Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

As far as I understand it is possible to write directly to disk on Windows, bypassing the file system, and presumably this is precisely what disk shredder software does in order to shred empty space on disk. Similarly SQL Server probably does direct writing to disk within the confines of its MDF data files.

Now, does Windows OS or any other known major software (other than shredder) write data to disk outside of legit Windows files, e.g. in order to create its own quasi file system in disk sectors which, from the standpoint of Windows file system, are "unused free space"?

I guess I am primarily interested in this with regards to Windows itself because that would have important implications for any work having to do with monitoring or imposing lock down on OS activities.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

Windows routinely writes to the disk MBR or more modern boot data structures, which is outside any file system. Also, file system initialization itself of course requires raw disk access. Windows creates a backup of the NTFS boot record at the end of the file system partition, but outside the file system. Other than that, there would be no reason for the OS to be accessing the disk other than through the file system. Raw disk access is limited by later Windows OS as described at http://msdn.microsoft.com/en-us/library/windows/hardware/ff551353%28v=vs.85%29.aspx. Any locking down or monitoring done to detect such raw access from within the OS is clearly going to have to be done at the kernal driver level.

share|improve this answer
    
thank you for informative response and interesting article. Question, so the article talks about "sectors being written to fall within a mounted file system that is locked explicitly". What does that mean, in terms of who is allowed to lock, what is locked and what is and is not allowed after lock? E.g. on my PC is file system locked? Can I lock it if I wanted to? –  EndangeringSpecies Apr 20 '12 at 20:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.