Monday, April 4, 2016

How to view what is on unnamed partitions

In a previous post I showed how to tell whether one had a Dell recovery partition on one's PC. This post is on how to view what is in that partition. This is the basis of more serious hacks. The partition is initially unnamed and hidden from view from the lay person for very good reasons so be very careful with the hacks on this page. We are getting into some advanced, dangerous stuff.

To view the contents of a hidden partition with a simple tool such as file explorer, it must be given a name. When you stick a thumb drive into a USB port, Windows immediately assigns a letter to that drive. This allows you to see it in file explorers. Then you can view the contents.

We are going to manually make Windows assign a letter to the recovery partition. This requires the use of the command prompt window and a neat, simple command line utility called DiskPart. For a complete reference, see here. It is a simple and intuitive utility. It can also allow you to fix broken thumb drives, see exactly what is on your hard disk and more.

While DiskPart is easy to use, it is perfectly possible to completely erase an entire drive by mistake by typing two words and hitting Enter. So be very alert. Pretend you are flying a fighter plane, or operating machinery that can chop off your arms in a jiffy... You get the point. Always read the commands you typed. Check and recheck where you are before hitting "Enter". And better yet, have a backup of your data on a spare hard drive not plugged into your computer when playing with DiskPart. And an OS recovery medium on hand. Scared yet? Let's proceed.

First we need to launch the command prompt window in administrator mode so we have full control (again, also full power to wipe out a drive). Go to the search box and type "command". Do not click on Command Prompt, but right-click and in the pull-down menu that appears, select "Run as administrator".


Windows will complain. Click "Yes". Now you have a friendly terminal window. The blinking horizontal cursor is inviting you to type a command.



After each command below, hit enter to execute. In what follows, type what is italicized then hit enter.

First we launch the utility. Type
diskpart
(and hit enter)

You need to wait a few seconds until DiskPart has started and is ready for your commands. You should see: "DISKPART>" with a blinking cursor in front of it. "DISKPART>" is called a "command prompt" (because it prompts you for a command).

Now we are going to list the hard drives installed in your computer. That's harmless. Type
list disk

You will see a list of your hard disks. You may have only one (but should have at least one).


With DiskPart, it is important to make sure one is on the correct disk and correct volume before running anything else than list commands.

Next we need to select the disk where the recovery partition is. If you have only one hard drive, this part is simple but still necessary. If you have more than one disk and you don't now which one to pick, go to Disk Management and look at the size and number of the disk that has the recovery partition (see my previous post).

Type
sel disk=1
if the disk you want to select is disk number 1. Otherwise, you would type "sel disk=0" if the disk with the recovery partition is disk 0. You get the idea.

DiskPart should tell you "Disk 1 is now the selected disk". If doing anything more advanced with DsikPart (such as formatting disks), make sure that it does. Then you can proceed. The next step is to list the partitions on that disk. DiskPart calls them "volumes".

Type
list vol

You now have a table that lists the partitions you can also see in Disk Management. But there is more details and it's more clear. Also, you can use DiskPart to manipulate partitions. We won't, other than assigning a letter.


Look for the volume that has for label "RECOVERY". I already named mine so in the column called "Ltr", it has an R. "Ltr" stands for letter. Yours should not have a letter assigned yet. We are going to give it a letter.

Before we assign a letter to volume 3 (in my case), we must select that volume. If your recovery partition is on a different volume, use the number of that volume instead in the following command.

Type
sel volume=3

DiskPart tells you "Volume 3 is the selected volume". It is nice that DiskPart speaks in clear English (and also understands pretty plain English).

Now we are ready to give it a letter.

Type
assign letter=r

Or any letter you want to use, that is not already in use (should not be C for example, as you probably already have that). R is good because it is so far down the alphabet that Windows is unlikely to use it for a DVD drive, a thumb drive or an external hard drive. Plus, it stands for "recovery".

If you make a booboo on the choice of letter (or change your mind), you can type
remove letter=r. As a matter of fact, once you are done viewing what is in that partition (I wouldn't touch the contents), you should remove the letter. Leave the terminal window opened so you can come back and do that easily (otherwise you will have to repeat all the steps above).

Now open file explorer. You should see a new "drive" called R. It's not really a drive, it's a partition on your hard drive you couldn't see before.

No comments:

Post a Comment