Detect Windows Boot/Recovery/Reserved/System partitions reliably

[Sebastian Roth]

Here is another thread were I would like to discuss an important topic with all of you. This time we want/need to figure out a way to detect those special Windows partitions more reliably.

[Quazz]

@sebastian-roth @george1421

Is it possible to read the partition flags of NTFS partitions? I’m assuming the System Reserved partition will always get the same flags (which are different from the Windows partition and any generic data partition). In particular, it will have a System flag.

After some googling, the Metafiles of NTFS might be interesting, particularily $Volume .

[Sebastian Roth]

Moved @Quazz’s comment here as I think this is a good starting point for the discussion.

What exactly do you mean by “partition flags”?

Please all make sure we don’t mix up the wording on this topic.

• There are partition IDs, like 0x7 for NTFS, though this doesn’t mean this partition is formated NTFS - it should be but those are two differnt things that don’t always match up.
• Then we have filesystem label which essentially is a string set in the filesystem header. This is currently used for detecting those Windows partitions but it fails as soon as you install Windows in a foraign language.
• And we have filesystem flags. Not sure if those are worth anything?

[Quazz]

@sebastian-roth I mean the flags you can see in Windows disk manager. I’m guessing they’re filesystem flags? (such as Active, Boot, System, etc)

I think particularily the System flag is interesting.

[Sebastian Roth]

What do you guys think of this: https://www.apt-browse.org/browse/ubuntu/xenial/main/i386/os-prober/1.70ubuntu3/file/usr/lib/os-probes/mounted/20microsoft

Just stumbled upon this and thought this could be a nice start for us to improve detecting those special partitions.

[george1421]

@sebastian-roth I’m not to sure about that script (I only looked at it for a moment), but detecting the partitions by existing files may have value. The question would be could use identify unique files on each of the partitions to properly identify the partition? These files would need to be named uniquely global (i.e. not having natural language variants).

[Sebastian Roth]

@george1421 said in Detect Windows Boot/Recovery/Reserved/System partitions reliably:

These files would need to be named uniquely global (i.e. not having natural language variants).

Good point George! Though I am fairly sure this is the case for some files that are used for booting the OS like bootmgr and such files.