Windows 7 system special hidden partition

Windows 7 users, after running the diskmgmt.msc open disk manager, you can see that there is a hidden partition of 200MB before the system partition (usually C partition). What is the connection between this special hidden partition and the Windows 7 system? Let us explore the following.

1. Partition Status

The format of this partition is NTFS. There is no disk label and no drive letter. The disk status is described as: system, activity, and primary partition. Because there is no drive letter, it is not visible in the resource manager.

2. What is in the partition?

In order to find out, I assigned a drive letter F to it. To do this, select the partition in Disk Administrator and right-click and select "Change Drive Letter and Path" to bring up the change wizard. Click the "Add" button in the pop-up dialog box, click "Assign the following drive letter", then click on the drop-down list to select F from it, and finally "OK" to exit. Next, open "Computer" to see a new disk partition F. Enter the partition and find two hidden directories Boot and System Volume Information. There are also two hidden files bootmgr and BOOTSECT.BAK. There is no doubt that Windows 7 saves the system's boot files in this hidden partition.

3, after adding the partition number will affect the system startup?

Next we restart the system to see if the above operation (adding a drive letter) will affect the startup of Windows 7. The test results system starts normally, and it can be seen that the above modifications will not affect the system startup. This is very well understood, the operation of reassigning the drive letter to the boot partition does not modify the system's boot file, nor does it modify the disk boot sector. It can be seen that the reason why Microsoft put the boot file of Windows 7 in a separate hidden partition must be the protection of the boot file.

4. Can I return the partition to hidden mode?

Since the hidden partition is to protect the system boot file, let's test to see if we can cancel the drive letter we just gave. Right-click on the partition and select "Change drive letter and path". Try "Change" or "Delete" drive letter to display "Cannot delete/change the drive letter of the volume" because the volume is the system or the boot volume. Thus, the process of adding a drive letter to this particular hidden partition in Windows 7 is irreversible.

5. Is deleting the files in the partition affecting the system startup?

Below we try to delete the system boot files in this partition. The author logs in to the system as an administrator, enters the F partition and then deletes the file. During the deletion process, some of the files were undelete, showing "File is in use" or "No deletion permission". Then I tried to give the administrator full control permission and the result was rejected. After testing, even the system does not have full control permissions, only the TrusterInstaller user has full control permissions. This user is unique to Windows 7. Its task is single and related to system installation. There is no such user in Windows 7 users and groups (lusrmgr.msc). Let's see if it affects system startup after deleting some files in the partition. Restart the system, no problem, the system starts normally. It can be seen that the file we just deleted has nothing to do with the system startup, and the files that are really related to the system startup cannot be deleted.

6. Does deleting the partition affect the system startup?

Through the disk manager, the author tried to "format", "delete volume" can not be successful, it can be seen that Windows 7 protection of the partition is very good. Since the system tools don't work, try a third-party tool. I tested it with Acronis Disk Director Suite 10.0, which used the tool to delete the partition and its data, and then restart the system. The display "BOOTMBR is missing" means that the primary boot sector is lost and the system cannot be started. It can be seen that the hidden partition saves the boot file of the system and the primary boot partition information of the disk.

Summary: The above test unveiled the mystery of this hidden partition. This 200MB hidden partition is critical for Windows 7, which saves information about the system boot file and the disk boot sector. If it is lost or destroyed, it will be catastrophic for Windows 7. In general, saving Windows 7 boot files in a hidden partition undoubtedly enhances its security. However, because the target is single, it is also easy to be the target of the attack. Therefore, it is recommended that you do not assign a drive letter to the hidden partition, so that it can prevent human or virus Trojans from causing damage to a large extent.