4 Replies Latest reply on May 3, 2011 7:08 AM by TechSecurityNate

    Help with Partinfo.exe and Force Sector Decrypt

      Below is the output of a machine with an encrypted C: Partition and an unencrypted "Q" partition.

       

      It's clear from the data that the C: Partition starts at sector 63 and comprises of  135781317 sectors. So to Force Decrypt this sector range, this would imply that the range is:

       

      63 - 135781380

       

      HOWEVER.......sector 135781380 is the START sector of the other, unencrypted, partition. So do I want to decrypt this last sector that seems to overlap to the other partition??

       

      Confused.

       

       

      Incidently, I'm doing this as the MBR is totally knackered and a regular SafeTech Removal is telling me that SB isn't installed. I've done this process a few times before but not encountered this 'overlap' in sectors before (usually becasue I'm force-decrypting the last partition on the disc.)

       

      I am using SafeBoot v4.2.15 before anyone suggests Wintech.

        • 1. Re: Help with Partinfo.exe and Force Sector Decrypt

          PARTINFO DATA:

           


          PARTINFO 1.10
          Copyright (c) 1996-2006 TeraByte, Inc.  All rights reserved.

          Run date: 04/29/2011 13:29

          ====================================================================
                     MBR Partition Information (HD0 - 0xCEEF56DD)
                                   (CHS: 1021/254/63)
          +====+====+=============+====+=============+===========+===========+
          | 0: | 80 |    0   1  1 |  7 | 1023 254 63 |        63 | 135781317 |
          | 1: |  0 | 1023   0  1 |  7 | 1023 254 63 | 135781380 |  20482875 |
          | 2: |  0 |    0   0  0 |  0 |    0   0  0 |         0 |         0 |
          | 3: |  0 |    0   0  0 |  0 |    0   0  0 |         0 |         0 |
          +====+====+=============+====+=============+===========+===========+
                                     BOOT SECTOR INFORMATION
          -------------------------------------------------------------------------------
          File System ID: 0x7   LBA: 63  Total Sectors: 135781317   ID: 0x1
                                    Jump: 45 B3 1C
                                OEM Name: '–8 .°6ë
                           Bytes Per Sec: 43565
                           Sec Per Clust: 226
                             Res Sectors: 50903
                                Num FATs: 152
                           Root Dir Ents: 2931
                                 Sectors: 56474
                                   Media: 0xEF
                            Secs Per FAT: 11934
                           Sec Per Track: 61668
                                   Heads: 34942
                             Hidden Secs: 1659925733
                            Huge Sectors: 1729574940
                               Drive Num: 0xDB
                                     Res: 0xEF
                                     Sig: 0x26
                                  Vol ID: 0x155282B6
                            Volume Label:  "²þÙ pÓi

                                 FS Type: ò-ª ÃP¨.
                               Boot Flag: 0x4609
          -------------------------------------------------------------------------------
          File System ID: 0x7   LBA: 135781380  Total Sectors: 20482875   ID: 0x2
                                    Jump: EB 52 90
                                OEM Name: NTFS   
                           Bytes Per Sec: 512
                           Sec Per Clust: 8
                             Res Sectors: 0
                                  Zero 1: 0x0
                                  Zero 2: 0x0
                                    NA 1: 0x0
                                   Media: 0xF8
                                  Zero 3: 0x0
                           Sec Per Track: 63
                                   Heads: 255
                             Hidden Secs: 135781380
                                    NA 2: 0x0
                                    NA 3: 0x800080
                           Total Sectors: 0x01388B3A
                                 MFT LCN: 0x0C0000
                            MFT Mirr LCN: 0x01388B3
                           Clust Per FRS: 0xF6
                        Clust Per IBlock: 0x1
                               Volume SN: 0x64DC3000DC2FCADE
                                Checksum: 0x0
                               Boot Flag: 0xAA55
          -------------------------------------------------------------------------------

          • 2. Re: Help with Partinfo.exe and Force Sector Decrypt
            TechSecurityNate

            They actually aren't overlapping.  It's a little confusing to wrap your head around, but sector 63 is your start, so it is one of the count.  Think of the math as if 1 is your start.  You wouldn't just add the count to get the end of your range.

             

            In other words, you are off by one sector.  Yes, I could have just said that, but I wanted to try to put some logic to it.  I always just remember to take the following:

             

                 Start

            +Count

            -     one

            ______

                 End

             

            This becomes really fun when you have multiple partitions on a drive.

             

            Message was edited by: TechSecurityNate on 5/3/11 7:53:07 AM EDT
            • 4. Re: Help with Partinfo.exe and Force Sector Decrypt
              TechSecurityNate

              NP... Fun with WIntech is one of my favorite games.  I try to play it at least once a week.