TR Forums

JimiH · Thu Jan 02, 2003 1:44 am

I will soon be building a new rig and would like to sell my existing system. From the reading that I have done about how hard drives store data, I understand that the act of deleting a file only flips the first bit in some byte that identifies the beginning of a file, but the whole file will still be there until it gets written over by another file. How do you scrub the hard drive of all files except the OS? Is there some software package that can do that? And how easy is it to recover files that are deleted but not yet written over? Thanks!

Alex · Thu Jan 02, 2003 2:01 am

I would simply do a fresh install of your O/S. With that, you will reformat, which will be the easiest way to delete all your files, and the recipient will most likely benefit from a more stable, more responsive feel that you get from a clean install.

My .02 worth.

Thu Jan 02, 2003 2:05 am

If you really want to be thorough, run the low-level hard-drive utilities from your hard-drive manufacturer (IBM, WD, Maxtor, Seagate, etc.), then re-partition (good ole FDISK), re-format and re-install your OS.

JimiH · Thu Jan 02, 2003 2:23 am

Thanks. Morpheus, I can handle that. Engineer, that sounds a little too complicated for me; and since my HD is a 3 year old, 6 GIG unit, in a Toshiba that is not even being made anymore, I doubt that I will be able to find the software that you mention. But thanks for the info, as it helps me to better understand how HD's work.

Thu Jan 02, 2003 2:38 am

Every hard drive manufacturer out there will advise agains low-level formatting due to the fact that it can render the drive USELESS. They low-level format back at the factory.

If you delete an existing partition and add a new one, then full format the drive, the old data will be IMPOSSIBLE to recover.

Lowlev format is unnecessary and for the most part stupid. Fdisk and format is enough.

By the way, a low level format sets up the Cylinders and sectors on the disk. Partitioning divides the physical drive into one or more logical drives [drives that appear in Explorer]. Most computers only have one huge partition, which holds everything. Some Linux users partition the drive into as many as six logical drives, each of which has a different job, such as system files and swapspace. High level format, the one that is made for the commonperson, creates a file table based on the preexisting sectors and cylinders.

I've written way too much. Good night, and happy new year!

Thu Jan 02, 2003 3:00 am

mac_h8r1 wrote:
Every hard drive manufacturer out there will advise agains low-level formatting due to the fact that it can render the drive USELESS. They low-level format back at the factory.

I agree, but I have been impressed with the ability of IBM's Drive Fitness Test software or other manufacturers' low level drive utilities to repair bad sectors on an otherwise-useless drive.

Aphasia · Thu Jan 02, 2003 4:01 am

If you delete an existing partition and add a new one, then full format the drive, the old data will be IMPOSSIBLE to recover.

Ehh, NO. Even a cheap utility like the old Powerquest Lost and Found is able to recover files as long as you havent overwritten them with other information. Formatting or no formatting. When i had a harddrive crash in win98 a long time ago, in some way it deleted all my files when under a sleepmode, when i then ran lost and found, i got up the fats from both my current install, and the 2 former installs, and by install i mean a total format(no quickformat) + reinstall of win98 + writing of data. Of course there wasnt many sectors that had been left alone after two reinstalls, but of the ones who were, it could recreate the data fine.

And you do know that with an electron microscope you can just about pull everything from a drive even though its been burned to crisp, sawed in half and overwritten 7 times with random numbers.

Thu Jan 02, 2003 10:06 am

Evidence Eliminator - for the truly paranoid.

Thu Jan 02, 2003 10:10 am

mac_h8r1 wrote:
Every hard drive manufacturer out there will advise agains low-level formatting due to the fact that it can render the drive USELESS. They low-level format back at the factory.

If you delete an existing partition and add a new one, then full format the drive, the old data will be IMPOSSIBLE to recover.

Lowlev format is unnecessary and for the most part stupid. Fdisk and format is enough.

Just so you know, the "low level format" the manufacturers' disk utilities do is nothing more than writing zeroes to the drive and then scanning for new bad sectors. It's impossible to do a "true" low level format on any modern IDE drive.

Niteslayer · Thu Jan 02, 2003 10:10 am

Just as a note of reference; any and all data ever written on a hard drive is recoverable today. I spoke recently to an engineer at work whos specialty is disk platter coatings. The drive manufactures have utilities that enable them to recover any data that was ever written onto a hard disk platter provided that the platter hasn't been damaged phisicaly in any way (scratched from a head crash or warped from dropping it). This is why government agency's and banks purchase any and all disk enclosures that contain any sensitive data, when they are to be removed form thier systems, and physicaly destroy the platters. The data recovery is a costly and time consuming process but it can be done. I personaly had to send an HDA (head disk assm.) back once for data recovery. It took two months to get the data back. When it did come back (on tape media) to the costomer. It amounted to about 20 times the amount the origonal drive would have been able to hold.

Thu Jan 02, 2003 10:31 am

This is all new to me, but wow, I had no idea they could do that....I don't think that JimiH should be conceerned that the next user will go that far to figure out what used to be there.

**From now on, I keep an M80 in between my hard drives, just in case the feds show up at my door!!!

dolemitecomputers · Thu Jan 02, 2003 11:15 am

I think storagereview has a good article about the low level format. It was done on older drives in order to get the tracks on the drive to align correctly. I guess with older actuator arms the tracks would move to where the data was read/written to the most so you would have to do this every so often. If you want to remove all reference to data you normally use a zero write utility.

BigGeek · Thu Jan 02, 2003 11:31 am

Were I work we use Auto Clave's Disk away. The program writes to every sector of the hard drive up to I think 50 times. I don't think even the NSA could then see what files you had on the disk.

Aphasia · Thu Jan 02, 2003 12:31 pm

It can be done.... with electron microscope... checking individual molecular traces from the magnetic charge. Time consuming and VERY expensive. And pretty hard to make sense of if its been overwritten 50 times. Depends how it was overwritten though.

spike · Thu Jan 02, 2003 1:11 pm

NO I think I’ve read it in PC WORLD that they can only recover data if it has been overwritten up to 7 or 8 times after that it virtually impossible. I will try to find the article for you.

JimiH · Thu Jan 02, 2003 2:45 pm

Wow, and I thought this would be a simple thing! Thanks all, verrry interesting! You guys are furthering my pc education whole lot faster than any degree program at some fancy school could. I only hope to someday to be able to get to a point where I can make significant contributions to these forums.

Razzmatazz · Thu Jan 02, 2003 2:49 pm

Wow, not a single person came up with "soap and water" or some such. :wink:

I am impressed.

Ragnar Dan · Thu Jan 02, 2003 4:14 pm

If I understand some of the posts here correctly, they are saying that a drive with say 10 GB of data, which is 80 Gb of data, plus the error correction stuff, can somehow be completely wiped with 0's and 1's and still hold evidence of past data on it? I'd like to know how.

Unless there's some way for one writing to move up a chain of "past writes" after being overwritten, and be recoverable by specialized means, I can't see how this is true. Even then I don't see how new writes wouldn't just reverse the past writes' changes to things which aren't read by the heads, like the spaces between tracks.

If it were me and I was concerned about such things, I'd just download the free PGP install and use it from the new machine's drive to wipe the entire old drive a few times. (Maybe 9-10 times according to what some are saying here.)

Really, though, I'm fairly concerned about government intrusions, but even I'm not that paranoid.

Thu Jan 02, 2003 7:04 pm

Easy "low level format": get some linux boot CD/disk/whatever. Then just do "cat /dev/zero > /dev/hda" (presuming said drive is primary master). Wait a (big) while for it to finish, and you've got yourself a squeaky-clean drive.

Freon · Thu Jan 02, 2003 8:06 pm

There are a few shareware/freeware apps out there that will do DOD wipes, which overwrites each sector multiple times. I forgot what the exact number is, but it is something like 8.

That is mainly for the paranoid. A normal format should do you fine. fdisk /mbr, the format c:, just don't use /q. Or boot off your choice OS install CD, let it go up to the format part, then cancel (or continue install for that matter).

sativa · Thu Jan 02, 2003 8:14 pm

3 words: high powered magnet.

Thu Jan 02, 2003 9:06 pm

Dan:

I think that a low-level format would have worked on an old hard disk, the ones that were coated with ultrafine iron oxide [super rust], because on those drives, the bits were like little bar magnets that would align themselves to the current of the write head.

The new drives use MagnetoResistive or Giant MagnetoResistive read/write heads that use a quantum mechanical process to change an element of the electron fields [can't remember which one, probably magnetic spin] of molecular domains. The reason that data can be back-tracked so well is because the heads don't modify a precise number of molecules per domain [one domain=1bit], so it is possible to see some remains of data placement. Using electron microscopes to pick these tracks up and advanced checksum algorithms, the data can be put together again.

hope you never need these

Aphasia · Thu Jan 02, 2003 9:11 pm

NO I think I’ve read it in PC WORLD that they can only recover data if it has been overwritten up to 7 or 8 times after that it virtually impossible. I will try to find the article for you

No need... it isnt really that important, ok, maybe not 50 times. But ill bet you could recover it after quite a few more times with it being overwritten by only zeroes as compared to a cross random pattern of both ones and zeroes.

Unless there's some way for one writing to move up a chain of "past writes" after being overwritten, and be recoverable by specialized means, I can't see how this is true

Its isnt rocket science, just pretty advanced physics regarding elecromagnetism(i think?). Ill bet a relative of mine could answer you correctly, he is a doctor in theoretical physics and doctored by inventing a new magnetoresistive head that was more sensitive then what is in their normal measuring equipment. Its some kind of special cross reading head with double reading heads/coils at intersecting angles(Or something like that).

Anyway, a harddrive's plates aint by no means a perfect binary medium showing 1's or 0's. But showing something very close to 1 or 0. The heads dont register anything below a certain threshold, but that doesnt mean it isnt there, and can be read by something more sensitive, like an electron microscope that can see individual molecules. And residue charges that isnt seeable by a normal GMT(Giant Magnetoresistive) head is there.

IIRC it was something along these lines, although it was years since i read any physics so feel free to correct me if you find any holes. But its something along these lines.

Thu Jan 02, 2003 9:39 pm

finally found the link....did a report on this a few years back, surprised that the sucker is still there. And whaddya know, now they're working on CMR, Colossal MagnetoResistive heads....just wait, a 200GB MicroDrive

http://www.pcguide.com/ref/hdd/op/heads/tech_GMR.htm

Lao Tze · Thu Jan 02, 2003 10:08 pm

For the truly paranoid:
http://www.datadocktorn.nu/us_frag1.php

Alex · Thu Jan 02, 2003 11:01 pm

Lao Tze wrote:
For the truly paranoid:
http://www.datadocktorn.nu/us_frag1.php

A bit "overboard," wouldn't you say....

TR Forums

How do you "scrub" a hard drive?

How do you "scrub" a hard drive?

Who is online