You might reasonably assume that there is only one agreed way of translating L-CHS to P-CHS and only one agreed way for converting CHS to LBA and LBA to CHS. Unfortunately, this is not the case. There is no standard algorithm and different BIOSes and different operating systems may well use different methods. As you might expect, different methods are likely also to yield different results. There is
therefore a real risk when hosting a hard disk from a suspect machine that uses a non-standard BIOS on a forensic machine for imaging that the translations performed by the forensic machine may not be correct for the disk, with potentially harmful results. This will normally only apply to older disks and older BIOSes; most modern BIOSes tend to use thede facto (nearly) standard method that has been described above, so the problem of incorrect translation when re-hosting should not occur very often.
The second most common translation method is the so-called LBA assisted method, which is rather different from the bit shifting method we discussed earlier. Here the rule is to translate the CHS address at the INT 13h interface to an LBA address and use that LBA address at the IDE/ATA interface, and vice versa. This method is perhaps best understood by looking at Table 5.12. To convert an LBA address to an L-CHS address, the total capacity (cap) of the drive in bytes is first calculated. Depending upon this capacity a particular line item in Table 5.12 is selected and the cylinders, heads and sectors values are calculated according to the appropriate entries. One particular point should be noted from this figure: the heads value and the relevant cylinders divisor for 4032 to 8032.5 Mbyte capacity is 255 rather than 256. This is because of an operating system problem which we will be looking at shortly, and makes this, in point of fact, therevised LBA assisted method.
If we now re-consider the example of Fig. 5.8, we recall that, at the ATA/IDE interface (P-CHS), the maximum number of cylinders is 4095, the maximum number of heads is 16 and the maximum number of sectors is 63, and that this gives a disk capacity of 4095 × 16 × 63 × 512 = 2,113,413,120 bytes. From this we can determine the capacity in megabytes as 2,113,413,120/1024 × 1024 = 2015.5 Mbyte49and look that up in Table 5.12.
The appropriate line entry in the table is the “1008 < cap < 2016 Mbyte” line, so the cylinders become 2,113,413,120/(63 × 64 × 512) = 1023.75.Rounding down, this gives us a maximum number of cylinders of 1023, together with a maximum number of heads of 64 and a maximum number of sectors of 63. The highest available LBA address for this translation is the total number of sectors minus 1 (because LBA addresses start with 0). This is (1023 × 64 × 63) – 1 = 4,124,735. The INT 13h BIOS (L- CHS) translated address for this highest available LBA address of 4,124,735 is therefore: cylinders 1022, heads 63 and sectors 63. This is exactly the same as that obtained using the bit shifting method above for the highest CHS address at the INT 13h BIOS (DOS) interface. Note that this will not always be the case. The two
Capacity Sectors Heads Cylinders
1 < cap < 504 Mbyte 63 16 cap/(63 × 16 × 512) 504 < cap < 1008 Mbyte 63 32 cap/(63 × 32 × 512) 1008 < cap < 2016 Mbyte 63 64 cap/(63 × 64 × 512) 2016 < cap < 4032 Mbyte 63 128 cap/(63 × 128 × 512) 4032 < cap < 8032.5 Mbyte 63 255 cap/(63 × 255 × 512) Table 5.12 LBA assisted method.
translation methods produce the same CHS values in many cases, but not in all. The LBA-assisted methodalwaysuses 63 sectors per track. The bit shifting method uses whatever sectors per track the drive reports from the IDE/ATA interface. If this is not 63, the two algorithms will produce completely different results50. It can therefore be very destructive of data to change translation modes, in SETUP, between ECHS (Large) and LBA on a working drive. The actual sectors accessed could be different between the two modes for the same CHS addresses called by the software.
The 2 Gbyte Problem
Some older translating BIOSes cannot accept a cylinders value at the IDE/ATA interface that is greater than 4095 because they only allocate 12 bits for the number of cylinders in the CMOS RAM. This results in a maximum physical drive geometry of 4095 cylinders, 16 heads and 63 sectors, which is a capacity of 4095 × 16 × 63 × 512 = 2,113,413,120 bytes and is known as the2 Gbyte problem. Three problem scenarios have been noted (Western Digital, 1998a): the BIOS can only see a maximum of 2015.5 Mbyte and truncates the remaining space; the BIOS loses all cylinder bits above 12 and may lose 2016 Mbyte of space or more; the BIOS completely locks up at boot time. A comprehensive solution to this problem is to use a dynamic drive overlay (DDO). However, if the BIOS locks up at boot time, it will be necessary to configure the drive (incorrectly) as 1023 cylinders, 16 heads and 63 sectors in CMOS SETUP. In this way the BIOS does not see the problem and does not lock up. The DDO, when activated, fetches the true CHS parameters from the drive itself and carries out the appropriate translation. One difficulty that may have to be overcome is getting into CMOS SETUP. The option to enter SETUP comes after the BIOS has detected all the hard drives, and as the lockup will occur when the drive is detected, SETUP is not at that stage accessible. The way round this problem is to disconnect the offending drive from its cable, then boot and enter SETUP to put in the artificial safe parameters. When the drive is reconnected, it should then be possible to boot and to establish the DDO.
The 4 Gbyte Problem
Older BIOSes may exhibit another problem with disks that have a cylinders value at the IDE/ATA interface that is greater than 8191. For a drive that has 8192 cylinders, 16 heads and 63 sectors, this results in a capacity of 8192 × 16 × 63 × 512 = 4,227,858,432 bytes = 4032 Mbyte; hence this is known as the4 Gbyte problem. In accordance with the bit shifting method, this requires the cylinders value at the IDE/ATA interface to be divided by 16 in order for the translated cylinders value to be in the INT 13h BIOS interface range. However, this then results in a translated heads value of 16 × 16 = 256 and it is this translated heads value which causes the problem. This is because both MS-DOS up to version 6.22 and Windows 95 holdthe number of headsin an 8 bit register and the maximum number of heads can then only be 255, resulting in the 4
50 As an example, the Western Digital WDAC2420, which is a 425 Mbyte disk, specifies 56 sectors per track. See Western Digital (1997b).
Gbyte limit. Although this is an operating system problem, BIOS manufacturers decided to deal with it by modifications to the translating BIOS (Micro Firmware, 1998). These need to be applied both to the bit shifting or ECHS translation method and to the assisted LBA method.
Therevised ECHS translation methodmakes the following adjustment. If, at the IDE/ATA interface, the number of cylinders is greater than 8191 and the number of heads is 16, then the cylinders value is multiplied by 16/15 and the heads value is set to 15 before the standard bit shifting algorithm is applied.
As an example, the Maxtor CrystalMax 1080, model number 84320A8 (Maxtor, 1996) shows 8,400 cylinders, 16 heads and 63 sectors per track as the geometry at the IDE/ATA interface. This gives us 8,400 × 16 × 63 × 512 = 4,335,206,400 bytes capacity. Using the standard bit shifting or ECHS translation method this results in 8400/16 = 525 cylinders and 16 × 16 = 256 heads, causing the problem that we referred to above. The revised ECHS translation, however, first gives us 8,400 × 16/15 = 8,960 cylinders and 15 heads, and then this in turn is translated to 8,960/16 = 560 cylinders and 15 × 16 = 240 heads. The resulting capacity is the same as before (this is not always the case), that is: 560 × 240 × 63 × 512 = 4,335,206,400 bytes. The largest L-CHS address for this disk at the INT 13h BIOS interface for the revised ECHS translation method is therefore (559, 239, 63).
In the case of the LBA-assisted method, the necessary adjustment has already been built into Table 5.12. We noted in passing at the time that for the 4032 to 8032.5 Mbyte capacity the heads value and the relevant cylinders divisor are both 255 rather than the expected 256. This is, in fact, an implementation of therevised assisted LBA method. We can now calculate the translated CHS addresses using the revised assisted LBA method from Table 5.12 in the following manner. We again note that the total byte capacity is 8,400 × 16 × 63 × 512 = 4,335,206,400 bytes and this, divided by 1024 × 1024, gives us 4134.375 Mbyte. We therefore have to use the “4032 < cap < 8032.5 Mbyte” entry in the table giving us a cylinders value of 4,335,206,400/(63 × 255 × 512) = 527 when rounded down. The heads figure is 255 and the sectors figure is 63, giving us a total capacity of 527 × 255 × 63 × 512 = 4,334,722,560. In addition, the largest L-CHS address for this disk at the INT 13h BIOS interface for this revised assisted LBA translation method is therefore (526, 254, 63). Note that neither the total capacity for the translated disk nor the largest L-CHS address are the same as those obtained using the revised ECHS method. Here we see that the two translations are completely incompatible with one another.