The IHC Damage

Trying to sort through a heap of floppy images recently, I found many of them to contain a suspicious ‘IHC’ signature in their boot sector in the location where an OEM identifier (such as ‘IBM  3.3’ or ‘MSDOS5.0’ would normally be. I first suspected a virus, but it turned out to be something worse — a testament to the ubiquity of Windows 9x and the idiocy of its developers.

The ‘IHC’ signature is most likely the first three letters of ‘CHICAGO’ (codename of Windows 95) in reverse order. Windows 9x by default rewrites the OEM identifier in the boot sector of every floppy disk that it accesses, even if the access is something as simple as listing directory contents.

It is unclear what problem Microsoft was trying to solve exactly; reportedly Windows 9x tries to add an unique signature to each floppy for the purposes of write caching, a feature known as Volume Tracker. Only limited information can be found, such as this.

What is very clear, on the other hand, is the trouble that Microsoft caused.

• Some DOS-formatted disks may depend on the OEM ID. Novell/Caldera DOS 7.x disks are known to be affected. Given Microsoft’s track record in the 1990s, that makes one wonder whether this was a deliberate attack on Novell DOS.
• Disks that are not in a DOS format are likely to be destroyed. That includes many UNIX systems, which do not use the DOS style boot sector and may store critical filesystem data in the first sector.

There is a way to limit the damage Windows 9x causes, as detailed here. However, the method is imperfect because it only stops Windows 9x from tampering with known OEM IDs, and unknown ones will still be damaged.

Windows NT (including XP and later) never used this method, which means that the few surviving floppies are not in much danger anymore. Unfortunately a lot of damage had already been done in the late 1990s and the early 2000s.

I myself have never been particularly affected, for two simple reasons: I used Windows 9x very little and I write protected any disks that I did not want to be modified. Write protecting floppies is generally good idea, whether one uses Windows 9x or not.

In short, the ‘IHC’ signature is a classic example of a cure worse than the disease.