unhiding hidden partition on the fly

Several PCs I work with every day have hidden FAT partitions that are used
for booting into DOS at times.
Since Windows does not see the hidden partition there is no direct way of
accessing the data. Currently I am using a user mode tool that directly
accesses the hard drive and does all the FAT interpretation by itself so I
can read and write files to the partition.
I was wondering if it was possible to write a filter driver that would
reinterpret the hidden partition into a 'normal' partition and also make it
removable, so I could mount the partition on the fly and rely on Windows file
system code instead of doing it myself.
Would such a driver be a upper storage filter driver of a file system
driver? Also would I be able to mount/unmount the partition without rebooting
the system?

440gtx
Mon Feb 07 21:59:31 CST 2005

You could write a bus filter to implement this. In a nutshell, you
would add your own PDO in IRP_MN_QUERY_DEVICE_RELATIONS beside the disk
drive. A bus filter is a reasonably large sized project.

Another approach would be a scsi miniport driver. You would simply
expose the partition as a disk drive and then Windows would
automatically give it a drive letter. You would have dynamic load
through "add new hardware" and dynamic unload by removing from device
manager (or you could do either of these programtically through the
setup api's). Internally, you would interpret as little as 3 scsi
commands (read capacity, read, and write) to be specific to that
partition. A miniport to do this should be less than a 3K sys file
binary to let you know just how little code this takes.

The best approach is to do this with no driver at all if possible.
Would it be possible to write to the partition table to unhide the
partition and force Windows to remount? Partition magic is an off the
shelf product that does things like this, though I'm not sure if a
reboot is required to activate / deactivate such a partition.

Maxim
Mon Feb 07 22:54:39 CST 2005

You need a disk filter which will patch the partition type on the fly to
make it, say, FAT.
Otherwise, MountMgr will not be able to see it and assign a drive letter to
it.

--
Maxim Shatskih, Windows DDK MVP
StorageCraft Corporation
maxim@storagecraft.com
http://www.storagecraft.com

"Gerhard" <Gerhard@discussions.microsoft.com> wrote in message
news:381392CB-832D-430D-ABC0-4FB9BB1A6180@microsoft.com...
> Several PCs I work with every day have hidden FAT partitions that are used
> for booting into DOS at times.
> Since Windows does not see the hidden partition there is no direct way of
> accessing the data. Currently I am using a user mode tool that directly
> accesses the hard drive and does all the FAT interpretation by itself so I
> can read and write files to the partition.
> I was wondering if it was possible to write a filter driver that would
> reinterpret the hidden partition into a 'normal' partition and also make it
> removable, so I could mount the partition on the fly and rely on Windows file
> system code instead of doing it myself.
> Would such a driver be a upper storage filter driver of a file system
> driver? Also would I be able to mount/unmount the partition without rebooting
> the system?

Gerhard
Tue Feb 08 04:33:03 CST 2005

You are right, it is easier to do this without a driver, as I am doing it
now. I simply realized that I was reinventing the wheel while I was writing
my FAT interpretation tool that writes are reads to the partition from user
mode.

PQ magic does the unhiding thing but I have to reboot the PC, which is
'unacceptable' in my situation.

I will persue your suggestions for educational purposes.

Thanks guys!

"440gtx@email.com" wrote:

> You could write a bus filter to implement this. In a nutshell, you
> would add your own PDO in IRP_MN_QUERY_DEVICE_RELATIONS beside the disk
> drive. A bus filter is a reasonably large sized project.
>
> Another approach would be a scsi miniport driver. You would simply
> expose the partition as a disk drive and then Windows would
> automatically give it a drive letter. You would have dynamic load
> through "add new hardware" and dynamic unload by removing from device
> manager (or you could do either of these programtically through the
> setup api's). Internally, you would interpret as little as 3 scsi
> commands (read capacity, read, and write) to be specific to that
> partition. A miniport to do this should be less than a 3K sys file
> binary to let you know just how little code this takes.
>
> The best approach is to do this with no driver at all if possible.
> Would it be possible to write to the partition table to unhide the
> partition and force Windows to remount? Partition magic is an off the
> shelf product that does things like this, though I'm not sure if a
> reboot is required to activate / deactivate such a partition.

Ralf
Tue Feb 08 06:32:54 CST 2005

Maxim S. Shatskih wrote:

>You need a disk filter which will patch the partition type on the fly to
>make it, say, FAT.
>Otherwise, MountMgr will not be able to see it and assign a drive letter to
>it.

What about just patching the partition type from user mode and then
sending a IOCTL_DISK_UPDATE_PROPERTIES (in XP/2003) to the physical disk
device? For W2K, I'd try things in this order

FSCTL_LOCK_VOLUME
patch partition type
FSCTL_UNLOCK_VOLUME
FSCTL_DISMOUNT_VOLUME
IOCTL_MOUNTMGR_VOLUME_ARRIVAL_NOTIFICATION

Not sure this will work because I don't know whether lock/dismount
actually does something for the RAW file system.

Ralf.