Format THOROUGHLY 1

[kwunder]

I've heard that a simple format c: at the dos prompt doesn't actually REMOVE all data.

1) Is this correct ?
2) How can you actually THOROUGHLY wipe a HDD if this info is correct ?

Reason I ask is that I am selling my HDD, and after using Norton's Wipe Info (From within Norton System Works 2002) on some MS Money files, I was alarmed to find that Norton Un-Erase (Also from within Norton System Works 2002) was able to recover them, despite doing a 7 pass wipe on them !!!!!!!!!!!

Thanks for any info

 

[krinid]

Perhaps another round-about way of accomplishing the task is to fill up your drive with an unimportant file. Write a script that copies the file over and over again with a different name until you have no more hard disk space. At the end, you may have to copy smaller files to fill the space left over (space left < size of file). Then just delete all the files. Once actual data has existed on each sector of the disk, nothing can be retrieved, even using Norton utilities.

 

[madonnac]

a degaussing wand works wonders - it's usually used to restore monitors (to remove the purple corners you can get if someone has set speakers next to the monitor) but used on a hard drive messes up the polarity of the surface in random way - note that you will have to low level format after this - most of the time the start/end of the sectors has vanished after doing this

Note that the only way to actually destroy the data on a hard disk is to destroy it - a fun way is to use the platters of the hard disk to make windchimes

 

[krinid]

1) How much does a degaussing wand cost?
2) Does it really fix monitors with purple corners?
3) How does one carry out a low level format?

 

[kwunder]

yeh, I'm interested in &quot;LOW LEVEL FORMAT&quot;.....What's that all about ? NOT sure about the windchimes theory though

Sorry for the delay in replying, as my wife has just given birth to our baby son Nicholas on Tuesday !

Thanks guys. I've d.l killdisk and the Data Lifeguard from WD

Will try them...
In the meantime, I've have achieved 100% success with this little gem :-

http://www.heidi.ie/eraser/

It is the proverbial dogs ********

Thanks again... Off to wet the babies head !!!
Bryn (kwunder)

 

[AlexIT]

To get free tools for a low-level format just contact the drive manufacturer. Most of them offer a SMART package that will (among other things) perform a low-level format.

The Data Lifeguard Tools was written specifically for Western Digital EIDE harddrives:

http://support.wdc.com/download/dlg/dlginstall_10_0.exe

I have quite a collection of these programs from different manufacturers, but you must run the correct manufacturer's software or risk completely destroying the HD!

 

[krinid]

AlexIT,
Are these tools usually available for free from the manufacturer?

 

[AlexIT]

Yes, go to the download section of the HD manufacturer's site...they almost always have a free version (some also offer more features if you pay for the &quot;deluxe&quot; or &quot;professional&quot; version but the low-level format is included in every free one I have.)

Alex

 

[smactek]

Alex has it right, I just attended a seminar given by the worlds leading data recovery company. I asked him flatly, If I use the hard drive manufacturers low level format utility, is there and recoverable data on the drive. He said No. that is the only way to absolutely clean the drive. they can even recover data of of demagnatized ,smashed with a hammer reformatted to ntfs, fat32, fat16 to ntfs2, kind of scary.

&quot;Never Argue with an Idiot. They will Lower You to Their Level, Then Beat YOU with Experience&quot;

 

[Turkbear]

Hi,
No to inteerject with what seems like a naive question, given the above discussion, but how can data be recovered if you do the following:
Boot with floppy that can deal with PC's HD architecture ( ntfs,dos, fat32,fat16,etc)
Delete everything below c:\ ( assume only 1 drive)
use fdisk to delete all existing partitions..
reboot with floppy
create a new (dos or any other type)partion using entire drive;
Create a file called fillitup.txt on the c: drive
with one line of text in it, say 1000 characters.
create a batch file to do a loop with
a copy append command of that file to itself
let it run until c: is full.
Delete it and redo the fdisk to drop that partition..

After all that how can anything usefull still be there?

Just curious..

 

[AlexIT]

The above proceedure is almost EXACTLY what a low-level format is...except that a low-level does this BEFORE a partition is created (so it even overwrites the area where the MBT is placed.)

But BEWARE - there are recover-specific techniques that can pull data from the platter after a number of overwrites. (In some cases they must remove the platter, install it into a device with a much more sensitive magnetic read-array and excite the platter with an external magnetic field...)

From US Department of Defense 5220.22-M Clearing and Sanitization Matrix - For fixed-rigid disk you must either a,b,d or m (but I wonder why &quot;d&quot; cannot be used for TOP secret...)

a. Degauss with a Type I degausser

b. Degauss with a Type II degausser.

d. Overwrite all addressable locations with a character, its complement, then a random character and verify. THIS METHOD IS NOT APPROVED FOR SANITIZING MEDIA THAT CONTAINS TOP SECRET INFORMATION.

m. Destroy - Disintegrate, incinerate, pulverize, shred, or melt.

Whenever I have a customer that paranoid about things I will do &quot;a&quot; (wand-type) THEN &quot;b&quot; (ring-type) THEN either a low-level format so I can use the hardware again or &quot;m&quot; (cold chisel and 5lb sledgehammer shatters them nicely...)

Alex

 

[smactek]

Wow, thanks for the Info. I must admit technology never ceases to amaze me. With the abilities we have at our disposal, seems like we could slow down world hunger or find a cure for cancer.

&quot;Never Argue with an Idiot. They will Lower You to Their Level, Then Beat YOU with Experience&quot;

 

[krinid]

How expensive is this specialized recovery software/hardware? What I'm really curious about is, how many people in the world actually have these devices? Surely the batch file technique repeated ~10 times is enough to fool all the &quot;Norton&quot;-type recoveries? So unless you're a gov't agent, you don't have to worry about someone running your drive through a super-power magnetic recovery process.
Or am I wrong? Are these devices fairly accessible? Or even worse, are there companies out there who over these services at low prices?

 

[AlexIT]

Look in the back of PC Magazine and you will see ads for many recover services, I have had discussions with two that offer services as extensive as I described above. For complete recovery of data from standard 5400rpm 4GB SCSI drive was (at the time) quoted about $350-400 per 100MB.

 

[kwunder]

Hmmmm......Opened up a can of worms here me thinks !

 

[krinid]

AlexIT, Thanks for the info.

kwunder, Yes, a can of worms, but an interesting one.

Okay, so these tools can detect files saved even after deleting and overwriting several times...

How about after being overwritten seventy times? Or several hundred times?

Wouldn't it be possible to just do the batch file thing repeatedly?

copy file until disk is full
delete all files
change the file to be copied (so it's different data)
repeat 100 times

Wouldn't the probability of recovering this be very, very, very, very low? If not impossible?

 

[WildeDove]

We used the first floppy of the DOS 6.0 instalation pack.
Then put the XP CD in and let it format the harddrive again less the many patitions.

 

[AlexIT]

The &quot;d&quot; method that cannot be used for top secret material is: Overwrite all addressable locations with a character, its complement, then a random character and verify. This is a three-pass overwrite. Its possible that a seven-pass (or seventy-pass) overwrite would not be recoverable...especially if you are continuing the theory of writing a character, its complement, then a random character (then its compliment, then another random character etc.)

 

[kwunder]

With ref to my earlier posting, I advise you to try

http://www.heidi.ie/eraser/

I've had 100% success with this so far. It not only overwrites 1, 3, 7 or 35 times, it overwrites the file name as well as the cluster tips. I tried to recover files after a 7 pass and there was NOTHING.

Best of all, this great little app is FREEWARE !!!

Good Luck
kwunder

 

[krinid]

kwunder, Will check it out and keep it around for future use. Thanks.

AlexIT, Btw, what exactly is the 'complement' of a character? bitwise complement?

 

[AlexIT]

For more information on recovery from magnetic media check out:

http://www.usenix.org/publications/library/proceedings/sec96/full_papers/gutmann/

Depending on the type of encoding hard-coded into the drive, you must write different characters. Thats why a low-level format routine is different for each drive manufacturer. (The above paper has a very good description.)