Even if it's there as "P:" ?

I believe it is there as P:/ so you *can* format it, not so you can access it. As I said before I don't believe windows allows access to the hard drive as a block device. To my knowledge you have to have a filesystem on it in windows. Accessing a hard drive as a block device is completely different than at the level of a filesystem. And if you could access it as a block device it would almost surly be some administration trickery not something a regular user can do. Accessing your hd as block means you could for instance grep the contents for the sting 'password.' There are no per file permissions, because your not at the file level, you could write right over kernel.dll or explorer.exe and by reading the device at that level those two files will be included in the dump in their entirety. I have since moved off of windows but I wasn't able to figure out how this was done when I was using it. You might have to install a driver to give you this functionality. The upside to this is no more bootsector viruses, and you can accidentally wipe your MBR.


Evan Carroll
www.EvanCarroll.com

If this were me, I'd probably boot into linux from a CD and use dd (and maybe strings too, if I was really just looking for the text files.) I think there's a dd that comes with cygwin. And there may be other versions available too. I'm not sure how functional they are.

Good luck.

-sauoq
"My two cents aren't worth a dime.";

With apologies to Janis Joplin,
Oh lord, won't you burn me a Knoppix CD.

Really-- a Live distro like Knoppix is built for this kind of hardware hackery. Boot it off the CD, and you never have to become an expert at dual booting, or even install anything to the hard drive itself.

--
[ e d @ h a l l e y . c c ]

use Win32API::File qw /:Func :IOCTL_DISK_ :MEDIA_TYPE/;
use Data::Dumper;

use strict;
use warnings;
use diagnostics;

my $sDosDeviceName = [];
my $osTargetPath;
my @devices = Win32API::File::QueryDosDevice($sDosDeviceName, $osTarge
+tPath, []) or  die "Can't open: $^E\n";

print Dumper($sDosDeviceName);

#foreach (@devices) {
#    print $_ . "\n";
#}

my $hObject = createFile( "//./PhysicalDrive3", "r", "rw")
                            or  die "Can't open: $^E\n";

#Usage: Win32API::File::DeviceIoControl(hDevice, uIoControlCode, pInBu
+f, lInBuf, opOutBuf, lOutBuf, olRetBytes, pOverlapped)
my $opOutBuf;
my $olRetBytes;
Win32API::File::DeviceIoControl($hObject, IOCTL_DISK_GET_DRIVE_GEOMETR
+Y, [], 0, $opOutBuf, [], $olRetBytes, []);

# Calculate the number of DISK_GEOMETRY structures returned:
my $cStructs= length($opOutBuf)/(4+4+4+4+4+4);
my @fields= unpack( "L l I L L L" x $cStructs, $opOutBuf );

my( @ucCylsLow, @ivcCylsHigh, @uMediaType, @uTracksPerCyl, @uSectsPerT
+rack, @uBytesPerSect ) = ();

print Dumper(@fields);

my $ucCylsLow = shift @fields;
my $ivcCylsHigh = shift @fields;
my $uMediaType = shift @fields;
my $uTracksPerCyl = shift @fields;
my $uSectsPerTrack = shift @fields;
my $uBytesPerSect = shift @fields;

if ($uMediaType eq FixedMedia) {
    print "FixedMedia";
}
[download]