what happens when usng open disk feature

Help on how to use HxD.
Post Reply
Polarfoil
Posts: 1
Joined: 15 Apr 2010 22:03

what happens when usng open disk feature

Post by Polarfoil »

I wanted to make an exact image of a complete disk. It's a laptop hard drive that was attached to my PC via SATA-to-USB converter cable. I opened the disk with HxD (read only) and had HxD calculate the md5 hash. Then I used dd for Windows to make a complete copy of the disk to a file on another disk. I used HxD to calculate the md5 hash on the image file, and the hashes did not match.

Can anyone tell me if the disk is being changed somehow even though I'm opening in HxD as read only? Might Windows be changing the disk somehow during the md5 calculation (on a 120GB disk it took about six hours)? Anyone know the technical details of what Windows does to disk data when mounted and/or while it's mounted and/or when it's unmounted?

I've heard/read elsewhere that Windows writes a disk signature to every disk you attach--but I have not been able to find any reference that specifically says if this is done once or every time, or if it is done only when there is a disk signature collision or if the existing signature is always overwritten. I have also heard that System Restore will create a folder on every disk you attach, maybe even if System Restore is turned off. But does this feature continuously write to the disk or does it write once when mounted, and that's it?

Thanks.
Maël
Site Admin
Posts: 1455
Joined: 12 Mar 2005 14:15

Re: what happens when usng open disk feature

Post by Maël »

Polarfoil wrote: Can anyone tell me if the disk is being changed somehow even though I'm opening in HxD as read only?
HxD will not change the disk (that's however the only thing readonly guarantees), but it's entirely possible that the disk is changed outside of HxD, indeed.
Polarfoil wrote:Then I used dd for Windows to make a complete copy of the disk to a file on another disk.
You can just use File|Save as... for making a disk image.

About Windows changing the disk contents: yes there might be several services affecting the disk contents or other software affecting it. Usually if the disk has no file system that Windows can recognize then it will not alter anything. However, the only reliable way I know of to ensure Windows will not modify a disk at all is to use a dongle/hardware plugged inbetween the disk and motherboard that prevents disk writes.

EDIT: I haven't tried it myself but here is a forum post about software solutions: How to Write Protect and Disable USB Drive
Post Reply