2

I have found a recommendation to change the GPT Attributes of a partition in order to prevent windows from automatically detecting and assigning a drive letter to an encrypted USB drive when inserted, as well as marking it as "required" - avoiding a pop-up suggesting to format it. This is the suggested change, and it appears to work across multiple computers with no data corruption yet.

GPT ATTRIBUTES=0xC000000000000001

I understand the '1' in the last position of the string is to mark the partition as "required" and prevent the system from deleting or formatting it. The first position following the 'x' has several possible values equating to things such as denoting the partition is a shadow, or a basic data partition; these all seem to be numeric values (ie. 2, 4, 8). But I cannot find anything that signifies what the 'C' in the first attributes. Does anyone know what this does, or if it poses an issue to data stability/corruption long term?

Thank you

0

2 Answers 2

3

First thing: 0xC = C (hex) = 12 (dec) = 1100 (bin). Four bits. Each and every character in the string C000000000000001 denotes four bits, 64 bits total. Binary representation of the string is 11…01 where replaces 60 zeros.

The meaning of these bits (from Wikipedia):

0 Platform required (required by the computer to function properly, OEM partition for example, disk partitioning utilities must preserve the partition as is)
1 EFI firmware should ignore the content of the partition and not try to read from it
2 Legacy BIOS bootable (equivalent to active flag (typically bit 7 set) at offset +0h in partition entries of the MBR partition table)
3–47 Reserved for future use
48–63 Defined and used by the individual partition type

It's not immediately obvious which bit in your 11…01sequence is 0th, which is 63rd. Are the numbers offsets in the bit sequence? or is the 0th bit the least significant (rightmost) bit in the resulting binary number? Well, in my tests with (Linux) gdisk I toggled the 0th bit and the attributes toggled between 00…00 and 00…01, so I would say 0th is the least significant bit in the resulting binary number.

Which means your interpretation of the (hexadecimal) digit 1 is right (although not complete, the digit includes information about bits 1, 2 and 3 as well, these bits are unset).

gdisk displays its own interpretation as:

0: system partition
1: hide from EFI
2: legacy BIOS bootable
60: read-only
62: hidden
63: do not automount

This agrees with Wikipedia when it comes to bits 0-2, and with this other answer and the link therein for 60, 62 and 63. I would treat those latter bits with a grain of salt, since Wikipedia states that

48–63 Defined and used by the individual partition type

and you didn't tell us what the partition type is, so we cannot really investigate further. On the other hand I wouldn't be surprised if Windows used its rules to all partition types. The fact your setup "works across multiple computers with no data corruption yet" suggests that at least for this particular partition Windows uses its rules regarding bits 62 and 63.


To summarize, the attributes in question mean:

  • disk partitioning utilities must preserve the partition as is,
  • hidden,
  • do not automount.

This setup should work for you and not possess any threat to data stability.

5
  • I don't know if the numbers are offset. For the bit sequence all I know is the 16 character string used to set the GPT attributes. The partition is NTFS on a 250GB ssd, total usable space 223GB. It's GPT, so not MBR from my understanding. Single partition for the entire disk, created in windows 10 1803. That is about all I know for partition characteristics. The drive was encrypted using VeraCrypt, after which the drive started being automatically recognized by windows as unusable or corrupt, asking it to format every time it was detected.
    – jay-123
    Jan 12, 2019 at 16:32
  • And yes after setting the gpt attributes to the string mentioned in my question, the drive was still detected by windows with an audible 'ping' but not mounted, not assigned a drive letter and hidden from explorer, though still visible in diskpart and disk manager. VeraCrypt was also able to detect the disk, and when decrypted a new drive letter was assigned and mounted with full functionality. The same results were obtained when the drive was connected to machines running windows 10 1803, window 8.1 64-bit windows 7 64-bit.
    – jay-123
    Jan 12, 2019 at 16:38
  • @jay-123 One information that would be definitely useful is the partition type (GUID code of the partition). Does it match any GUID from this list? Edit the question if you'd like to publish the GUID. Jan 12, 2019 at 16:42
  • Thank you, I will look for and post the GUID later when I get home. If I am interpreting the information correctly then the string C000000000000002 would give the binary 11..011, adding the hide from efi attribute?
    – jay-123
    Jan 12, 2019 at 16:50
  • @jay-123 No, 0xC0…02 is binary 110…010 (0x2 is binary 0010). To get binary 110…011 you need 0xC0…03 (0x3 is binary 0011). Jan 12, 2019 at 16:54
1

As Kamil pointed out, the "C" is hexadecimal, and is represented in binary as 1100. That is: 1*8 + 1*4 + 0*2 + 0*1. Thus, you can think of the "C" as a combination of an 8 and a 4.

From https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/gpt, here are some of the values of the GPT attributes.

  • 0x8000000000000000. Specifies that the partition will not receive a drive letter by default when the disk is moved to another computer or when the disk is seen for the first time by a computer.

  • 0x4000000000000000. Hides a partition's volume. That is, the partition will not be detected by the mount Manager.

So, in your case, treating "C" as a combination of 8 and 4, your partition (1) will not receive a drive letter, and (2) is hidden.

2
  • It’s also marked as being required. Which sounds like the EFI partition.
    – Ramhound
    Jan 12, 2019 at 1:27
  • Wow, this makes a lot of sense. Thank you for the answer!
    – jay-123
    Jan 12, 2019 at 16:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .