Archived from groups: comp.sys.ibm.pc.hardware.storage,microsoft.public.storage (
More info?)
Arno Wagner <me@privacy.net> wrote:
> In comp.sys.ibm.pc.hardware.storage Jimmy Hoffa <jhoffa@cementshoes.com> wrote:
> > I saw a story on television last night about the BTK serial killer.
> > The reporter said that the killer was caught because he sent in a floppy
> > disk and floppy disks have code written to them that identifies the computer
> > that the floppy was written on. The story didn't specify whether the code
> > is written to the floppy during formatting or during a normal write
> > operation. Is this true?
> > J.H.
>
> As usual, it depends. I'll try to break it down:
>
> 1. Space to store something:
>
> There is space in the boot-sector of a floppy for information.
> It does hold some structural info about the floppy and the actual
> boot code, if present.
>
> As a consequence in a non-bootable floppy there is around 300 bytes
> free space. In a bootable floppy there is less, depending on the boot
> loader code.
>
> So there _is_ space. However the boot sector is the only safe space
> that can be used for this type of information.
Actually there is more room for data on floppies than the above. A sector
doesn't consist of just 512 bytes but has a preamble that is seen by the
controller and serves to locate the sector CHS, the sector size, and for ECC.
The CHS data and size is written when unconditionally formatting the floppy and
the CRC is re-written by the controller on every "write" to the sector.
The above data occupies just a few bytes of the preamble section which has ample
spare space for extra sectors on the track. Old timers may remember FDFORMAT, a
utility by Christoph H. Hochstaeter that allows formatting floppies to smaller
or larger capacity than the default, by changing the number of sectors per track
and adding extra tracks.
Old timers may also remember the software copy protection schemes that were
based on non-standard tracks that were deliberately created to protect from
software piracy. Both features are based on manipulating data structures that
cannot be accessed normally by the user.
Yet there is no computer-specific data in the preamble area.
> 2. "identifies the computer" and how to trace that identity:
>
> There are devices in a modern computer that have unique serial
> numbers that can be read by the OS. There are also possible temporary
> values that are unique at one point in time. Examples are HDD serial
> number, MAC address of the network card and (possibly temporary)
> IP address. Also there is a GUID (Globallu Unique ID)
> windows generates on installation.
>
> The only one of these relatively easy to trace is the IP address,
> and the GUID. It is possiblethat the GUID gets transmitted to MS
> on every update and can then be tied to an IP address. Also remember
> that you have to register your OS with MS today.
>
> 3. When is something stored and what code does it:
>
> On formatting there is a chance that the GUID of the OS is
> written to the floppy, I don't know what Windows does.
> Maybe somebody else here knows...
It does nothing of the sort.
> On normal floppy access nothing is written to the boot sector.
> Nothing is written to identify the accessing computer.
>
> The only two possibilities I see is spyware (never heard of
> one that writes any computer ID on the floppy) and the
> ID being in, e.g., a MS word document. They contain all
> kinds of information that is not supposed to be in a
> text file, e.g. the mentioned GUID.
If the floppy wasn't pre formatted and out of the box, then it may have
contained erased data that could link the floppy to the computer on which it was
processed. Whether computer specific or not depends on the exact nature of such
data, if there was any.
> Bottom line:
>
> For a MS box I consider it possible to identify the computer the
> floppy was formatted on
There is nothing computer specific in the formatting process.
> and it may be easy to identify the computer
> a MS word document was created on or worked on.
Identify the PC, once it is in the hands of the investigator, yes. Easy? Far
from it.
> On the other hand an ASCII file written on a preformatted
> floppy or one formatted, e.g., on a Linux box would likely
> be impossible to trace.
Plain formatting of a floppy doesn't erase the data area, it just clears the
root directory and the FAT. To clear the entire data area use FORMAT /U
(unconditional formatting).
> I consider it far more likely that they identified the computer
> from a file and not from the floppy.
I wouldn't entirely exclude the floppy option.
Regards, Zvi
--
NetZ Computing Ltd. ISRAEL www.invircible.com www.ivi.co.il (Hebrew)
InVircible Virus Defense Solutions, ResQ and Data Recovery Utilities
Facebook
Twitter
Instagram