What's _in_ a hidden partition?

Prompted by the thread where we're trying to help "fake" with his "dark"
laptop, I wondered:

I have a 100 MB (MB, not GB) hidden partition, before my C: partition
(which is 100 GB).

According to Disk Management (Windows 7), this hidden partition is:
o "System Reserved" [where other partitions are "(C" and "data (D"
o "100 MB NTFS"
o "Healthy (System, Active, Primary Partition)"
o 62 MB (so 62%) free, i. e. there's only 38 MB on it.

I'm unlikely to use it, as my backup policy is to image C: (and this
hidden one), but I keep it there as it's so small and _might_ be useful.

But I'm wondering what _is_ the it obviously isn't anywhere near a
copy of Windows 7 waiting to be restored in emergency. But 38 MB, though
tiny compared to Windows (which I think is at least about 20 to 30 GB
unpacked), is to me a lot more than just a boot sector, boot manager,
and so on. So what _is_ in there? What _does_ happen if it is ever
"invoked"?
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

And every day in Britain, 33 properties are sold for around that price [a
million pounds or so]. - Jane Rackham, RT 2015/4/11-17

On 17/3/2018 23:41, J. P. Gilliver (John) wrote:
Prompted by the thread where we're trying to help "fake" with his "dark"
laptop, I wondered:

I have a 100 MB (MB, not GB) hidden partition, before my C: partition
(which is 100 GB).

According to Disk Management (Windows 7), this hidden partition is:
o "System Reserved" [where other partitions are "(C" and "data (D"
o "100 MB NTFS"
o "Healthy (System, Active, Primary Partition)"
o 62 MB (so 62%) free, i. e. there's only 38 MB on it.

I found a 100M system partition sometimes when creating a new OS
partition for Window$ installation in a BLANK new hard disk. I never
looked into it though.

You could, however, extend that 100M partition into a bigger one to make
it the OS partition.

--
@~@ Remain silent! Drink, Blink, Stretch! Live long and prosper!!
/ v \ Simplicity is Beauty!
/( _ )\ May the Force and farces be with you!
^ ^ (x86_64 Ubuntu 9.10) Linux 2.6.39.3
ä¸�借貸! ä¸�è©�騙! ä¸�è³*錢! ä¸�æ�´äº¤! ä¸�打交! ä¸�打劫! ä¸�自殺! ä¸�求神! 請考慮綜æ�´
(CSSA):
http://www.swd.gov.hk/tc/index/site_...sub_addressesa

In message , KenW
writes:
On Sat, 17 Mar 2018 15:41:36 +0000, "J. P. Gilliver (John)"
wrote:

Prompted by the thread where we're trying to help "fake" with his "dark"
laptop, I wondered:

I have a 100 MB (MB, not GB) hidden partition, before my C: partition
(which is 100 GB).

According to Disk Management (Windows 7), this hidden partition is:
o "System Reserved" [where other partitions are "(C" and "data (D"
o "100 MB NTFS"
o "Healthy (System, Active, Primary Partition)"
o 62 MB (so 62%) free, i. e. there's only 38 MB on it.

I'm unlikely to use it, as my backup policy is to image C: (and this
hidden one), but I keep it there as it's so small and _might_ be useful.

But I'm wondering what _is_ the it obviously isn't anywhere near a
copy of Windows 7 waiting to be restored in emergency. But 38 MB, though
tiny compared to Windows (which I think is at least about 20 to 30 GB
unpacked), is to me a lot more than just a boot sector, boot manager,
and so on. So what _is_ in there? What _does_ happen if it is ever
"invoked"?

Get a partition manager, a free one is fine, they usually have a
view/explore partition setting. I like MiniTool Partition Manager
Free.


KenW

Hmm. The one built into W7 doesn't, but you're right, EaseUS does: it
lets me explore the hidden partition to file level, though not view or
do anything with the files. It contains five things in its root: bootmgr
(390.49 KB), BOOTSECT.BAK (8.00 KB), rescuepe.log (94 Bytes), and
folders called Boot and System Volume Information, the latter of which
contains only tracking.log (20.00 KB). Boot contains lots of language
folders, and files BCD (28.00 KB), BCD.LOG (25.00 KB), BCD.LOG1 and
BCD.LOG2 (both 0 bytes), BOOTSTAT.DAT (64.00 KB), and - interestingly -
memtest.exe (474.38 KB). If I look inside one of the language folders,
en-US [there isn't an en-GB )-:], I see bootmgr.exe.mui (83.06 KB) and
memtest.exe.mui (42.58 KB).

So I now know it probably contains a boot manager and a memory tester,
various logs, and probably language files so that those two can "speak"
in assorted languages.

But I'm still puzzled as to what it would actually _do_ if invoked: I
always understood they were some sort of rescue or return-to-as-new
facility, but obviously as a total size of 38 MB, they can't do that on
their own. So, do they just contain a secret set of the most essential
files, or do they know how to find such a secret set, uncorrupted, in
the main partition? Or do they have nothing to do with Windows?

And no, I'm not going to try invoking it: I have no desire to revert to
factory settings (-:! I just wondered, what they do, and how they do it.
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

I can prove anything with statistics - except the truth.

J. P. Gilliver (John) wrote:

Prompted by the thread where we're trying to help "fake" with his "dark"
laptop, I wondered:

I have a 100 MB (MB, not GB) hidden partition, before my C: partition
(which is 100 GB).

According to Disk Management (Windows 7), this hidden partition is:
o "System Reserved" [where other partitions are "(C" and "data (D"
o "100 MB NTFS"
o "Healthy (System, Active, Primary Partition)"
o 62 MB (so 62%) free, i. e. there's only 38 MB on it.

I'm unlikely to use it, as my backup policy is to image C: (and this
hidden one), but I keep it there as it's so small and _might_ be useful.

But I'm wondering what _is_ the it obviously isn't anywhere near a
copy of Windows 7 waiting to be restored in emergency. But 38 MB, though
tiny compared to Windows (which I think is at least about 20 to 30 GB
unpacked), is to me a lot more than just a boot sector, boot manager,
and so on. So what _is_ in there? What _does_ happen if it is ever
"invoked"?

The default install of Windows 7 will be to create 2 partitions. To
provide for recovery options (in case a partition gets corrupted and to
avoid requiring Windows to load), a 100 MB recovery partition gets
created. That will contain the boot sector (first sector of a partition
that the BIOS' boot loader will load into memory and to which control
gets passed), the boot loader (for wherever is the Windows kernel), boot
manager, BCD database (for boot manager), and recovery options. By
having the recovery options in a different partition, they can work on a
non-working instance of Windows in the other partition.

That is *if* there do not already exist any partitions on the target
drive. The get around Windows 7 using 2 partitions, you have to first
[format the drive and] create a partition on the drive, the one where
you intend to install all of Windows 7 in just one partition. If you
use one partition, the boot sector, boot loader/manager/BCD, kernel and
rest of Windows gets loaded into that one partition. If there is
already a partition on the drive, the Windows installer won't change the
partition layout. You could create a partition for some other user and
Windows would use the rest of the drive to create one partition for
itself, or you could point its installer at that partition to get it
installed in that partition.

https://en.wikipedia.org/wiki/System...boot_partition

Microsoft names these partitions unintuitively. The system partition
(small one) is where are the boot files. The boot partition (the big
one) is where are the system files: kernel, rest of OS, apps, and data.
The system and boot partitions can be separate partitions or they can be
the same partition. The point of having a separate partition for the
system is to have recovery options *outside* the partition of the OS
you're trying to repair. While that provides convenience to the typical
user in having the recovery options available on the drive inside the
computer, you can use one partition (that you've already created before
installing Windows) and then create the Windows rescue CD to give you
the recovery options. Another choice is to install another OS into the
BCD for recovery options. That doesn't create a new partition but
instead deposits a .dat file which is an image of an OS environment. It
will get loaded as an imaged OS; however, its .dat file is in the file
system of the OS you are trying to repair. This is also how many backup
programs add a startup option: they create a .pim (Windows PE image with
their program added) and add an entry in BCD to load the .pim image
file, if selected on boot. Just like the recovery image in the .dat
file, a .pim file is in the file system of the OS you are trying to
restore, so make sure to also create a rescue CD for the backup program
to use if the file system gets corrupted or the entire partition
disappears (some malware works by deleting the partition records [but
the partitions are still left behind to recover] or they change the
indexing in the records to offset the partition record but doesn't match
where is the actual partition).

Some multi-boot managers can work with their code solely contained
within the boot sector (e.g., GAG). Some require their own partition:
they still use the boot sector but the rest of the program is saved in a
small partition. Some are stupid in putting themselves within the same
partition as the OS (so if that file system gets corrupt then the multi-
boot manager becomes useless and you lose access to all OSes in the
other partitions. Microsoft decided to emulate the 2nd approach with
their dual-boot manager (don't ask me why Microsoft used "dual" instead
of "multi" since their boot manager with its BCD can load multiple
OSes). The process actually loads the Windows boot loader and boot
manager as the multi-boot manager to then presents what OSes are
available in BCD (boot configuration data) database - which is a binary
database (instead of the old boot.ini text file) and why you have to use
bcdedit to alter its content (like you use regedit to alter the contents
of the registry which is also a binary database).

You could assign a drive letter to the 100 MB partition if you want to
see what is on it. Of course, that leaves it open to malware that hunts
around for drives (by letter designation). I've never bothered to
research if the system and boot partitions (after putting them in
separate partitions during installation) can be merged into one
partitions. For one thing, the entries in the BCD would end up pointing
to partitions that no longer exist or are invalid pointers because
partition layout has changed in its indexing.

You never mentioned whether you built this computer or if you bought a
pre-built. The pre-builts will use the 2-partition layout, and may even
have a 3rd partition where the factory image or a default installer gets
saved as another recovery option made available by the pre-built maker.

Mr. Man-wai Chang wrote:
On 17/3/2018 23:41, J. P. Gilliver (John) wrote:
Prompted by the thread where we're trying to help "fake" with his "dark"
laptop, I wondered:

I have a 100 MB (MB, not GB) hidden partition, before my C: partition
(which is 100 GB).

According to Disk Management (Windows 7), this hidden partition is:
o "System Reserved" [where other partitions are "(C" and "data (D"
o "100 MB NTFS"
o "Healthy (System, Active, Primary Partition)"
o 62 MB (so 62%) free, i. e. there's only 38 MB on it.

I found a 100M system partition sometimes when creating a new OS
partition for Window$ installation in a BLANK new hard disk. I never
looked into it though.

You could, however, extend that 100M partition into a bigger one to make
it the OS partition.


You can combine the materials onto one partition, like this.

"How to Remove the Windows System Reserved Partition"
http://www.terabyteunlimited.com/kb/article.php?id=409

I used that technique on Windows 7, to free up a partition
on an MSDOS-partitioned (MBR) Windows 7 disk.

The main advantage of System Reserved (i.e. leaving it alone),
is for support of BitLocker. If the Windows 7 SKU you are using
doesn't support BitLocker, or you don't plan on ever using
BitLocker, you can squash the two functions together. The
\boot materials on the small partition, are quite happy as
C:\boot. You have to move the Active (boot flag) indicator
though. You can do that with "diskpart".

A 100MB partition has room for \boot and the BCD.

A 450MB partition has room for a WinRE.wim 300MB emergency
boot image.

When you find an OS installation with *two* 450MB partitions,
I can't tell you why they made two of them :-)

The partitions are hidden, to prevent System Restore from
writing into them. And to add an air of mystery to the OS.

The hidden partitions can be examined with TestDisk if you
want, even though the partition type is set as Hidden. TestDisk
can still read them. TestDisk can be run from Windows. TestDisk
can be run from Linux. It doesn't have a fancy GUI though,
and it doesn't explain the possible issues you could cause
for yourself by using some of the commands... One very bad
habit it has, is it can sniff a former-GPT disk, recently
converted to MBR, and propose changing it to GPT again,
when you had absolutely no desire to do so. It's a useful
tool, with a "danger factor" to it. I've learned a lot,
just from the weird outcomes I got using this.

https://www.cgsecurity.org/wiki/TestDisk

TestDisk can also repair the broken $MFTMIRR that the new
Windows 10 insists on creating, when it makes NTFS partitions.
CHKDSK doesn't seem to be fixing that, although it should.
Windows 10 wasn't doing that in the first release, but
it makes broken $MFTMIRR now, today.

Paul

On Sat, 17 Mar 2018 15:41:36 +0000, J. P. Gilliver (John) wrote:

Prompted by the thread where we're trying to help "fake" with his "dark"
laptop, I wondered:

I have a 100 MB (MB, not GB) hidden partition, before my C: partition
(which is 100 GB).

According to Disk Management (Windows 7), this hidden partition is:
o "System Reserved" [where other partitions are "(C" and "data (D"
o "100 MB NTFS"
o "Healthy (System, Active, Primary Partition)"
o 62 MB (so 62%) free, i. e. there's only 38 MB on it.

I'm unlikely to use it, as my backup policy is to image C: (and this
hidden one), but I keep it there as it's so small and _might_ be useful.

But I'm wondering what _is_ the it obviously isn't anywhere near a
copy of Windows 7 waiting to be restored in emergency. But 38 MB, though
tiny compared to Windows (which I think is at least about 20 to 30 GB
unpacked), is to me a lot more than just a boot sector, boot manager,
and so on. So what _is_ in there? What _does_ happen if it is ever
"invoked"?

It's the active partition, it contains the boot routines and once
loaded it transfers control to the C drive. Without a backup of it your
emergency recovery won't be able to restore a bootable drive, it MUST
be backed up!

--
Faster, cheaper, quieter than HS2
and built in 5 years;
UKUltraspeed http://www.500kmh.com/

"J. P. Gilliver (John)" wrote

| I'm unlikely to use it, as my backup policy is to image C:

In that case you'd do well to follow Pauls' instructions.
It's a fairly easy job to get the boot files onto C and
then you've got a whole, functional system to image.

In message , VanguardLH
writes:
J. P. Gilliver (John) wrote:
[]
But I'm wondering what _is_ the it obviously isn't anywhere near a
copy of Windows 7 waiting to be restored in emergency. But 38 MB, though
tiny compared to Windows (which I think is at least about 20 to 30 GB
unpacked), is to me a lot more than just a boot sector, boot manager,
and so on. So what _is_ in there? What _does_ happen if it is ever
"invoked"?
[]
avoid requiring Windows to load), a 100 MB recovery partition gets
[]
Microsoft names these partitions unintuitively. The system partition
(small one) is where are the boot files. The boot partition (the big
one) is where are the system files: kernel, rest of OS, apps, and data.
[]
Thanks for excellent detailed information; my head is spinning and I got
maybe one tenth of it, though I have marked it "keep" and might get more
if I really concentrated!

So, basically, although sometimes the little one is called a "Recovery"
partition, it is as I suspected: it can't really "recover" a corrupted
system, as it's far too small.

You could assign a drive letter to the 100 MB partition if you want to

Hadn't thought of that. Might, though probably won't, ...

see what is on it. Of course, that leaves it open to malware that hunts

.... if only for that reason.

around for drives (by letter designation). I've never bothered to
[]
You never mentioned whether you built this computer or if you bought a
pre-built. The pre-builts will use the 2-partition layout, and may even
have a 3rd partition where the factory image or a default installer gets
saved as another recovery option made available by the pre-built maker.

It is a laptop I obtained second-hand; it had about a 110 G HD, rather
than the 250 or so online documentation suggests was normally supplied,
so I imagine the reseller had switched drives. I have since fitted a
"1T" (931-odd G) drive, but left the partitions as they were (actually
the first time I've used Macrium's clone, as opposed to image, facility:
it worked perfectly).
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

But this can only happen if we replace the urge to blame with the urge to
learn so that it is safe for staff to admit errors and raise concerns without
the fear of being punished.
- Former MI5 boss Eliza Manningham-Buller, RT 2016/5/7-13

On 18/3/2018 00:52, Paul wrote: onto one partition, like this.

"How to Remove the Windows System Reserved Partition"
http://www.terabyteunlimited.com/kb/article.php?id=409

I used that technique on Windows 7, to free up a partition
on an MSDOS-partitioned (MBR) Windows 7 disk.
....

You don't need additional tools to extend that system/reserved partition.

That 100M partition was not usually found when installing older Window$,
only started with Win 8? Couldn't quite remember....

--
@~@ Remain silent! Drink, Blink, Stretch! Live long and prosper!!
/ v \ Simplicity is Beauty!
/( _ )\ May the Force and farces be with you!
^ ^ (x86_64 Ubuntu 9.10) Linux 2.6.39.3
ä¸�借貸! ä¸�è©�騙! ä¸�è³*錢! ä¸�æ�´äº¤! ä¸�打交! ä¸�打劫! ä¸�自殺! ä¸�求神! 請考慮綜æ�´
(CSSA):
http://www.swd.gov.hk/tc/index/site_...sub_addressesa

In message , Mayayana
writes:
"J. P. Gilliver (John)" wrote

| I'm unlikely to use it, as my backup policy is to image C:

*And* the hidden partition (I did say that but you snipped it!)

In that case you'd do well to follow Pauls' instructions.
It's a fairly easy job to get the boot files onto C and
then you've got a whole, functional system to image.

I image the hidden and C: into my image files.


--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

But this can only happen if we replace the urge to blame with the urge to
learn so that it is safe for staff to admit errors and raise concerns without
the fear of being punished.
- Former MI5 boss Eliza Manningham-Buller, RT 2016/5/7-13

In message , Mr. Man-wai
Chang writes:
[]
That 100M partition was not usually found when installing older
Window$, only started with Win 8? Couldn't quite remember....

I have it on this 7 machine, and there was/is one on the HD of my old XP
machine, which was there from new.
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

But this can only happen if we replace the urge to blame with the urge to
learn so that it is safe for staff to admit errors and raise concerns without
the fear of being punished.
- Former MI5 boss Eliza Manningham-Buller, RT 2016/5/7-13

On 18/3/2018 01:14, J. P. Gilliver (John) wrote:
I have it on this 7 machine, and there was/is one on the HD of my old XP
machine, which was there from new.

I still don't know why that 100M partition was needed. Sometimes, it's
mandatory to have it ... I just don't understand.

--
@~@ Remain silent! Drink, Blink, Stretch! Live long and prosper!!
/ v \ Simplicity is Beauty!
/( _ )\ May the Force and farces be with you!
^ ^ (x86_64 Ubuntu 9.10) Linux 2.6.39.3
ä¸�借貸! ä¸�è©�騙! ä¸�è³*錢! ä¸�æ�´äº¤! ä¸�打交! ä¸�打劫! ä¸�自殺! ä¸�求神! 請考慮綜æ�´
(CSSA):
http://www.swd.gov.hk/tc/index/site_...sub_addressesa

On 18/3/2018 01:25, Mr. Man-wai Chang wrote:
On 18/3/2018 01:14, J. P. Gilliver (John) wrote:
I have it on this 7 machine, and there was/is one on the HD of my old XP
machine, which was there from new.

I still don't know why that 100M partition was needed. Sometimes, it's
mandatory to have it ... I just don't understand.


Possibly some dirty play in the part of Micro$oft?

--
@~@ Remain silent! Drink, Blink, Stretch! Live long and prosper!!
/ v \ Simplicity is Beauty!
/( _ )\ May the Force and farces be with you!
^ ^ (x86_64 Ubuntu 9.10) Linux 2.6.39.3
ä¸�借貸! ä¸�è©�騙! ä¸�è³*錢! ä¸�æ�´äº¤! ä¸�打交! ä¸�打劫! ä¸�自殺! ä¸�求神! 請考慮綜æ�´
(CSSA):
http://www.swd.gov.hk/tc/index/site_...sub_addressesa

On 17/03/2018 17:14, J. P. Gilliver (John) wrote:
In message , Mr. Man-wai
Chang writes:
[]
That 100M partition was not usually found when installing older
Window$, only started with Win 8? Couldn't quite remember....

I have it on this 7 machine, and there was/is one on the HD of my old XP
machine, which was there from new.

As others have pointed out, the W7 hidden partition is put there by
default when you install W7, and it contains the boot files, Microsoft's
poor man's grub. However, I think the option is there for manufacturers
to put their own stuff on it as well, drivers and such like, and perhaps
a some sort of recovery option to return the PC to its factory default
state. As others have also pointed out, if you are installing W7
yourself, you can avoid the automatic creation of the hidden partition
by allocating all the free space on the disk to a partition structure of
your own choosing, and then installing W7 into one of those partitions.

In such manner, there is no hidden partition on this W7 PC. Its disk
space is split between a 64GB system partition containing W7 including
its boot files, and a partition taking up the rest of the disk space
containing my own data. As I back up the system partition using Ghost,
I have no need of any special recovery or similar partition.

My suspicion is that your XP hidden partition was put there by the
manufacturer to hold a recovery option of some sort, as mentioned above.
AFAICR, neither 2k nor XP setup.exe put one there by default.

In message , Java Jive
writes:
[]
like, and perhaps a some sort of recovery option to return the PC to
its factory default state. As others have also pointed out, if you are
[]
My suspicion is that your XP hidden partition was put there by the
manufacturer to hold a recovery option of some sort, as mentioned
(Samsung)
above. AFAICR, neither 2k nor XP setup.exe put one there by default.

The "return to factory default state" is misleading, though: they rely
on a lot of the OS remaining on the C: partition. 100M (let alone 38M)
is far too small for even XP, let alone 7.
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

"Bother," said Pooh, as Windows crashed into piglet.