:

I'd cut the write signal to the drive first, to make it definitely read-only.
Then I'd create an image file from that drive, and only work with that image
file.

Some years ago I saved an crashed drive onto CDs, and then wrote a recovery
program which used the image files on those CDs. With nowadays disk capacities
it would be more practical to buy a hard disk of an appropriate size (twice the
size of the crashed drive), then both a working copy and a backup of the
crashed drive can be kept on that drive.

If you have NT (or newer systems) available, have a look at the DiskProbe(?)
utility in the NT resource kit.

DoDi

Hi DoDi,

thanks, it's excelent idea how to make drive read only for shure :) It
would never even cross my mind.

btw do you or somebody know how the windowses wil respond to
connecting drive to cable like this when booted? I'll try it
definitely but it would be usful to know in advance do I have to fight
with windoze to prevent some error messages and similar stuff, since
I'm working on comercial product so it must work as clean as possible.

As of backing up and making image it would propably not be feasible
for buers of software. Do you think that drive can be damaged further
in some sense if it is conected and attemped to be read from?

thanks again
robert

p.s. if my comercial product work financialy you'll certanly have your
share of profit for this idea even if I solve problem some other way.

news:de7cb45e.0302240909.142082c2@posting.google.com...

If there is a problem with damage to the drive surface (Head has hit the
drive) then attempting to read could definately cause more damage. In cases
like this, the platter would have to be removed in a clean room and be read
by special machines to retrieve the data without fear of causing (too much)
more damage.

Cheesr,
Nicholas Sherlock

Hi Nicholas,

I know I am getting a little bit off-topic, but I thought that modern
drives have some sort of protection in order to prevent this kind of
situation. Am I wrong?

robert

Im Artikel <de7cb45e.0302240909.14208...@posting.google.com>,
ro...@bankerinter.net (robert aleksic) schreibt:

At least removable drives are allowed to be write-protected.

What kind of product do you mean? Software-only solutions are not very
professional, because every attempt to read an physically damaged disk will
increase the damage. A recovery of defective directory structures requires a
lot of experience and intelligence, either human or artificial, and some
companies offer such services with a qualified staff and sophisticated
equipment.

DoDi

news:de7cb45e.0302251220.7bc0639d@posting.google.com...

Although my current Seagate 80gb can take 450g's of non-operating shock,
hard drives can take very little *operating* shock without the head
contacting the disk surface (The head is separated from the disk by just 4
microns)

Cheers,
Nicholas Shelrock

Hi DoDi,

what I am writing is recovering data from destroyed fat filesystem. So
it will not deal with physicaly damaged disks. I already have a lot of
experience in doing this with bunch of small util's I wrote but for
comercial product it always need a lot of make-up and should work an
all windoze flavours. This kind of situations arises after deleting
files by mistake, having desctructible virus, formatting by mistake,
misbihavior of some otherwise normal software, power sureges etc. In
my expirience physical damage do not occurs as often as the previous
situation. So if you cannot read files from some drive which dont make
any unusual noise, and it is recognizable by bios - chances are very
small that you have physical damage.

The problem I am trying to avoid is that windows can recognize
semi-damaged file system and write some birocracy data on it (like
creating recycle bin in win9x and who knows what else in winnt,xp
etc.), which can make even more damage to broken fat or root directory
and the file system as whole.

First idea I came to is to tell user to disable hard disk in bios
before connecting it (this would solve also potentialy damaging scan
disk before boot),
but I could not find a way to acces it in windows afterwards, so I
decided on marking fat partitions as "other" instead of fatx from
small utility on bootable floppy or cd. Anyway disabling write through
cable patch seems much more secure and elegant than this (I don't have
to write anything on sector 0).

Have you tried cable like this, and what hapens in that situation
after the boot (are they any error messages from windows, and does it
realy behave exactly like read-only floppy - posting error when you
try to write to it)?

thanx
robby