Menu Geometry
TestDisk 6.2-WIP, Data Recovery Utility, November 2005
Christophe GRENIER <grenier@cgsecurity.org>
https://www.cgsecurity.org
Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512
Because these numbers change the way that TestDisk looks for partitions
and calculates their sizes, it's important to have the correct disk geometry.
PC partitioning programs often make partitions end on cylinder boundaries.
A partition's CHS values are based on disk translations which make them
different than its physical geometry. The most common CHS head values
are: 255, 240 and sometimes 16.
[ Cylinders ] [ Heads ] [ Sectors ] [ Sector Size ] [ Ok ]
Done with changing geometry
Change hard disk geometry parameters (Cylinders, Heads, Sectors).
- Usually PC partitioning programs found on Dos, Windows 9x/2000/XP/2003, RedHat Enterprise Linux 5 and before make partitions start and end on cylinder boundaries.
- More recent programs use 1MB boundaries, it's the default for Windows Vista/7/2008 and later, RedHat Enterprise Linux 6 and later.
Using partition aligned on 1MB boundaries give better performance for RAID device, SSD, computer virtualization (VMware, Hyper-V...).
CHS numbers change the way that TestDisk looks for partitions and calculates their sizes, etc. It does not affect the hard drive itself, unless you actually write data about lost partitions to the drive. Choosing the wrong geometry settings and then saving any lost partitions based on those faulty settings might make it harder or impossible to recover your data.
Some background information
To access data, modern operating systems use logical block addressing. HD sectors are numbered 0,1, 2 up to N-1 where N is the total number of sectors.
But before IDE disks larger than 8 GB and SCSI disks existed, another method was used. To access data, the BIOS and the operating system (DOS/Win9x) used CHS addressing. CHS values are limited to 1023 cylinders, 255 heads and 63 sectors (8 GB). A common trick introduced with hard drives bigger than 504 MB (1023 cylinders, 16 heads, 63 sectors) was to use a geometry (Cylinder/Heads/Sector) different from the physical geometry (Extended CHS or large mode addressing).
A method used by BIOS is to read the partition table and to guess the number of heads. When the partition table is cleared or corrupted, the physical disk geometry may be used instead. It becomes harder for partition recovery utilities to find lost partitions on the hard disk.
This problem is not limited to DOS users. Linux users can also be affected.
Under Linux, run dmesg and search for Partition check.
In the following example, the geometry of hard disk hdc is determined by the partition table (PTBL).
Partition check: hda: hda1 hda2 hda3 hda4 < hda5 hda6 hda7 hda8 hda9 hda10 hda11 hda12 hda13 > hda3: <bsd: hda14 hda15 hda16 hda17 > hdc: [PTBL] [7476/255/63] hdc1 < hdc5 hdc6 hdc7 hdc8 hdc9 hdc10 hdc11 hdc12 hdc13 >
How does TestDisk get the disk geometry?
- Under DOS, TestDisk gets the disk sizes using an extended BIOS function (ah=0x48, int 0x13), and geometry (number of heads and sectors) using a standard BIOS function (ah=0x08, int 0x13). TestDisk uses the default sector size of 512 bytes.
- Under Windows, TestDisk gets the numbers of cylinders, heads and sectors, and the sector size using the DeviceIoControl call, IOCTL_DISK_GET_DRIVE_GEOMETRY.
- Under Linux, TestDisk gets the sector size using BLKSSZGET ioctl, and the geometry using HDIO_GETGEO_BIG or HDIO_GETGEO ioctl; the disk sizes are from BLKGETSIZE64 or BLKGETSIZE.
- Under BSD, TestDisk gets all information using DIOCGDINFO. If that fails, TestDisk assumes the sector size is 512 bytes, and it uses DIOCGFWSECTORS, DIOCGFWHEADS and DIOCGMEDIASIZE to get all the other parameters.
- Under Sun Solaris, TestDisk uses the default sector size of 512 bytes, and gets the numbers of cylinders, heads and sectors using the DKIOCGGEOM ioctl.
Some hints about the geometry
How to find the correct number of heads?
If the HD geometry mismatches the geometry used when creating the partition table, warning messages such as: Bad sector count,
Bad relative sector or Bad ending head are displayed when Analyse is selected from the main menu. If you see such errors, you may need to use the Geometry menu to change the logical number of heads.
Try 255, 16, 32, 64, 128 and 240 heads until TestDisk finds all your partitions. 255 and 240 are the most common head values. If you installed Linux as the only OS on your hard drive, it tends to default to only 16 heads.
How to find the correct number of sectors?
Usually the number of sectors per head is 63, but on some USB devices, the value 32 can be found.
Back to Running the TestDisk Program