Ten Questions & Answers About Disk Signature Collision
Below are a list of the ten most common questions about a disk signature collision along with the related answer. The bottom of this article includes a video for some of the diskpart steps, which is needed when investigating a disk signature collision.
- What is a disk signature collision?
- Why does Windows create a disk signature collision?
- How do I find the disk signature ID?
- Does Windows 10 have diskpart?
- How do I start or launch diskpart?
- How to change a disk signature?
- Is there a disk signature collision for every device?
- What is MBR verse GPT
- What is the difference between an online and offline device, how do I fix it?
- Where can I find the full list of diskpart commands?
- Jump right to the demonstration video at bottom of article
#1 – What is a disk signature collision?
When two (or more) storage devices have the same hexadecimal value for their disk ID (also known as disk signature). Windows does not like to see multiple storage devices with the same signature, so it will take all but one offline so the user gains access to only one device. The signature collision is most often found when binary copies of a master have been made to target devices.
#2 – Why does Windows create a disk signature collision?
Our understanding of why Microsoft did this was to prevent malware from spoofing the OS by presenting an identical seeming drive with bad intent. Bear in mind this MBR stuff was developed when dinosaurs still ruled the earth. Malware was but a dream in some teenage miscreants mind. So little effort was expended in that direction, much to the chagrin of todays Microsoft. The bible says something about this, “The sins of a father shall be visited upon their sons” or words to that effect.
#3 – How do I find the disk signature ID?
Using a utility which comes with a Windows installation you can request to see the disk signature ID and compare the two (or more) signatures to be sure the collision is the root of your problem.
#4 – Does Windows 10 have diskpart?
Diskpart is part of the Windows installation package since Windows XP. The utility is available in all Windows installation packages from XP through Windows 11. Users may be required to run diskpart as the administrator so privileges may be required if the User profile does not have admin rights.
#5 – How do I start or launch diskpart?
The quickest method to start diskpart is typing “cmd” in any Windows Explorer window and click enter. TIP: If you need to get at the command prompt for a specific device, like a USB flash drive, navigate to the root of the USB itself (double click the USB drive letter) and from that Explorer window for that device, type “cmd” and that will take you to the command prompt for that specific device.
#6 – How to change a disk signature?
This is a very easy process. The instructions will show you how to fetch the disk signature hexadecimal value and also change the disk signature value.
Do the following: Start an Explorer window and type “cmd” into the address bar (the field at the top) and this will launch the command line. From this new window type “diskpart” and this will launch the diskpart.exe utiliyty included with your Windows installation
Type “list disk” and this command will list all the storage devices on your computer, even if a storage device is offline.
From the given list select the device you want to investigate. Using a teenager’s bit of logic we know the 476GB disk is probably not the one we want to investigate, probably the 15GB disk… that seems more like a storage device (says the teenager to himself)
Type “select disk 1”
Now the device is selected we must request the disk signature id. Type: “uniqueid disk” and this will return the disk signature Windows is using to identify the disk.
Changing the disk signature ID is equally as simple. The only caveat is knowing the disk signature must be a hexadecimal value. So if changing the disk ID is required, be sure to have a hexadecimal value ready. Hexadecimal from Wikipedia
TIP: Typically changing the disk signature by one value will do the trick to fix a collision.
In the example below we fetched the disk signature ID (A7F7C160) and changed the disk signature value to A7F70000.
TIP: If you have multiple devices with this disk signature you can incrementally increase them, such as A7F70001, A7F70002, A7F70003, etc.
#7 – Is there a disk signature collision for every device?
No. Windows will create a disk signature collision only to bootable devices. As mentioned before, the fundamental reason for Microsoft to create the collision in the first place was so a malware could not spoof an identical disk ID and fake it’s intentions as an honest, law-abiding citizen.
Here is proof of that. Below is a screen shot of two USB flash drives (16GB capacity) with the same disk signature ID and because the devices are not bootable, Windows doesn’t create a disk collision.
#8 – What is MBR verse GPT
Master Boot Record (MBR) disks use the standard BIOS partition table and can have a maximum of four partitions. GUID Partition Table (GPT) disks use Unified Extensible Firmware Interface (UEFI). The big advantage of GPT disks is the ability to have more than four partitions. GPT is also required for disks larger than two terabytes (TB) which is now the more common hard drive size. The traditional MBR is becoming a thing of the past (like FAT32)
#9 – What is the difference between an online and offline device, how do I fix it?
An online device means Windows has enumerated the device and given it a drive letter. An offline device is one which is enumerated, but Windows did not assign a drive letter and the reason is related to a disk signature collision. The intent here is for Microsoft to make it difficult for a User to gain access to the device. As mentioned before, we believe this is Microsoft’s way of combating against malware trying to spoof hardware devices and letting their virus spread. You can see the offline device by going into Disk Management. See the two images below.
To fix the offline issue, please go back to step six and follow those instructions.
#10 – Where can I find the full list of diskpart commands?
Microsoft makes public the commands for diskpart on their documents sub-directory:
https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/diskpart
#11 – Video tutorial on how to change disk signature in diskpart
Tags: disk signature collision, diskpart