I now understand this bug. The DOS partition table comprises 4 primary partition records (PPR) in the first sector of the disk, the so-called MBR. These define 4 physical partitions(PP). If one of these is flagged as an extended partition, there is a linked list of extended partition records (EPR) threaded through the extended partition. Usually (but not always) the actual logical partition (LP) data immediately (actually track aligned) follows its EPR. Hence if the third partition is an extended one, you might have the scenario:
- MBR: PPR1, PPR2, PPR3, PPR4, PP1 ,PP2, PP3 (Extended partition), PP4
Extended Partition: EPR5, LP5, EPR6, LP6, ...
However this is a typical case and not mandatory. Where this can "go wrong" is if you delete LP5, then the old LP6 now becomes LP5
- Extended Partition: EPR5, <big gap>LP5 (was called LP6), ...
and insert a new partition:
- Extended Partition: EPR5, EPR6, LP6, LP5, ...
and this is the case in these two examples: LP5 follows LP6. Unfortunately this
createrawvmdk routine assumes that the EPR and LP are consecutive and reads this dead space into memory. I don't know but I suspect this is because some encryption and protection schemes hide key data in these nominally unused sectors. Anyway, the utility can happily allocate a 63 sector block, but a 70Gb one is a slightly different matter.
Until the VBox developers fix this bug, the work around is to use the Linux fdisk advanced feature of renumbering the partitions which recreates the EPR records in LP order.