Win10 Fall 2017 upgraded from Win7 Pro
This is the second attempt to collect a bit more information on this same system.
https://forums.fogproject.org/topic/11070/disk-drive-geometry-and-partition-layouts-for-well-know-os/9
The issue I was running into is that the computer was running RAID on intel’s “fake raid” (i.e. hardware assisted software raid). When I collected the data the first time I did not take into account I needed to have the RAID kernel drivers enabled using the kernel parameter mdraid=true as outlined in this tutorial: https://forums.fogproject.org/topic/7882/capture-deploy-to-target-computers-using-intel-rapid-storage-onboard-raid So that explains why I had a hard time understanding the disk structure as it was being presented to FOS. I also discovered (for some unknown reason) when I setup this computer I set the data drive up as raid 0 (striping) and not raid 1 (mirroring) like I thought. Hmmmmm…
So the following info is being generated with the mdraid kernel parameter enabled.
gdisk -l /dev/sda
GPT fdisk (gdisk) version 1.0.0
Partition table scan:
MBR: MBR only
BSD: not present
APM: not present
GPT: not present
***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format
in memory.
***************************************************************
Warning! Secondary partition table overlaps the last partition by
468849521 blocks!
You will need to delete this partition or resize it in another utility.
Disk /dev/sda: 468862128 sectors, 223.6 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 824735B4-8872-4BDB-A1EB-AD2E1DC47DBF
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 468862094
Partitions will be aligned on 2048-sector boundaries
Total free space is 2014 sectors (1007.0 KiB)
Number Start (sector) End (sector) Size Code Name
1 2048 206847 100.0 MiB 0700 Microsoft basic data
2 206848 936790015 446.6 GiB 0700 Microsoft basic data
3 936790016 937711615 450.0 MiB 2700 Windows RE
gdisk -l /dev/md124 (the logical array)
GPT fdisk (gdisk) version 1.0.0
Partition table scan:
MBR: MBR only
BSD: not present
APM: not present
GPT: not present
***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format
in memory.
***************************************************************
Disk /dev/md124: 937713664 sectors, 447.1 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): DD15BBA2-DB04-4CDE-9C39-604AA3A9015F
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 937713630
Partitions will be aligned on 2048-sector boundaries
Total free space is 4029 sectors (2.0 MiB)
Number Start (sector) End (sector) Size Code Name
1 2048 206847 100.0 MiB 0700 Microsoft basic data
2 206848 936790015 446.6 GiB 0700 Microsoft basic data
3 936790016 937711615 450.0 MiB 2700 Windows RE
gdisk -l /dev/sdc
GPT fdisk (gdisk) version 1.0.0
Partition table scan:
MBR: MBR only
BSD: not present
APM: not present
GPT: not present
***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format
in memory.
***************************************************************
Warning! Secondary partition table overlaps the last partition by
976758769 blocks!
You will need to delete this partition or resize it in another utility.
Disk /dev/sdc: 976773168 sectors, 465.8 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 77A3546C-A31D-4134-9E04-681DB01678E1
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 976773134
Partitions will be aligned on 2048-sector boundaries
Total free space is 2014 sectors (1007.0 KiB)
Number Start (sector) End (sector) Size Code Name
1 2048 1953531903 931.5 GiB 0700 Microsoft basic data
gdisk -l /dev/md125 (the logical array)
GPT fdisk (gdisk) version 1.0.0
Partition table scan:
MBR: MBR only
BSD: not present
APM: not present
GPT: not present
***************************************************************
Found invalid GPT and valid MBR; converting MBR to GPT format
in memory.
***************************************************************
Disk /dev/md125: 1953536000 sectors, 931.5 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): 600AE6A8-463C-4363-BC6A-0B1ED148F3A4
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 1953535966
Partitions will be aligned on 2048-sector boundaries
Total free space is 6077 sectors (3.0 MiB)
Number Start (sector) End (sector) Size Code Name
1 2048 1953531903 931.5 GiB 0700 Microsoft basic data
lsblk
NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 223.6G 0 disk
`-md124 9:124 0 447.1G 0 raid0
|-md124p1 259:0 0 100M 0 md
|-md124p2 259:1 0 446.6G 0 md
`-md124p3 259:2 0 450M 0 md
sdb 8:16 0 223.6G 0 disk
`-md124 9:124 0 447.1G 0 raid0
|-md124p1 259:0 0 100M 0 md
|-md124p2 259:1 0 446.6G 0 md
`-md124p3 259:2 0 450M 0 md
sdc 8:32 0 465.8G 0 disk
`-md125 9:125 0 931.5G 0 raid0
sdd 8:48 0 465.8G 0 disk
`-md125 9:125 0 931.5G 0 raid0
sde 8:64 1 29.1G 0 disk
`-sde1 8:65 1 121M 0 part
blkid
/dev/ram0: UUID="3db56938-95cb-4bd6-a325-4ba458198604" TYPE="ext2"
/dev/sda: TYPE="isw_raid_member"
/dev/sdb: TYPE="isw_raid_member"
/dev/sdc: TYPE="isw_raid_member"
/dev/sdd: TYPE="isw_raid_member"
/dev/sde1: SEC_TYPE="msdos" LABEL="GRUB" UUID="367A-397D" TYPE="vfat" PARTUUID="dbbe8098-01"
/dev/md125: PTUUID="5816dc85" PTTYPE="dos"
/dev/md124: PTUUID="c657bdb6" PTTYPE="dos"
/dev/md124p1: LABEL="System Reserved" UUID="C6E4AA25E4AA1827" TYPE="ntfs" PARTUUID="c657bdb6-01"
/dev/md124p2: UUID="D02AAB7A2AAB5BEA" TYPE="ntfs" PARTUUID="c657bdb6-02"
/dev/md124p3: UUID="926ACC2A6ACC0D43" TYPE="ntfs" PARTUUID="c657bdb6-03"
Here is some additional information the developers asked me to collect.
mount.ntfs-3g /dev/md124p1 /mnt
`ls -la /mnt’
rwxrwxrwx 1 root root 4096 Oct 1 21:49 .
drwxr-xr-x 18 root root 1024 Nov 9 12:28 ..
-rwxrwxrwx 1 root root 1 Jul 16 2016 BOOTNXT
-rwxrwxrwx 1 root root 8192 Sep 27 14:52 BOOTSECT.BAK
drwxrwxrwx 1 root root 8192 Oct 1 21:49 Boot
drwxrwxrwx 1 root root 0 Feb 22 2014 'Program Files'
drwxrwxrwx 1 root root 0 Feb 22 2014 ProgramData
drwxrwxrwx 1 root root 0 Jul 18 2016 Recovery
drwxrwxrwx 1 root root 4096 Jul 17 2016 'System Volume Information'
-rwxrwxrwx 1 root root 389328 Sep 7 09:23 bootmgr
ls -la /mnt/Boot
drwxrwxrwx 1 root root 8192 Oct 1 21:49 .
drwxrwxrwx 1 root root 4096 Oct 1 21:49 ..
-rwxrwxrwx 1 root root 45056 Nov 12 2017 BCD
-rwxrwxrwx 1 root root 51200 Jul 18 2016 BCD.LOG
-rwxrwxrwx 2 root root 0 Feb 22 2014 BCD.LOG1
-rwxrwxrwx 2 root root 0 Feb 22 2014 BCD.LOG2
-rwxrwxrwx 1 root root 65536 Sep 27 14:52 BOOTSTAT.DAT
drwxrwxrwx 1 root root 4096 Sep 27 14:52 Fonts
drwxrwxrwx 1 root root 0 Sep 27 14:52 Resources
drwxrwxrwx 1 root root 0 Oct 1 21:50 bg-BG
-rwxrwxrwx 1 root root 101728 Jul 16 2016 bootvhd.dll
drwxrwxrwx 1 root root 0 Oct 1 21:50 cs-CZ
drwxrwxrwx 1 root root 0 Oct 1 21:50 da-DK
drwxrwxrwx 1 root root 0 Oct 1 21:50 de-DE
drwxrwxrwx 1 root root 0 Oct 1 21:50 el-GR
drwxrwxrwx 1 root root 0 Oct 1 21:50 en-GB
drwxrwxrwx 1 root root 0 Oct 1 21:50 en-US
drwxrwxrwx 1 root root 4096 Oct 1 21:50 es-ES
drwxrwxrwx 1 root root 0 Oct 1 21:50 es-MX
drwxrwxrwx 1 root root 0 Oct 1 21:50 et-EE
drwxrwxrwx 1 root root 0 Oct 1 21:50 fi-FI
drwxrwxrwx 1 root root 0 Oct 1 21:50 fr-CA
drwxrwxrwx 1 root root 0 Oct 1 21:50 fr-FR
drwxrwxrwx 1 root root 0 Oct 1 21:50 hr-HR
drwxrwxrwx 1 root root 0 Oct 1 21:50 hu-HU
drwxrwxrwx 1 root root 0 Oct 1 21:50 it-IT
drwxrwxrwx 1 root root 0 Oct 1 21:50 ja-JP
drwxrwxrwx 1 root root 0 Oct 1 21:50 ko-KR
drwxrwxrwx 1 root root 0 Oct 1 21:50 lt-LT
drwxrwxrwx 1 root root 0 Oct 1 21:50 lv-LV
-rwxrwxrwx 1 root root 806752 Sep 7 06:29 memtest.exe
drwxrwxrwx 1 root root 0 Oct 1 21:50 nb-NO
drwxrwxrwx 1 root root 0 Oct 1 21:50 nl-NL
drwxrwxrwx 1 root root 0 Oct 1 21:50 pl-PL
drwxrwxrwx 1 root root 0 Oct 1 21:50 pt-BR
drwxrwxrwx 1 root root 0 Oct 1 21:50 pt-PT
drwxrwxrwx 1 root root 0 Oct 1 21:50 qps-ploc
drwxrwxrwx 1 root root 0 Oct 1 21:50 ro-RO
drwxrwxrwx 1 root root 0 Oct 1 21:50 ru-RU
drwxrwxrwx 1 root root 0 Oct 1 21:50 sk-SK
drwxrwxrwx 1 root root 0 Oct 1 21:50 sl-SI
drwxrwxrwx 1 root root 0 Oct 1 21:50 sr-Latn-CS
drwxrwxrwx 1 root root 0 Oct 1 21:50 sr-Latn-RS
drwxrwxrwx 1 root root 0 Oct 1 21:50 sv-SE
drwxrwxrwx 1 root root 0 Oct 1 21:50 tr-TR
drwxrwxrwx 1 root root 0 Oct 1 21:50 uk-UA
drwxrwxrwx 1 root root 0 Oct 1 21:50 zh-CN
drwxrwxrwx 1 root root 0 Oct 1 21:50 zh-HK
drwxrwxrwx 1 root root 0 Oct 1 21:50 zh-TW
ls -la /mnt/Recovery
drwxrwxrwx 1 root root 0 Jul 18 2016 .
drwxrwxrwx 1 root root 4096 Oct 1 21:49 ..
drwxrwxrwx 1 root root 0 Jul 18 2016 Logs
mount.ntfs-3g /dev/md124p3 /mnt
ls -la /mnt
drwxrwxrwx 1 root root 4096 Sep 27 19:10 .
drwxr-xr-x 18 root root 1024 Nov 9 12:28 ..
drwxrwxrwx 1 root root 0 Sep 27 19:10 Recovery
drwxrwxrwx 1 root root 0 Jul 18 2016 'System Volume Information'
ls -la /mnt/Recovery/WindowsRE/
drwxrwxrwx 1 root root 0 Sep 27 15:31 .
drwxrwxrwx 1 root root 0 Sep 27 19:10 ..
-rwxrwxrwx 1 root root 1061 Sep 27 15:31 ReAgent.xml
-rwxrwxrwx 1 root root 340406344 Sep 27 19:10 Winre.wim
-rwxrwxrwx 1 root root 3170304 Jul 16 2016 boot.sdi
Here is what the disk geometry looks like from within windows
<insert picture here>