Take the 2-minute tour ×

QUESTION : Can the apparently "random"-ish data written to a full drive (not just a partition) during a random "wipe" or encryption be somehow interpreted by the computer as having a "valid" MBR Partition table? (Since the random data is written to the first 512 bytes of the drive when you choose a full drive --- I think).

Note: I'm using Truecrypt, however I think the same issue can logically occur whether random wiping or encrypting. I've thought more about my previous wall-o-text post (here: Why is TrueCrypt creating random "phantom partitions" when encryption a full drive? ) and I realized I could probably ask this in a much simpler and refined way above regardless of the operating system or program used.

BACKGROUND : Each time I re-encrypt the same drive (full drive), I keep getting these partitions of various sizes showing up (expanded description in the posted wall-o-text link above if you would like to see more).

MY GUESS: I think maybe the proper location of bytes of the MBR are getting filled with seemingly valid data to make it appear as though it's defining a partition table (even though the partitions are totally wacky, and are impossible sizes). It only happens with one particular hard drive, I can't seem to make it happen with another drive (flash drive this time instead of an external backup drive).

The flash drive doesn't seem to have the fake partitions be generated on it despite numerous attempts, but the external backup drive does consistently.

Or does it likely seem to be a hardware related issue with my external hard drive do you think?

OTHER MISC INFO: Note: I can mount the "device" perfectly fine (if I choose the physical "drive", and not one of the weird partitions), I just can't figure out why there are these fake and wildly random partitions showing up when I connect the external drive. I just would have thought there's some sort of standard signature check of the MBR partition table to prevent weird partitions from being registered when you connect the external hard drive.

A partition manager software (GParted) doesn't register and display the random fake partitions, but the Operating system (Linux in this case) does register them, and so does Truecrypt itself (probably due to querying the operating system).

Do you think this is normal to have happen? I don't remember it happening initially when I first encrypted the drive; but it seems to happen consistently upon every attempt to re-encrypt the drive to see if it finally stops doing it.

share|improve this question
Since that is clearly not the intention it could only be because of buggy s/w. Maybe best post to the TrueCrypt support forum? (forums.truecrypt.org) I can only say that I have used TC for years in the manner which you describe and have never once seen a new partition appearing ... sounds curios, best ask the TC guys –  Mawg Dec 27 '12 at 3:21
I've also used Truecrypt for quite a long time, but encrypted partitions, and not a full drive. Only recently did I decide to encrypt the full device (no partitions at all). It just seems plausible in my mind that random data might be interpreted as a partition table --- but, if so, I would imagine every drive would have an equally likely chance of this occurring. Likewise, I would imagine everyone that wipes a drive would notice this odd occurrence as well.. –  Mikeweb49 Dec 27 '12 at 3:31
Statistically, it is possible for random data to just happen to describe a valid partition header, but such an event is inconceivably unlikely. For all intents and purposes, the probability of this occurring is zero. –  Thomas Dec 27 '12 at 3:45
Thomas, that's what I was thinking too... statistically unlikely --- except in my case it's happening quite consistently (at least 5 times in a row with different partitions arrangements showing up using certain tools). However, that seems to only be recognized by Linux (while watching /var/log/syslog) and Truecrypt. Other software such as partition management software doesn't seem to show the partitions, nor does the linux command "fdisk -l". Thanks for your input. –  Mikeweb49 Dec 27 '12 at 5:10
add comment

closed as not constructive by techie007, Simon Sheehan, 8088, Renan, ChrisF Dec 27 '12 at 12:36


2 Answers

My guess would be that the problem lies in your hardware since your flash drive never has this problem (but also, naturally, will have an MBR) and your hard drive does consistently.

share|improve this answer
Well, technically the flash drive shouldn't have a truly valid MBR either since I first wiped out all partitions on that drive too prior to encrypting it. –  Mikeweb49 Dec 27 '12 at 3:27
add comment

Some hard drives come with specialized firmware to keep a private partition used to store apps or sensitive data used by the drive. This is sometimes used for bootstrapping secure systems and can be leveraged by OS and user level apps given the right toolset.

share|improve this answer
Interesting.. I'm trying to think how that could be interpreted by the OS as partitions. I did use a hex editor to analyze the first 512 bytes of the drive itself and there doesn't seem to be the proper signature in the last 2 bytes (bytes 511 and 512) of the MBR.. Possibly what you're referring to is the first 446 bytes of the MBR where you can store boot code, etc? If so, that shouldn't represent partitions. Bytes 447 through 510 store the partition table (16 bytes per entry for a total of 4 entries = 64 bytes). For all I can see, it's entirely random data. –  Mikeweb49 Dec 27 '12 at 3:36
add comment
