[comp.virus] Hard Disks

padgett%tccslr.dnet@uvs1.orl.mmc.com (Padgett Peterson) (02/07/91)

rfink@eng.umd.edu (Russell A. Fink) writes
>On two IBM PC's, one, a PS/2 Model 50; the other, an AT (circa '86), I
>notice that 'chkdsk' on the hard drives result in there being an
>identical number (and memory cost) of 'bad sectors' reported for both
>machines.

	This is not surprising if the disks are similar and would
depend on the disk configuration and "bad tracks". Very simply, it is
not unusual a hard disk to have a few "bad tracks" reported. This
usually appears on a sheet supplied with the drive and on a label
attached to the drive. At one time, most drives I saw had zero while
today 2-4 is not unusual. If a 40 Mb drive had over 5 I would become
concerned though I once saw a 33 Mb EDSI drive with over 100
(really!).

	Normally, the label will report "bad" tracks by cyl and head
e.g. cyl 307 hd 5 and this should be entered into the "defects list"
when a low-level format is done such as by DISKMANAGER.

	Now on an MFM drive, there are typically 17 sectors per
cyl/head so when a "track" is marked bad, this represents 17 x 512
bytes or 8704 bytes.  However, when the disk is formatted, DOS
allocates in "clusters" made up of 2, 4, 8, or 16 sectors. Since if
any part of a cluster touches the bad track, DOS marks it "bad" in the
FAT so the real loss depends on the cluster size (Norton's DiskInfo or
any of a number of utilities can give you this information) so for
each bad track, DOS reports "bad sectors" as follows:

Cluster Size     Sectors Lost "Bad"     DOS Lost Bytes/"Bad" Track
     2                 18                    9,216
     4                 20                   10,240
     8                 24                   12,288
    16                 32                   16,384

Thus for 4 sectors / cluster, each "track" marked bad will have CHKDSK
report a loss of 10,240 bytes, if four heads are reported on the "bad
track" list, CHKDSK will report a loss of 40,960 bytes. This would not
be unusual and could be verified by examination of the disk or use of
a non-destructive disk analysis utility such as Steve Gibson's
SPINRITE. What would be unusual would be the loss of a different
sector quanta such as 2 - 4 sector clusters or 4096 bytes.

Note: If you use DEBUG to look at the boot sector (-L 100 2 0 1), the
      cluster size may be found at offset 0Dh (debug command -e10d). If you
      see a 10, remember this is hex (16).
						Padgett

            ps: my partition table replacement is now in beta.

KKEYTE%ESOC.BITNET@VM1.gatech.edu (Karl Keyte) (02/11/91)

..but it's _highly_ unlikely that two PCs with the same type of disk
have both the same number of bad sectors and IN THE SAME PLACE.  In
fact, it's so unlikely that it's very suspicious.  That's not to say
that it's unlikely that there's a similar disk somewhere with exactly
the same bad sectors, but just two side-by-side PCs... no way!