±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 7 Overall: 36105
New Yesterday: 9 Visitors: 161

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Unused space at the end of the disk and between partitions

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

ckwongkennyw
Newbie
 

Unused space at the end of the disk and between partitions

Post Posted: Oct 09, 19 06:02

Hi all,

I would like to ask why there are unused spaces (not allocated to any partitions) exist between some partitions and at the end of the hard disk?

Thank you Smile  
 
  

jaclaz
Senior Member
 

Re: Unused space at the end of the disk and between partitions

Post Posted: Oct 09, 19 07:06

- ckwongkennyw
Hi all,

I would like to ask why there are unused spaces (not allocated to any partitions) exist between some partitions and at the end of the hard disk?

Thank you Smile

And the usual answer is "it depends".

Traditionally (which means up to XP in the windows world) there was a convention to respect the geometry of the disk.
So, basically you would have all indexed space a multiple of 1 cylinder size.
Since almost *any* device will have a n/255/63 CHS geometry and a 512 bytes sector, that means that multiples of 1x255x63x512=8225280.
Since almost *no* device capacity is actually a multiple of 8225280, that explains some empty space at the end of the disk.

Later the convention is about 1 MB (2048 sectors) alignment.

Each and every partitioning/formatting tool may have implemented the one (or the other) standard in a slightly different manner, and if more than one tool has been used on a same disk it is not rare (but not-so-common) to have empty space between two partitions.

If you partition a disk "all in one session" and with a same tool, *any* partitioning tool will propose you to start the "next partition" right at the end of the previous one (but if the "previous" partition does not respect the convention the start of the new partition may well be determined by the alignment convention instead), as well if you "shrink" a partition/volume without moving/enlarging following partitions you create "non-indexed" area.

And of course there are other cases, when the partitioning is done manually and either intentionally or by mistake a partition is created leaving "holes" in the indexing.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 

Page 1 of 1