# Menu Geometry

### From CGSecurity

#### Disk Geometry

    TestDisk 6.2-WIP, Data Recovery Utility, November 2005
    Christophe GRENIER <grenier@cgsecurity.org>
    http://www.cgsecurity.org

    Disk /dev/sda - 120 GB / 111 GiB - CHS 14593 255 63, sector size=512

    Because these numbers change the way that TestDisk looks for partitions
    and calculates their sizes, it's important to have the correct disk geometry.
    PC partitionning programs often make partitions end on cylinder boundaries.

    A partition's CHS values are based on disk translations which make them
    different than its physical geometry. The most common CHS head values
    are: 255, 240 and sometimes 16.

    [ Cylinders ]  [   Heads   ]  [  Sectors  ]  [Sector Size]  [    Ok     ]

                              Done with changing geometry

Change hard disk geometry parameters (Cylinders, Heads, Sectors).

PC partitionning programs often (always) make partitions end on cylinder boundaries. CHS numbers change the way that TestDisk looks for partitions and calculates their sizes, etc. It does not affect the hard drive itself, unless you actually write data about lost partitions to the drive. Choosing the wrong geometry settings and then saving any lost partitions based on those faulty settings might make it harder or impossible to recover your data.

### Some information background

To access data, modern operating systems use logical block adressing. HD sectors are numbered 0,1, 2 up to N-1 where N is the total number of sectors.

But before IDE disks larger than 8GB and SCSI disks existed, another method was used. To access data, the BIOS and the operating system (Dos/Win9x) used CHS adressing. CHS values are limited to 1023 cylinders, 255 heads and 63 sectors (8GB). A common trick introduced with HD bigger than 504 MB (1023 cylinders, 16 heads, 63 sectors) was to use a geometry (Cylinder/Heads/Sector) different from the physical geometry (Extended CHS or large mode adressing).

A method used by BIOS is to read the partition table and to guess the number of heads. When the partition table is cleared or corrupted, the physical disk geometry may be used instead. It becomes harder for partition recovery utilities to find lost partitions on the hard disk.

This problem is not limited to DOS users. Linux users can also affected. Under Linux, run dmesg and search for Partition check. In the following exemple, the geometry of harddisk hdc is determined by the partition table (PTBL).

    Partition check:
     hda: hda1 hda2 hda3 hda4 < hda5 hda6 hda7 hda8 hda9 hda10 hda11 hda12 hda13 >
     hda3: <bsd: hda14 hda15 hda16 hda17 >
     hdc: [PTBL] [7476/255/63] hdc1 < hdc5 hdc6 hdc7 hdc8 hdc9 hdc10 hdc11 hdc12 hdc13 >

### How to find the correct number of heads?

If the HD geometry mismatches the geometry used when creating the partition table, warning messages such as: `Bad sector count`, `Bad relative sector` or `Bad ending head` are displayed when Analyse is selected from the main menu. If you see such errors, you may need to use the `Geometry` menu to change the logical number of heads. Try 255, 16, 32, 64, 128 and 240 heads until TestDisk finds all your partitions. 255 and 240 are the most common head values. If you installed Linux as the only OS on your hard drive, it tends to default to only 16 heads.

#### How does TestDisk get the disk geometry?

- Under DOS, TestDisk gets the disk sizes using an extended BIOS function (ah=0x48, int 0x13), and geometry (number of heads and sectors) using a standard BIOS function (ah=0x08, int 0x13). TestDisk uses the default sector size of 512 bytes.

- Under Windows, TestDisk gets the numbers of cylinders, heads and sectors, and the sector size using the DeviceIoControl call, IOCTL_DISK_GET_DRIVE_GEOMETRY.

- Under Linux, TestDisk gets the sector size using BLKSSZGET ioctl, and the geometry using HDIO_GETGEO_BIG or HDIO_GETGEO ioctl; the disk sizes are from BLKGETSIZE64 or BLKGETSIZE.

- Under BSD, TestDisk gets all information using DIOCGDINFO. If that fails, TestDisk assumes the sector size is 512 bytes, and it uses DIOCGFWSECTORS, DIOCGFWHEADS and DIOCGMEDIASIZE to get all the other paramaters.

- Under Sun Solaris, TestDisk uses the default sector size of 512 bytes, and gets the numbers of cylinders, heads and sectors using the DKIOCGGEOM ioctl.

Back to Running the TestDisk Program

Categories: Data Recovery

##### Data Recovery

- TestDisk
- PhotoRec
- Download