Get IT Done: Prevent data loss on XP workstations with large hard drives

by Scott Lowe MCSE | Jul 28, 2003 7:00:00 AM

Tags: Patches, Operating systems, SECURITY, workstation, Scott Lowe MCSE, Get IT Done, Microsoft Windows XP, patch, Microsoft Windows, hard drive, flaw

9 comment(s)

Takeaway: Patch Windows XP to prevent data loss on large hard drives

When hard drives first became standard on PCs, they were commonly only around 10 MB in size. Today, depending on your organization, you might have users with ATA hard drives sizes well in excess of 100 GB, with individual data file sizes that dwarf the hard drives of old. Unfortunately, Windows XP can encounter problems with large hard drives. To avoid losing data on large hard drives on XP workstations, you should obtain and install the latest patch from Microsoft.

What's the problem?
If you have or support systems with ATA hard drive sizes exceeding 137 GB running any version of Windows XP or XP with Service Pack 1—Home, Professional, Media Center Edition, Tablet PC Edition, or 64-bit Edition—you may be at risk from a flaw in the operating system. This flaw may become apparent when the system enters Hibernation/Standby mode or after a memory dump is written out to the disk.

It's important to note that you aren't likely to run into this problem in XP without SP1, because only SP1 has native support for drives exceeding the 137-GB limit. While support can be enabled in pre-SP1 XP installations, this isn't recommended outside a test lab.

Only ATA drives are affected by this flaw. If you're running systems exclusively with SCSI drives, you aren't at risk.

Problem description
To make use of the space beyond the old 137-GB limit, Windows XP SP1 uses 48-bit logical block addressing (LBA). Unfortunately, the processes that write the memory dump and Hibernation/Standby files do not write their data to the disk using 48-bit LBA. Moreover, when a Windows XP SP1 system with 48-bit LBA enabled enters Hibernation, Windows fails to issue a flush cache command to the IDE system's cache. As a result, any information still in the cache won't be written to the disk.

There are a number of symptoms that you can watch for to determine whether you're suffering from this flaw. If your system restarts rather than waking up from Hibernation, or if you experience data corruption upon entering Hibernation/Standby mode or after a memory dump or stop error, you may be afflicted. Data corruption can manifest itself in a variety of ways including problems starting the system, shutting down the system, running programs, or opening and/or saving files.

The fix
On January 22, 2003, Microsoft issued two fixes for this flaw. The first fix supports the Home, Professional, Media Center, and Tablet PC Editions—all 32-bit editions—of Windows XP, while the second one is intended for the 64-bit 2002 Edition of Windows XP.

To obtain the patch for the 32-bit editions of Windows XP, download it from Microsoft's Web site. There is a different patch for the 64-bit 2002 edition of Windows XP that you can download and install separately. These are links to the English language versions of the patches. If you need a patch for a different language, follow the link and select the appropriate language from the selection box on the right-hand side of the screen.

Note also that this patch should be included in Windows XP Service Pack 2 which is—as of this writing—undergoing testing. The patch replaces a single file, Atapi.sys.

Installation
To install the fix, download the appropriate version of the patch and run the single downloaded executable. The patch installer will automatically create a system restore point that you can back down to in the event that the new driver causes a problem. After the installation is complete, restart the system.

Fix for frustrating flaws
Data corruption flaws can be among the most frustrating flaws to stumble across and recover from. If you're supporting systems that meet the qualifications for this flaw, I recommend that you proactively install the fix rather than risk encountering this problem.

9 comment(s)