The translation algorithm, which operates between the two interfaces, has to reside as some form of software in the PC. There are a number of options for this. All
modern BIOSes will already have the translation algorithm software built into their INT 13h functions and will automatically be capable of what is sometimes known as Extended CHS(ECHS)Translationor just simplyLarge Mode. Such BIOSes are often referred to asenhanced47ortranslating BIOSes and the translation algorithm as the ECHS translation method. If a user has an earlier BIOS, however, which does not incorporate such translation facilities, there are three possibilities for using disks larger than 528 Mbyte.
The first involves using special software drivers that do the translation for us. They are sometimes referred to asDynamic Drive OverlaysorDDOs. They are typified by EZ-Drive from Microhouse (Western Digital, 1999), and Disk Manager from Ontrack (IBM, 1999), and many hard disk manufacturers provide software of this nature with their disk products in order to deal with the non-translating BIOS problem. Both work in similar ways. During the first setting up of the disk, the DDO is placed by the initialization software in some spare disk space just after the partition table and at boot time it gets loaded into memory as the CHS translating software. We will look at this process in more detail later. Suffice to say, at this stage, that, having been loaded into memory, the CHS translating software of the DDO first adjusts the INT 13h vector in memory to point to where it, the DDO, now resides, so that all INT 13h calls thereafter are automatically handled by the translation routines.
In passing we should note the earlier comment that, without translation, the maximum number of cylinders accessible by the INT 13h BIOS is 1024. This has an important effect when we have a non-translating BIOS and are using a DDO. Prior to the DDO being activated, all INT 13h BIOS calls are subject to the non-translating BIOS limitations. In particular, this means that a boot sector, if it has to be accessed before the DDO is established48, cannot normally reside on the disk beyond what is called the1024 cylinder limit.
A further important point is that DDOs are usually loaded through execution of the hard disk boot sequence. When booting from floppy disk to DOS, with a non- translating BIOS, the hard disk may not be accessible at all because the DDO has not been loaded. Most DDOs provide a workaround process for this problem, which may involve either pressing a particular key during the boot sequence or preparing a floppy disk with the DDO installed on it. This is vitally important to note from a forensic imaging viewpoint when rehosting a suspect drive that has been installed with a DDO. It is essential that the DDO is loaded from floppy disk into the forensic host machine before attempting to access the suspect drive.
The second approach to the problem is to use a disk drive unit which has its own version of the INT 13h translating BIOS routines built into its onboard ROM. During the boot process,the INT 13h vector is adjusted to point to the translating BIOS of the hard disk ROM rather than to the standard internal INT 13h BIOS routines. The 1024
47 Do not confuse this with theBIOS Enhanced Disk Drive Specification(Phoenix, 1995), which introduces entirely new INT 13h functions.
48 This depends upon the stage at which the DDO is loaded and the INT 13h vector gets changed. If this occurs during the analysis of the partition table, then boot sectors beyond the 1024 cylinder limit will be accessible. If it occurs during the sector boot sequence, they will not.
cylinder boot limit always applies here because the INT 13h vector does not get changed until after the boot sector has been accessed, but the floppy boot to DOS problem should not arise in this case as it does for the DDO. The third approach to the problem, long since outdated since all modern BIOSes now contain the updates, was to change the system BIOS. This could have been done either by obtaining an updated chip and replacing the current BIOS with it or, with the later flash BIOS systems, downloading a modification patch from the supplier and changing the flash memory.
If we refer back to Table 5.11, we may note that the total number of bits required by the ATA specification is 16 for cylinders + 4 for heads + 8 for sectors/track, giving a total of 28. In the low-level formatting discussion, we saw that three bytes (Fig. 5.4) were used for the CHS of the sector ID field, which only gives us 24 bits. However, we also saw (Fig. 5.7) that 4 bits of the sector flag in the sector ID field were “reserved”, and by using these as well we can obtain the 28 bits required for P-CHS addressing. An approach used by one manufacturer (Seagate, 1995a) is shown at Fig. 5.18. Here the first two byes are used to hold the cylinders number (0 to 65,535), the last three bits of the third byte to hold the heads number (0 to 7) and the fourth byte to hold the sectors number (1 to 255).