Disk Admin Bug

TITLE: Disk Administrator May Corrupt Partitions

----------------------------------------------------------------------
The information in this article applies to:

 - Microsoft Windows NT Workstation version 3.51
 - Microsoft Windows NT Server version 3.51
 ---------------------------------------------------------------------

SUMMARY
=======

After installing NT 3.51 and entering Disk Administrator for the first 
time, NT will write a disk signature to the drives before bringing the
window up. The drives and partitions will appear as normal but if you 
exit Disk Administrator and re-enter, some of the partitions may be lost
and incorrect information may be displayed on the remaining ones.
Other symptoms include Disk Administrator failing to display its main
window (hanging during initialization) or the error message "The
parameter is incorrect" being issued when Disk Administrator initializes.

MORE INFORMATION
================

The Disk Administrator in Windows NT writes a "Fault Tolerance"
signature to each physical drive's master boot record if one is not
already present when it is run for the first time.  This will be the case if
the drive has not been previously used with any version of Windows
NT.

In the situation where Disk Administrator does write a signature to a
drive on initialization, faulty calculations can result in the corruption of
logical drives in an existing extended partition.  This problem will not
occur if a signature is already present.

This problem will only manifest itself if there are more than two logical
drives in an extended partition a the time when Disk Administrator is
attempting to write the fault tolerance signature.

It is possible for a system to remain functional after the partition table is
corrupted.  The nature of the corruption is such that partition table data
is written to incorrect locations on the disk which may lie in the middle of 
user or file system data.  Provided this information is not overwritten, the
partition table entries may still identify the layout of the drives sufficiently
well that Windows NT can continue to access the drives.  This is an
unstable situation, however, as access to the partitions will be lost when
the table entries are eventually overwritten.  Additionally, if the table
entries overwrite existing data, user data or file system integrity may be
compromised immediately.

If you suspect that your partition table may already be compromised, you
should immediately back up any critical data, then repartition your disk
and restore the previously backed up data to the system.

WORKAROUND
==========

Assuming no version of Disk Administrator has ever been run, the
following options are available to prevent partition table corruption:

Option 1:  If there are not already more than two logical drives in an
extended partition, simply use Disk Administrator normally.  The
signature will be written correctly and no corruption should ensue.  If
there are more than two logical drives, perform a full system backup of
data on all drives prior to running Disk Administrator.  Then be prepared
to delete and recreate the partition structure prior to restoring the
previously backed up data.

Option 2:  If an earlier version of Windows NT is available, boot that
version and run its copy of Disk Administrator so that a Fault Tolerance
signature will be written to the disk. The 3.5 version of windisk.exe may
be run directly on Windows NT version 3.51 in order to write the initial
fault tolerance signature, but is not recommended for systems using
third-party partitioning software to support large IDE drives.

Option 3:  If you have the tools and knowledge to edit the disk at the
sector level, you may manually enter a disk signature so that Disk
Administrator will not try to do so.  The 4-byte signature is located at
offset 0x1b8 from the start of the Master Boot Record (physical sector
0). The value written is not important provided that it is non-zero, but if
there are multiple disks in the system, each should have a distinct
signature value. If this field is already non-zero, it is not necessary to
change it.
CAUTION:  This option should only be used at your own risk. incorrectly
editing physical disk sectors can result in corruption of the entire
physical volume resulting in loss of data and may require a complete
reinstall of the operating system.

This bug was fixed in service pack 2, if you haven't installed any service
pack yet I would suggesting getting service pack 5 from:

ftp://ftp.microsoft.com/bussys/winnt/winnt-public/fixes/usa/NT351/ussp5

Backup one step