Anyone know what disk editors are available for modern operating systems, like windows, macosx or linux? Partition Magic sort of fills the gap in windows.
- There are now many links to such editors for Windows, but a good disk editor for both Linux/*nix and Mac OS X doesn't appear to exist yet! Daniel B. Sedory 01:53, 1 April 2007 (UTC)
- It would only make sense to combine them if there was a "low level/direct/raw data/byte editor" page, but since there isn't... This note is in case someone decides to do a merge at a later date. A redirect would have to be created for "hex/disk/sector/..." editors. Note that this would include the process editors such as ArtMoney, GameHack, 010 Editor, WinHex, and many more including just about any debuggers. This would ALSO include tools like RW-Everything and SBWorkshop that can access firmware and 'hidden' busses such as the one going to my laptop's battery and the serial EEPROMs on almost all DRAM modules. The effort would be great and require a new table to show a comparison of features for those programs since there's so much overlap. Editing of raw data is much more subtle than files vs disks. If there were a "Raw data editing" article, I would recommend getting it working in a hidden test article posted in the discussion pages of these related articles, and then combining the original articles until they are ready to be replaced by a set of redirects. Is there a way to do this? Or a tool to change spreadsheets into the format for tables that Wikipedia uses?
Some more candidates for Windows
R-Studio (most expensive? :P)
Disk Explorer by Runtime software (Two versions - FAT and NTFS)
010 Editor (Also edits processes!)
http://www.new-utilities.net/nt_disk_viewer.html has a freeware one that I haven't tried.
Note that many of these are hybrid hex/sector editors like WinHex. I'll add the ones that I have tried into the list. If there's a reason to not post one, then just redact it. Does anyone have some command line interface tools that just extract/write sectors/bytes from drives? I know there has to be plenty for Linux (dd clones for example), but I don't have a link to any for Windows. JWhiteheadcc (talk) 04:30, 16 May 2009 (UTC)
These tools are so important to a person needing them, that the links are very useful. However, this goes in contrast to the shortness of the article. Since the links must stay to make the article remotely useful, the article needs more information in the non-link sections. :P
A history of disk editing applications/programs could be a good candidate for a new section. Initially, the closest thing to editing data directly was to use a logic probe to view the data, and a pulse generator to program the data. Disk drives changed all that by adding the ability to send commands using simple assembly libraries that the drives made convenient to access. You would just use a known working code sample typed in from a magazine or book and get access to the raw data without using the OS. On later computers such as the Commodore 64 and Apple IIe, the system even had a lot of the needed code included on the board/drive! Most of the logic needed to access raw sectors was on the 1541 drives and the serial bus used packets much like modern ATA/IDE drives. USB and IEEE 1384 were both inspired by the Commodore 64's convenience for the time with it's serial bus. The Apple II family had raw sector logic implemented as part of the BIOS, instead of on the drive itself. From a software point of view, you just put data in a certain format, in certain places in memory, and then called a certain location in the drive controller's firmware, in order to tell it to read/write data. No recent standard I'm aware of uses direct software access to the non-decoded bits like this. The chipset and firmware on DVD-ROMs for example, does not normally have ATAPI commands to bypass ECM encoding/decoding. This would normally only be useful for forensic applications, as even tools to copy 'copy protected' CDs don't need this kind of access - the drive just must allow the burning of arbitary/bad sectors which is at least a level above ECM.
What about a reference to the politics related to accessing data in this manner. For example, DRM would have to either provide only encrypted results that obviously could only be edited if you had the key, or refuse to provide any data at all in order to save money by not encrypting the data but rather use a handshake/password. Examples of the first method are DVD's CSS and cable/satellite television's premium broadcasts. Examples of the 2nd method include the ATA standard and (rather worthless) software that goes in the boot sector. A challenge-response method is somewhere in the middle - the data isn't encrpyted, but the process to get access IS. Laws in some places could make accessing data with even the weak "software password" protection on a drive, illegal unless you have permission. Laws in even fewer places make the software tool itself illegal. However, depending on how it's sold, it can be illegal in most places if you advertise it as a "hacking tool".
A link to a copy protection article makes sense. A lot of the disk copier tools included a built-in disk and file editor back when this was essentially the same function due to the way a floppy drive works (most had less than 500 clusters and often the cluster was a single sector). Hard drives and networking have made these into two very similar, but distinct types of tools. It is no longer practical to try to distinguish between one file's sectors and the 200000+ other files on a drive. Even if there is only one file on a HDD, the millions of 'empty' clusters would be a pain to go through. The point is that a file-only editor is often much more easy to use since you can't accidentally change the wrong file. A disk copier had the sector editing function to get around some silly 'features' that prevented copying the disk using the file copying tools built into OSes. Often, just creating two files with the same name was enough to prevent casual copying. Later, the copy protections included bad sector checks, and the disk editor had a disassembler so that you could 'fix' the check. Copy II Plus came with a database of 'patches' that fixed 95% of the 5% of disks that it couldn't make good copies of. Note that the protections weren't what often prevented copying - the disks got errors over time and you had to combine two known partially good disks. Often though, the copy protection wore out the same part of the disk. Thus, the patches included a work around. Ouch!
A description of the difference between hex editors and disk editors already exists but is kind of narrow. A good extension might be to follow it up with a comparison of types of raw editing.
Disk editors and detection of a boot virus is also of interest. This applies to disk overlays as well.
Disk imaging tools are related in that they allow easier editing of the drive's data a later time, without changing the original. R-Studio includes a read-only virtual drive driver for it's image files. You can get data off of a drive without harming it. The nice thing is that you can write to the virtual drive and the changes vanish as soon as you reboot. This makes tools such as CHKDSK work, still. Some non-forensic tools allow live editing such as WinImage. This means that changes are instant to the image, as if you had writen to a real drive. The changes are kept after a reboot, so you can edit a master disk image for writing back to multiple drives. This is handy for IT security purposes. Get your changes made, and then make sure that no one modifies systems. >:)
Does anyone else have ideas for improving content? It'll be hard to find the references to products such as Copy II Plus and Locksmith II, so someone might complain about verifiability. This is the most painful part of creating a history section. Does Wikipedia accept out-of-print user manuals or magazine articles as references? I imagine many people reading this article have copies hanging around.
I am afraid to edit this page but I think DiskPatch from www.diydatarecovery.nl should be in the list of products containing a disk editor. — Preceding unsigned comment added by 18.104.22.168 (talk) 09:13, 1 November 2012 (UTC)