Uncover the mystery of Windows 7 self-built hidden partitions

Windows 7 users, after running the diskmgmt.msc to open the disk manager, you can see that there is a hidden partition of size 100MB or 200MB before the system partition (usually C partition). What is the connection between this special hidden partition and the Windows 7 system?

Special note: The size of this hidden partition is different in each version of Windows 7. In the bate version of Windows 7, the hidden partition is 200M. From the RC version of Windows 7 and later versions, the hidden partition size is changed to 100MB, but in any case, the effect is the same. During the Windows 7 installation process, it will first create a hidden partition of about 100M at the beginning of the disk, and then install Windows 7 in another partition.

Okay, let's take a look.

1. Partition Status

The format of this partition is NTFS. There is no disk label and no drive letter. The disk status is described as: system, activity, primary partition. Because there is no drive letter, it is not visible in the resource manager.

2, What is in the partition?

In order to find out, I assigned a drive letter F to it. To do this, select the partition in Disk Administrator and right-click and select "Change Drive Letter and Path" to bring up the change wizard. Click the "Add" button in the pop-up dialog box, click "Assign the following drive letter", then click on the drop-down list to select F from it, and finally "OK" to exit. Next, open "Computer" to see a new disk partition F. Enter the partition and find two hidden directories Boot and System Volume Information. There are also two hidden files bootmgr and BOOTSECT.BAK. There is no doubt that Windows 7 saves the system's boot files in this hidden partition.

3. Does it affect the system startup after adding the partition number?

Next, we restart the system to see if the above operation (adding a drive letter) will affect Windows 7 starts. The test results system starts normally, and it can be seen that the above modifications will not affect the system startup. This is very well understood, the operation of reassigning the drive letter to the boot partition does not modify the system's boot file, nor does it modify the disk boot sector. It can be seen that the reason why Microsoft put the boot file of Windows 7 in a separate hidden partition must be the protection of the boot file.

4. Can I return the partition to the hidden mode?

Since the hidden partition is to protect the system boot file, let's test it to see if it can be canceled. The drive letter it is assigned to. Right-click on the partition and select "Change drive letter and path". Try "Change" or "Delete" drive letter to display "Cannot delete/change the drive letter of the volume" because the volume is the system or the boot volume. Thus, the process of adding a drive letter to this particular hidden partition in Windows 7 is irreversible.

5. Does deleting the files in the partition affect the system startup?

The following is how we try to delete the system boot files in the partition. The author logs in to the system as an administrator, enters the F partition and then deletes the file. During the deletion process, some of the files were undelete, showing "File is in use" or "No deletion permission". Then I tried to give the administrator full control permission and the result was rejected. After testing, even the system does not have full control permissions, only the TrusterInstaller user has full control permissions. This user is unique to Windows 7. Its task is single and related to system installation. There is no such user in Windows 7 users and groups (lusrmgr.msc). Let's see if it affects system startup after deleting some files in the partition. Restart the system, no problem, the system starts normally. It can be seen that the file we just deleted has nothing to do with the system startup, and the files that are really related to the system startup cannot be deleted.

6. Does deleting the partition affect the system startup?

Through the disk manager, the author tries to "format" and "delete the volume". Windows 7 has done a very good job of protecting this partition. Since the system tools don't work, try a third-party tool. I tested it with Acronis Disk Director Suite 10.0, which used the tool to delete the partition and its data, and then restart the system. The display "BOOTMBR is missing" means that the primary boot sector is lost and the system cannot be started. It can be seen that the hidden partition saves the boot file of the system and the primary boot partition information of the disk.

Summary: The above test reveals the mystery of this hidden partition. This 100MB or 200MB hidden partition is very important for Windows 7, it saves the system boot file and disk boot sector information. . If it is lost or destroyed, it will be catastrophic for Windows 7. In general, saving Win7 boot files in a hidden partition undoubtedly enhances its security. However, because the target is single, it is also easy to be the target of the attack. Therefore, it is recommended that you do not assign a drive letter to the hidden partition, so that it can prevent human or virus Trojans from causing damage to a large extent.