Jump to content

Letter Assignment when dual booting win98 & XP


mntview64

Recommended Posts


Hiding all operating systems from one another may be useful in preventing virus infections from spreading to other operating systems, as I have just recently experienced

Luckily I was able to recreate the whole HDD quickly, so the infection across operating systems was not a major problem. The major pain of the infection was the infected 1TB USB HDD, which probably would have happened even if I my operating systems had been hidden from one another. So I still prefer operating systems which can see each other's partitions.

Yes, it's mainly a matter of personal preference. I personally don't like to have a bunch of partitions that I am not using always displayed/assigned drive letters in the OS I am currently using. However, I agree with the point you made back during the earlier discussion about working on files from one OS from another OS. If this need arises, I just unhide the partition I need to see to do the work, and then hide it again.

Having the partitions hidden from one another during a malware attack should at least prevent damage to the hidden partitions/OS's and eliminate having to restore the entire machine from scratch. It may also give you the ability to use an antivirus program from one of the non-infected partitions/OS's to work on the infected ones.

How easy was it to convert from System Commander to BootIT NG? Do you use BootIT NG on your main system?

No, I currently only use BootIt NG on the Multi-OS computer, because I needed it there to solve the specific logical partition hiding problem. I have retained System Commander for my other machines because of the password protection ability.

Switching to BootIt NG was quite painless on that system, I just booted into the OS where System Commander was installed (1st primary, 1st hdd, Windows 95 in that case) and uninstalled it, (which gave a warning that other OS's besides the current one may be unbootable {of course!}) then checked for any leftover files or registry entries and removed them.

Then I installed BootIt NG (if I remember correctly this was done by shutting down and rebooting from a boot floppy created by the BootIt NG package) to the same partition SC was in, and it simply took over where SC had been previously. Of course I had to re-set-up my Hidden partitions settings for each OS.

Link to comment
Share on other sites

Having the partitions hidden from one another during a malware attack should at least prevent damage to the hidden partitions/OS's and eliminate having to restore the entire machine from scratch. It may also give you the ability to use an antivirus program from one of the non-infected partitions/OS's to work on the infected ones.

I'd like to undermine :ph34r: , at least partially ;), your certainties about "safety" of hidden partitions.

Please read this:

http://homepages.tesco.net/J.deBoynePollard/FGA/determining-filesystem-type.html

and this:

http://www.boot-land.net/forums/index.php?showtopic=10169

In NT based systems a hidden partition is not much different from having a partition with no letter attached. :whistle:

jaclaz

Link to comment
Share on other sites

Having the partitions hidden from one another during a malware attack should at least prevent damage to the hidden partitions/OS's and eliminate having to restore the entire machine from scratch. It may also give you the ability to use an antivirus program from one of the non-infected partitions/OS's to work on the infected ones.

I'd like to undermine :ph34r: , at least partially ;), your certainties about "safety" of hidden partitions.

Please read this:

http://homepages.tesco.net/J.deBoynePollard/FGA/determining-filesystem-type.html

and this:

http://www.boot-land.net/forums/index.php?showtopic=10169

In NT based systems a hidden partition is not much different from having a partition with no letter attached. :whistle:

jaclaz

should + may /= certainties ;)

I have very limited experience when it comes to malware problems, having only gotten a virus once in my lifetime of computing experience even though I do not use Antivirus software. So I normally do not address the subject, I only did so in this case because the discussion was directed toward me.

Thanks for the info though, especially concerning NT.

XP (along with other NT-based Windows) is only a "means to an end" for me on any of my systems. I have it for two reasons only - for playing games that require it or running specific programs that require it, and occasionally for dealing with >4GB files. I would never dream of using it on the internet. When the day comes that my 98SE cannot take me wherever I want to go online, I will use Linux. :yes:

Link to comment
Share on other sites

Thanks for the info though, especially concerning NT.

XP (along with other NT-based Windows) is only a "means to an end" for me on any of my systems. I have it for two reasons only - for playing games that require it or running specific programs that require it, and occasionally for dealing with >4GB files. I would never dream of using it on the internet. When the day comes that my 98SE cannot take me wherever I want to go online, I will use Linux. :yes:

I guess you are missing the point I was trying to make. :unsure:

Hiding a partition by means of changing it's partition ID in the MBR (or EPBR's) is ONLY a convention to prevent "good behaving" apps and OS's to access that partition.

As long as the partition data is there, a program under ANY OS may be able to read that info and consequently "operate" on the hidden partition.

In other words a hidden partition is only hidden to you and to the running OS and to programs that respect this "convention".

I showed you an example for NT, but you can do EXACTLY the same under DOS/9x or Linux or whatever, in other words, if the data is there, it can be read (and used for whatever good or malicious scope):ph34r:.

If you want to make a partition really "hidden" you need to remove the data identifying it, not simply changing it's ID.

Think of it about the difference between having a reserved document in plain view on your desktop with a nice yellow post-it on it "Please don't read or take this" vs. keeping it in your safebox. ;)

jaclaz

Link to comment
Share on other sites

I guess you are missing the point I was trying to make. :unsure:

Hiding a partition by means of changing it's partition ID in the MBR (or EPBR's) is ONLY a convention to prevent "good behaving" apps and OS's to access that partition.

As long as the partition data is there, a program under ANY OS may be able to read that info and consequently "operate" on the hidden partition.

In other words a hidden partition is only hidden to you and to the running OS and to programs that respect this "convention".

I showed you an example for NT, but you can do EXACTLY the same under DOS/9x or Linux or whatever, in other words, if the data is there, it can be read (and used for whatever good or malicious scope):ph34r:.

If you want to make a partition really "hidden" you need to remove the data identifying it, not simply changing it's ID.

Think of it about the difference between having a reserved document in plain view on your desktop with a nice yellow post-it on it "Please don't read or take this" vs. keeping it in your safebox. ;)

jaclaz

Hmmm.. :huh:

Interesting. I had been under the impression that such a program would depend on the OS for access to a partition, and that partition would have to be "recognized" by the OS for this to occur. (i.e. NT and Linux systems see all partitions whether they are assigned a letter/mounted or not)

Definitely something to think about. Thanks again. :thumbup

Link to comment
Share on other sites

Speaking of Anti-Viruses, I am using the old Norton 2000 anti-virus program on my win98. On my other computer that has XP, I am using AVG-9. When I install XP on my main computer with win98, to duel boot, I want to use AVG-9 or the latest version. I know AVG-9 won't install on win98, but will it still give virus protection for win98 OS? Do I uninstall my old Nortons from win98?

Link to comment
Share on other sites

Do I uninstall my old Nortons from win98?

In my personal opinion you should UNinstall ALL Norton Antivirus versions, old and new, from ANY system around.

There are a few thread about software that still work on 98, here:

http://www.msfn.org/board/index.php?showtopic=105936

http://www.msfn.org/board/index.php?showtopic=105936&st=390

http://www.msfn.org/board/index.php?showtopic=137928

there may be others.

jaclaz

Link to comment
Share on other sites

XP ...I would never dream of using it on the internet. When the day comes that my 98SE cannot take me wherever I want to go online, I will use Linux. :yes:

This is exactly my view too. On rare exceptions I do use the internet under WinXP, like for downloading with eMule a file >4GB.

My young son, however, only wants to use WinXP :w00t:

he needs wireless access to the shared printer on the home network, so the home network is mixed Win98/WinXP :w00t: ,

he wants to access the Internet with his Nintendo DS, which works only with WEP :w00t: , so I am not using WPA.

he needs to connect his Asus school-netbook to the home network, so the network has to be set for file sharing :w00t:

his Asus netbook has locked up with virus infections already twice :w00t:

his friends come over and hook up their infected notebooks to the router :w00t:

Life consists of compromises, it's hard to avoid WinXP and other risks in life.

As long as the partition data is there, a program under ANY OS may be able to read that info and consequently "operate" on the hidden partition.
I am quite sure that eventually malware which infects hidden partitions will become common, given the increased use of hidden partitions. Does such malware exist already?
Link to comment
Share on other sites

In my personal opinion you should UNinstall ALL Norton Antivirus versions, old and new, from ANY system around.
Definitely, nothing is gained by keeping Norton Antivirus. But Symantec stuff in general is hard to get rid of, the uninstall usually leaves a lot of trash.

Make sure to uninstall Norton Antivirus before installing another anti-virus package, having 2 different anti-virus programs on the system is asking for trouble.

Link to comment
Share on other sites

  • 3 weeks later...

Sorry for the delayed reply ... time is lacking.

Anyway, if you assigned the unused 105G as a primary

NTFS partition, this would be the end result (assuming

as I stated, that NT* follows the same enumeration

rules as MS-DOS) :

Drive 0 (250G) =

C: Primary/Active FAT32 35G (Both O/S)

D-F: Extended/Logical FAT32 33, 30, 30G (Both O/S)

K: Primary NTFS 105G (Normally, NT* only)

Drive 1 (40G) =

G-J: Extended/Logical FAT32 10, 10, 9, 9G (Both O/S)

You will notice how the K: partition is enumerated last,

so that even for O/S (that is, MS-DOS and W98) that can't

see this partition (being NTFS), all other partitions get

assigned the same drive letter. Beware that F: is partly

beyond the 128/137G limit for LBA32, so you need to ensure

LBA48 solutions are in place lest you corrupt C: due to

LBA wrap-around! Same applies for K: which is entirely

above this limit.

Now, as for the W9* IO.SYS patch, this is for a separate

problem. If you have a mixture of CHS and LBA partitions,

MS-DOS 7.XX (W9X) and 8.00 (WME) will sometimes use CHS

addressing for partitions beyond 7.8G, which must use LBA

addressing, since otherwise CHS wrap-around will occur. In

your case, all partitions will have been LBA types, which

should mean you are safe from this bug. However, if you

were to choose slightly smaller partitions on your second

hard drive, you might still be vulnerable to this bug.

As for the various service packs and updates from MGDx and

other sites, beware some of these will restore the standard

(ie. buggy) version of 'IO.SYS', so (if you had a mix of

CHS and LBA partitions types) you would need to restore the

patched version PRIOR to rebooting.

Joe.

I have 2 hard drives in my computer and 2 DVD's. Both hard drives are EIDE/PATA. Right now I am running win98se and I want to install XP pro sp3 so it will dual boot both OS. Drive 0 is 250gb and Drive 1 is 40gb. Drive 0 has 5 partition volumes. C drive is primary/active with win98se installed on it. My other volumes have other programs installed into them except G drive, which I left empty. All volumes are FAT32 on both hard drives. So I have:

(Drive 0) ---------------------------------------------- (Drive 1) is extended partition with 4 volumes.

C:\ primary/Active win98se 35gb ------------- H:\ programs installed 10gb

D:\ programs installed 33gb -------------------- I:\ programs installed 10gb

E:\ programs installed 30gb -------------------- J:\ programs installed 9gb

F:\ programs installed 30gb -------------------- K:\ programs installed 9gb

G:\ empty 105gb

The order in which MS-DOS (*) enumerates partitions is :

a) First primary partition of each drive, in turn

B) All extended partitions of each drive, in turn

c) All remaining primary partitions of each drive, in turn

Drives that are not recognized are not enumerated.

* At least as far back as version 7.0, perhaps even 6.22

(earlier than that, only one primary partition was supported).

Assuming NT uses the same rules, what you should do is make

that 105G partition a primary partition. Then it will get

enumerated last for NT, & ignored for DOS/W9X. So all other

partition drive letters will match between the two O/S.

BTW, if you get phantom drive enumeration or other LBA problems

in W9X, you might want to try my revised patch for V7.10 'IO.SYS'

(based on original patch by Steven Saunderson), available at :

http://jds.com-t.com/general.html

Joe.

Thank you JDS (Joe) This sounds interesting to me, but am still a little confused here. If I make my G volume into a primary partition, then install NTFS on it, win98 won't see it, so then win98 will change the drive letters on my second hard drive, because there won't be a G volume on my first hard drive. Then what happens when I boot into XP, where it can see all volumes, to the letter assignment? Do you know if XP has to be installed on a primary partition? I have read XP will run from a logical drive as long as it can install it's drivers in the first primary partition of the hard drive.

Another question, what is this V7.10 - IO.sys patch for? I downloaded all the win98 updates from MDGx web site and installed them in order to get my 250gb hard drive to run win98se, and so far everything is working great.

Link to comment
Share on other sites

Sorry for the delayed reply ... time is lacking.

Anyway, if you assigned the unused 105G as a primary

NTFS partition, this would be the end result (assuming

as I stated, that NT* follows the same enumeration

rules as MS-DOS) :

Drive 0 (250G) =

C: Primary/Active FAT32 35G (Both O/S)

D-F: Extended/Logical FAT32 33, 30, 30G (Both O/S)

K: Primary NTFS 105G (Normally, NT* only)

Drive 1 (40G) =

G-J: Extended/Logical FAT32 10, 10, 9, 9G (Both O/S)

You will notice how the K: partition is enumerated last,

so that even for O/S (that is, MS-DOS and W98) that can't

see this partition (being NTFS), all other partitions get

assigned the same drive letter. Beware that F: is partly

beyond the 128/137G limit for LBA32, so you need to ensure

LBA48 solutions are in place lest you corrupt C: due to

LBA wrap-around! Same applies for K: which is entirely

above this limit.

Now, as for the W9* IO.SYS patch, this is for a separate

problem. If you have a mixture of CHS and LBA partitions,

MS-DOS 7.XX (W9X) and 8.00 (WME) will sometimes use CHS

addressing for partitions beyond 7.8G, which must use LBA

addressing, since otherwise CHS wrap-around will occur. In

your case, all partitions will have been LBA types, which

should mean you are safe from this bug. However, if you

were to choose slightly smaller partitions on your second

hard drive, you might still be vulnerable to this bug.

As for the various service packs and updates from MGDx and

other sites, beware some of these will restore the standard

(ie. buggy) version of 'IO.SYS', so (if you had a mix of

CHS and LBA partitions types) you would need to restore the

patched version PRIOR to rebooting.

Joe.

I have 2 hard drives in my computer and 2 DVD's. Both hard drives are EIDE/PATA. Right now I am running win98se and I want to install XP pro sp3 so it will dual boot both OS. Drive 0 is 250gb and Drive 1 is 40gb. Drive 0 has 5 partition volumes. C drive is primary/active with win98se installed on it. My other volumes have other programs installed into them except G drive, which I left empty. All volumes are FAT32 on both hard drives. So I have:

(Drive 0) ---------------------------------------------- (Drive 1) is extended partition with 4 volumes.

C:\ primary/Active win98se 35gb ------------- H:\ programs installed 10gb

D:\ programs installed 33gb -------------------- I:\ programs installed 10gb

E:\ programs installed 30gb -------------------- J:\ programs installed 9gb

F:\ programs installed 30gb -------------------- K:\ programs installed 9gb

G:\ empty 105gb

The order in which MS-DOS (*) enumerates partitions is :

a) First primary partition of each drive, in turn

B) All extended partitions of each drive, in turn

c) All remaining primary partitions of each drive, in turn

Drives that are not recognized are not enumerated.

* At least as far back as version 7.0, perhaps even 6.22

(earlier than that, only one primary partition was supported).

Assuming NT uses the same rules, what you should do is make

that 105G partition a primary partition. Then it will get

enumerated last for NT, & ignored for DOS/W9X. So all other

partition drive letters will match between the two O/S.

BTW, if you get phantom drive enumeration or other LBA problems

in W9X, you might want to try my revised patch for V7.10 'IO.SYS'

(based on original patch by Steven Saunderson), available at :

http://jds.com-t.com/general.html

Joe.

Thank you JDS (Joe) This sounds interesting to me, but am still a little confused here. If I make my G volume into a primary partition, then install NTFS on it, win98 won't see it, so then win98 will change the drive letters on my second hard drive, because there won't be a G volume on my first hard drive. Then what happens when I boot into XP, where it can see all volumes, to the letter assignment? Do you know if XP has to be installed on a primary partition? I have read XP will run from a logical drive as long as it can install it's drivers in the first primary partition of the hard drive.

Another question, what is this V7.10 - IO.sys patch for? I downloaded all the win98 updates from MDGx web site and installed them in order to get my 250gb hard drive to run win98se, and so far everything is working great.

This confused me even more. I believe what you said eariler made more sense to me, when you said to repartition my empty G drive into 2 partitions, so hard drive 0 will keep the drive letter G in place and it won't change drive 1 letter asignment. After doing this partition change on drive 0 it would make it C - D - E- F - G - H. and drive 1 would be I - J - k - L. Then install XP and NTFS onto G drive, which would hide it from w98 on Drive 0 making w98 just see it as C-D-E-F-G and in turn change drive 1 drive back to H - I - J - K. I don't understand why making the NTFS partition a primary partition matters, or am I missing something here.

Link to comment
Share on other sites

  • 2 weeks later...

Sorry for the delayed reply ... time is lacking.

Anyway, if you assigned the unused 105G as a primary

NTFS partition, this would be the end result (assuming

as I stated, that NT* follows the same enumeration

rules as MS-DOS) :

Drive 0 (250G) =

C: Primary/Active FAT32 35G (Both O/S)

D-F: Extended/Logical FAT32 33, 30, 30G (Both O/S)

K: Primary NTFS 105G (Normally, NT* only)

Drive 1 (40G) =

G-J: Extended/Logical FAT32 10, 10, 9, 9G (Both O/S)

You will notice how the K: partition is enumerated last,

so that even for O/S (that is, MS-DOS and W98) that can't

see this partition (being NTFS), all other partitions get

assigned the same drive letter. Beware that F: is partly

beyond the 128/137G limit for LBA32, so you need to ensure

LBA48 solutions are in place lest you corrupt C: due to

LBA wrap-around! Same applies for K: which is entirely

above this limit.

Now, as for the W9* IO.SYS patch, this is for a separate

problem. If you have a mixture of CHS and LBA partitions,

MS-DOS 7.XX (W9X) and 8.00 (WME) will sometimes use CHS

addressing for partitions beyond 7.8G, which must use LBA

addressing, since otherwise CHS wrap-around will occur. In

your case, all partitions will have been LBA types, which

should mean you are safe from this bug. However, if you

were to choose slightly smaller partitions on your second

hard drive, you might still be vulnerable to this bug.

As for the various service packs and updates from MGDx and

other sites, beware some of these will restore the standard

(ie. buggy) version of 'IO.SYS', so (if you had a mix of

CHS and LBA partitions types) you would need to restore the

patched version PRIOR to rebooting.

Joe.

I have 2 hard drives in my computer and 2 DVD's. Both hard drives are EIDE/PATA. Right now I am running win98se and I want to install XP pro sp3 so it will dual boot both OS. Drive 0 is 250gb and Drive 1 is 40gb. Drive 0 has 5 partition volumes. C drive is primary/active with win98se installed on it. My other volumes have other programs installed into them except G drive, which I left empty. All volumes are FAT32 on both hard drives. So I have:

(Drive 0) ---------------------------------------------- (Drive 1) is extended partition with 4 volumes.

C:\ primary/Active win98se 35gb ------------- H:\ programs installed 10gb

D:\ programs installed 33gb -------------------- I:\ programs installed 10gb

E:\ programs installed 30gb -------------------- J:\ programs installed 9gb

F:\ programs installed 30gb -------------------- K:\ programs installed 9gb

G:\ empty 105gb

The order in which MS-DOS (*) enumerates partitions is :

a) First primary partition of each drive, in turn

B) All extended partitions of each drive, in turn

c) All remaining primary partitions of each drive, in turn

Drives that are not recognized are not enumerated.

* At least as far back as version 7.0, perhaps even 6.22

(earlier than that, only one primary partition was supported).

Assuming NT uses the same rules, what you should do is make

that 105G partition a primary partition. Then it will get

enumerated last for NT, & ignored for DOS/W9X. So all other

partition drive letters will match between the two O/S.

BTW, if you get phantom drive enumeration or other LBA problems

in W9X, you might want to try my revised patch for V7.10 'IO.SYS'

(based on original patch by Steven Saunderson), available at :

http://jds.com-t.com/general.html

Joe.

Thank you JDS (Joe) This sounds interesting to me, but am still a little confused here. If I make my G volume into a primary partition, then install NTFS on it, win98 won't see it, so then win98 will change the drive letters on my second hard drive, because there won't be a G volume on my first hard drive. Then what happens when I boot into XP, where it can see all volumes, to the letter assignment? Do you know if XP has to be installed on a primary partition? I have read XP will run from a logical drive as long as it can install it's drivers in the first primary partition of the hard drive.

Another question, what is this V7.10 - IO.sys patch for? I downloaded all the win98 updates from MDGx web site and installed them in order to get my 250gb hard drive to run win98se, and so far everything is working great.

This confused me even more. I believe what you said eariler made more sense to me, when you said to repartition my empty G drive into 2 partitions, so hard drive 0 will keep the drive letter G in place and it won't change drive 1 letter asignment. After doing this partition change on drive 0 it would make it C - D - E- F - G - H. and drive 1 would be I - J - k - L. Then install XP and NTFS onto G drive, which would hide it from w98 on Drive 0 making w98 just see it as C-D-E-F-G and in turn change drive 1 drive back to H - I - J - K. I don't understand why making the NTFS partition a primary partition matters, or am I missing something here.

Sorry again for the delay and sorry too for causing any confusion.

To be honest, your reply here confuses me. Did I ever mention splitting your empty "G" drive into two partitions?

Anyway, I think your confusion might stem from an assumption you may have, that physical drives are enumerated in turn (in sequence). That is not the case. The second thing you need to realize, is that for all the drive letters to match up, all partitions common (visible) to both O/S must be enumerated first, the remainder (eg. your proposed 105G NTFS partition) must be enumerated last.

So the idea is to arrange the partitions in such a way that, following the enumeration rules that I outlined in my first reply, the above enumeration sequence is achieved. For that, you would need to make the proposed 105G NTFS partition as primary, such that it is the SECOND primary partition on physical drive 0.

I hope that explains things well enough. Just slowly go through those enumeration rules and you should end up with the logical drive letter assignments I've outlined. The caveat is that I've assumed the NT* family follows the same rules as the DOS/9* family (someone let me/us know if that's not the case, since I don't have an NT* machine to experiment on).

BTW, in answer to your question on 'IO.SYS', I forgot to mention again the other/lesser bug, whereby phantom drive letters can appear in Windows (not a serious safety issue provided you don't write to those phantom drive letters). I don't remember the exact conditions under which this bug manifests, so I'm not sure if you will encounter it. However, it is also addressed in the patch available on my "general.html" web page.

Joe.

Link to comment
Share on other sites

BTW, if you get phantom drive enumeration or other LBA problems

in W9X, you might want to try my revised patch for V7.10 'IO.SYS'

(based on original patch by Steven Saunderson), available at :

http://jds.com-t.com/general.html

@jds: You say in your read.me:

However, one of Steven's changes were causing me other LBA problems, and since I didn't agree with it, I reversed it.

I've determined that the change you reverted is (quoting Steven Saunderson's original w98bug.txt):

* Offset 2072 was 04 now 00 (erroneous set of LBA flag for next par[tition]).

Would you please elaborate on what problems did that particular change have, and why do you consider it a misfix?

Link to comment
Share on other sites

Thank you all for your help and information. This is what I ended up doing. I purchased a new 250gb PATA hard drive. Then I repartationed the G: volume on drive 0 into 5 partations, making drive(0) C-D-E-F-G-H-I-J-K and my drive (1) L-M-N-O. Then I used xcopy32 to copy from drive(1)L to H, M to I, N to J, and O to K on drive(0). I then removed my old 40gb drive(1) and installed the new 250gb hard drive. I used my XP-cd to partation the new hard drive into 2 partations, the first partation as primary and one logical drive, which made them D: and M: using the NTFS file system. Then installed XP into the D volume on drive(1). Now when I boot into win98 the drive letters are C-D-E-F-G-H-I-J-K on drive(0)just the way it was with 2 hard drives. Win98 doesn't see drive(1). When I boot into XP the drive letters are C-win98 D-XP-ntfs E-F-G-H-I-J-K-L all FAT32 and M-ntfs. I just renamed the volume label names in XP to show what volume it is in win98. Like C is win98 D is XP,E is 98-D, F is 98-E, G is 98-F, and so on. So far everything is working fine.

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...