The previous part made a passing mention about hidden data from duplicators nested in Track 80 (the 81st track) – so in this segment, I’ll be focusing on just what other things can be unearthed. This will look at data on the disks – whether it could be recovered with or without the Kryoflux.
Lets start with an innocent blank disk, one of my favourites, the Verbatim Teflon Coated 3.5″ HD. Straight from the factory, blank with factory formatting.
I’ve given this sort of image a nickname – the 80 “and a half” tracks image. There’s some data on side 0 of track 80 – but none on the other side. Track 80 shows a full 18 sectors on one side and noise on the other. This results in a slightly larger disk image than you’d expect due to the extra track.
Time for some hex editing fun – in this case I’m using WinHex but anything will do really. Inspecting the first sector gives us an interesting insight already. The boot sector has the information suggesting this “preformatted” disk was actually duplicated in a Trace/ST duplicator.
Big woop – so we could see this if we just imaged the disk regularly – but I’m not so sure we can see that “half” track with a regular disk imaging software. This is what’s in that last half track …
The rest of the sectors on that track were filled with F6h’s, but I spot human readable text. Now that’s interesting. It has a date – 15th June 2005 at 1:46 am (presumably). CMC – maybe this implies CMC Magnetics Corporation had something to do with it, and KL2 may represent the plant. CL1, KL3 has been seen in place of KL2. VA_144 probably denotes the type of drive or media? The number 144 stands out as being related to 1.44Mb but this could be a coincidence. In place of VA_144, CMCMACC has been seen as well.
This was found in a Verbatim DatalifePlus Black, Apple Formatted disk
In this case, the pattern of 2Eh continues for the end of the sector, and the mark rest of the track is padded out with E5h. Interestingly, both sides of Track 80 were written with the full 18 sectors in this format. Disk Type 101 may be an internal use, the Disk # may represent the number of disks written by the loader. Interestingly, the time stamp on the first sector says 20:00:00 and the time stamp on the second sector says 20:00:01. Very accurate timekeeping there! Also interesting the plain text readable DISK ACCEPTED ! message.
I went and found another one, and the numbers are different, so this isn’t just being lazily replicated from one master disk to another!
It has been spotted with a different M/C ID and DISK TYPE as well, despite also being an Apple Format disk. This machine here actually has a proper date setup – and I’d probably believe it too.
It would probably be these types of marks, amongst others, which analyzation software tries to make sense of to identify and authenticate disks. But it’s interesting to look at this information which I never knew existed on floppy disks!
This one comes an Imation Translucent IBM formatted disk. The dates are nonsensical – I’ve seen ones from 1903 and 1904 as well. Interestingly, the equipment must have still been configured for 3M when it was acquired by Imation. The IBM represents the formatting type.
And this one is for the Mac preformatted disks …
And there are ones from them which were configured correctly. Interestingly, this one is slightly different from an Imation Black HD IBM formatted disk that says says No Error but it also seems to have logged RESH TRACK 35, SIDE 1 which implies something happened …
This was spotted at the end of the Verbatim DatalifePlus HD Black. This one uses @ symbols to fill the rest of the track, only one side of Track 80 is written. It’s got a sensible date and time, with some numbers which are likely to represent the machine and a serial.
Other examples include, amongst many others …
This one even has a letter where the other examples have numbers.
This one was from a Verbatim DatalifePlus HD Black with Gold Shutter. From the looks of it, Verbatim probably had many OEMs supplying disks or different plant equipment for each line. Rather amazing to think of. This one has a sensible date and time, and seems to be aligned for a 16 character wide view (funnily enough – they may have forseen my use of a hex editor in this configuration).
A similar mark was spotted on a Verbatim HD disk with Black Plastic Shutter with Beige Plastic Body. I wonder if those are settings or parameters encoded in there too …
One was spotted with just nulls filling up track 80, side 0.
Going hunting for these marks on HD disks is generally easy since they will be mastered typically MFM which would format match with the main data. If you see a Mismatch, it may be because of the sector size. By changing the sector size, you might have a chance of decoding it into an image file for analysis. The default size is 512 bytes, so try all other options and see if it works (but it’s unlikely).
If you want to find them on Apple GCR coded disks – they might be there as well, but I’ve had little to no luck with it showing Mismatch. Their presence is easily detected by the appearance of the Scatter Plot.
Unfortunately, as I’ve found, all cases of mismatch on my disks cannot be resolved from tweaking the sector settings or modes in sane ways, so I’ll give up on those. But there’s definitely data there!
One of the interesting things is that if it was present at the manufacture, this data will linger with the disk for its life unless it’s been formatted by a utility utilizing more than the standard 80 tracks – i.e. special “extra capacity” programs. This means that there may be a forensic way to verify the age of the floppy, or the source of the floppy, or even the machine which formatted the floppy and the batch it was produced in.
In the next part, I’ll look at making some use for the images of the disks we’ve gotten so far. Stay tuned …