App for finding hidden drives

[mekon]

I have a program on a key that I have mislaid that would show hidden drives.I cannot remember the name of it to save my life. Does anybody know what I'm talking about or recommend something. If anybody out there can respond quickly you might just save me a 60 mile round trip.

[Tweak]

Do you refer to the listings in Device Manager?

1) Open the “Start” menu and choose “Run…”
2) Type in “cmd” (without the quotes) and click “ok”.
3) At the cmd prompt, type in “set devmgr_show_nonpresent_devices=1″ (without the quotes) and press enter. (Note that nothing seems to happen–this is ok. We are actually setting an environment variable which is going to help us to see hidden devices)
4) On the next cmd prompt line, type in “devmgmt.msc” (without the quotes) and press enter. This will launch the Windows Device Manager Console.
5) In the Device Manager Console, from the “View” menu, select “Show Hidden Devices”.

[PatrickB]

That was interesting Tweak!

Mekon, you should be able to see all drives in the Disk Management:
Start > Run > diskmgmt.msc

-- Patrick B.

[mekon]

I understand from the customer that the computer has a passworded hidden recovery partition. If it has, I can't find it. It isn't showing up in diskmgmt.msc or easeus. I do however believe her because she says the techie with whom she has now fallen out used to be able to reset the computer to factory settings in about 10mins; not the sort of thing that an old dear in her seventies is likely to know. I have a program that shows everything that has a drive letter no matter what has been used to hide it, but I have mislaid the key it is on. It is so annoying

[PatrickB]

It isn't showing up in diskmgmt.msc or easeus.

Does the total size shown equal the size specified by the manufacturer for that model number of hard drive? If so, there is no hidden partition -- unless:

... something like something like Truecrypt is being used that can manage a hidden "partition" within an existing partition. It just looks like white noise, empty space, but Truecrypt can use it.

-- Patrick B.

[Tweak]

Originally Posted by mekon

I understand from the customer that the computer has a passworded hidden recovery partition. If it has, I can't find it. It isn't showing up in diskmgmt.msc or easeus. I do however believe her because she says the techie with whom she has now fallen out used to be able to reset the computer to factory settings in about 10mins; not the sort of thing that an old dear in her seventies is likely to know. I have a program that shows everything that has a drive letter no matter what has been used to hide it, but I have mislaid the key it is on. It is so annoying

Tried Partition Magic or Paragon Partition Manager by chance? Tried using a bootable cd such as UBCD4Win? I have created backups in the past then used Partition Magic to make them hidden.

And Patrick, using that you should see loads of things no longer connected, funny when you ask someone if they have a HP printer or a Sony camera at home and they are making a weird face trying to figure out how you know that. Greyed items are no longer attached, removing some dealing with network and audio can cause serious problems though.

[PatrickB]

Originally Posted by Tweak

And Patrick, using that you should see loads of things no longer connected, funny when you ask someone if they have a HP printer or a Sony camera at home and they are making a weird face trying to figure out how you know that. Greyed items are no longer attached, removing some dealing with network and audio can cause serious problems though.

Err, sorry Tweak. I missed the reference. DiskMgmt.msc? Truecrypt?

I have used Nirsoft's USBDeview to find usb items that have been plugged in.

-- Patrick B.

[Tweak]

Originally Posted by PatrickB

Err, sorry Tweak. I missed the reference. DiskMgmt.msc? Truecrypt?

I have used Nirsoft's USBDeview to find usb items that have been plugged in.

-- Patrick B.

Only referring to the hidden devices within the Device Manager, the original poster I wasn't 100% clear on the request...seems he referred to a disk volume where I was reading as an application to view hidden devices/drives and misunderstood.

[mekon]

Originally Posted by PatrickB

It isn't showing up in diskmgmt.msc or easeus.

Does the total size shown equal the size specified by the manufacturer for that model number of hard drive? If so, there is no hidden partition -- unless:

... something like something like Truecrypt is being used that can manage a hidden "partition" within an existing partition. It just looks like white noise, empty space, but Truecrypt can use it.

-- Patrick B.

Sorry boys. Nothing quite like asking for help by braille is there? There is 3GB missing from the volume. I can't see anything untowards in linux. I've probably spent too long on this already but you know what it's like; it gets personal.

[PatrickB]

Mekon, I found this in my bookmarks. It looks like it would find that 3 GB if anything would. Let us know how it goes.

TestDisk
http://www.cgsecurity.org/wiki/TestDisk

TestDisk can

• Fix partition table, recover deleted partition
• Recover FAT32 boot sector from its backup
• Rebuild FAT12/FAT16/FAT32 boot sector
• Fix FAT tables
• Rebuild NTFS boot sector
• Recover NTFS boot sector from its backup
• Fix MFT using MFT mirror
• Locate ext2/ext3 Backup SuperBlock
• Undelete files from FAT, NTFS and ext2 filesystem
• Copy files from deleted FAT, NTFS and ext2/ext3 partitions.

In a second step, TestDisk searches for 'lost partitions' without making use of any results from the previous step. This is the heart of TestDisk's powerful capabilities! TestDisk assumes the existence of partitions and scans all relevant locations for them. With a PC/Intel partition table, a primary partition usually starts at the beginning of a cylinder (head=0, sector=1), while a logical partition starts a little further along (head=1, sector=1).

For each possible partition starting location, TestDisk can search for the presence of a filesystem header (FAT or NTFS boot sector, ext2/ext3 superblock, BSD disklabel...), which confirms the presence of a known partition type. Thus, the size of a partition is determined directly from its structure on the disk. Each partition that TestDisk discovers is added to a list of found partitions.

Here is an example of its "Analyse" command

Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63
Current partition structure:
Partition Start End Size in sectors
1 * FAT32 0 1 1 1010 254 63 16241652 [NO NAME]
2 P Linux 1011 0 1 1023 254 63 208845 [/boot]
3 E extended LBA 1024 0 1 14592 254 63 217985985
5 L Linux RAID 1024 1 1 3573 254 63 40965687 [md0]
X extended 3574 0 1 4210 254 63 10233405
6 L Linux RAID 3574 1 1 4210 254 63 10233342 [md1]
X extended 4211 0 1 14592 254 63 166786830
7 L Linux 4211 1 1 14592 254 63 166786767

-- Patrick B.