I am the author of a freeware drive cloning utility, called Copy+. This software is explicitly designed for cloning drives from a popular PVR in the UK. I currently have a problem open with a user, where I am seeing the FAT32 Total_Sector_Count value at offset 0x20 in the BPB being modified upwards from the expected value (as would normally be set by the PVR during formatting). It appears this change is being made by some third party software on the users PC (i.e. not by Windows). This particular user has NOD32 installed as his AV product. The situation is thus: The PVR partitions the entire drive, up to the maximum LBA limit, as a FAT32 Extended INT13 partition. It then creates a FAT32 file system within that partition, but always rounds down the Total_Sector_Count value recorded in the BPB to an exact multiple of 240 x 63 = 15,120 sectors. This means that there are almost always spare sectors at the end of the volume that could have been allocated to extra clusters in the FAT. However when mounted on Windows the BPB Total_Sector_Count is being increased, effectively adding the extra clusters on to the end of the volume. I realise that this process is normally safe on regular FAT32 volumes, when the BPB Sectors_per_FAT value allows for sufficient padding at the end of the FAT to map the extra clusters so created. I can also see how a virus might attempt to hide in these unavailable clusters on malformed volumes, and why a virus scanner or disk management software might attempt to make corrections. Unfortunately the software in the PVR (over which I have no control) also uses the total number of clusters (as calculated from the Total_Sector_Count value) to determine the offset of the non-FAT32-standard video recordings. Increasing the Total_Sector_Count value therefore has a direct effect on the PVRs ability to make future recordings on any disks modified in this way. I would therefore like to know: Does NOD32 "correct" the BIOS Parameter Block Total_Sector_Count value? If it is not NOD32, does anyone have any ideas what might be making the adjustment? Is there any way of inhibiting this behavior? Thanks in advance.