All pastes #904538 Raw Edit

Anonymous

public text v1 · immutable
·published 2008-02-15 00:44 UTC
rendered paste body
The T40 is not shipped with a recovery CD, but instead contains an hidden area on the hard drive, that contains all needed data and programs to restore your laptop to its factory settings (with formatted disk, and installed Windows XP). This hidden area is often refered as HPA for Hidden Protected Area, and is described in this document. It consists of reserved space at the end of the disk, unpartitionned. This area can be seen under linux, it depends on the value of the "Access IBM Predesktop Area" entry in the "Security/IBM Predesktop Area" section of the BIOS. If the value is set to "Disabled", the number of cylinders reported by fdisks reflects the real limit of the disk capacity, if another value is set ("Normal" or "Secure"), the number of cylinders is lowered to hide this protected area.

I disabled the Access Predesktop Area Security in the BIOS, so I could backup the HPA. With my 80GB drive, the HPA starts at cylinder 9933, and a cylinder contains 7741440 bytes, as reported by fdisk, so I backuped the data with this command :


dd if=/dev/hda of=hidden.img bs=7741440 skip=9932

With an hexadecimal editor (like hexedit for example), I looked for the beginning of a valid partition, identified by the string "IBM 7.0" or "IBM 7.1". I found several consecutive partitions, that I extracted into six distinct files :


dd if=hidden.img of=diags.img    bs=512 skip=26850 count=15063
dd if=hidden.img of=diags2.img   bs=512 skip=41913 count=15060
dd if=hidden.img of=recovery.img bs=512 skip=56973 count=5847040
dd if=hidden.img of=unknown.img  bs=512 skip=5904013 count=15060
dd if=hidden.img of=unknown2.img bs=512 skip=5919073 count=2883
dd if=hidden.img of=unknown3.img bs=512 skip=5921956 count=2883

My algorithm to find the partition limits is rather simple. Starting from the beginning of the hidden.img area, I mount the file using a loop device, I obtain the partition size in 1k blocks with df, and I search the beginning of a new partition around the corresponding offset, in the image file. I iterate this algorithm with the new discovered partition, until the end of the hidden.img area is reached.