Path: utzoo!utgpu!news-server.csri.toronto.edu!bonnie.concordia.ca!thunder.mcrcim.mcgill.edu!snorkelwacker.mit.edu!usc!zaphod.mps.ohio-state.edu!rpi!uwm.edu!rutgers!netnews.upenn.edu!vax1.cc.lehigh.edu!cert.sei.cmu.edu!krvw From: padgett%tccslr.dnet@uvs1.orl.mmc.com (Padgett Peterson) Newsgroups: comp.virus Subject: Hard Disks (PC) Message-ID: <0006.9102061308.AA27330@ubu.cert.sei.cmu.edu> Date: 7 Feb 91 00:22:08 GMT Sender: Virus Discussion List Lines: 48 Approved: krvw@sei.cmu.edu rfink@eng.umd.edu (Russell A. Fink) writes >On two IBM PC's, one, a PS/2 Model 50; the other, an AT (circa '86), I >notice that 'chkdsk' on the hard drives result in there being an >identical number (and memory cost) of 'bad sectors' reported for both >machines. This is not surprising if the disks are similar and would depend on the disk configuration and "bad tracks". Very simply, it is not unusual a hard disk to have a few "bad tracks" reported. This usually appears on a sheet supplied with the drive and on a label attached to the drive. At one time, most drives I saw had zero while today 2-4 is not unusual. If a 40 Mb drive had over 5 I would become concerned though I once saw a 33 Mb EDSI drive with over 100 (really!). Normally, the label will report "bad" tracks by cyl and head e.g. cyl 307 hd 5 and this should be entered into the "defects list" when a low-level format is done such as by DISKMANAGER. Now on an MFM drive, there are typically 17 sectors per cyl/head so when a "track" is marked bad, this represents 17 x 512 bytes or 8704 bytes. However, when the disk is formatted, DOS allocates in "clusters" made up of 2, 4, 8, or 16 sectors. Since if any part of a cluster touches the bad track, DOS marks it "bad" in the FAT so the real loss depends on the cluster size (Norton's DiskInfo or any of a number of utilities can give you this information) so for each bad track, DOS reports "bad sectors" as follows: Cluster Size Sectors Lost "Bad" DOS Lost Bytes/"Bad" Track 2 18 9,216 4 20 10,240 8 24 12,288 16 32 16,384 Thus for 4 sectors / cluster, each "track" marked bad will have CHKDSK report a loss of 10,240 bytes, if four heads are reported on the "bad track" list, CHKDSK will report a loss of 40,960 bytes. This would not be unusual and could be verified by examination of the disk or use of a non-destructive disk analysis utility such as Steve Gibson's SPINRITE. What would be unusual would be the loss of a different sector quanta such as 2 - 4 sector clusters or 4096 bytes. Note: If you use DEBUG to look at the boot sector (-L 100 2 0 1), the cluster size may be found at offset 0Dh (debug command -e10d). If you see a 10, remember this is hex (16). Padgett ps: my partition table replacement is now in beta.