Radified Community Forums | |
http://radified.com/cgi-bin/yabb2/YaBB.pl
Rad Community Technical Discussion Boards (Computer Hardware + PC Software) >> PC Hardware + Software (except Cloning programs) >> Partition Recovery Utility and HDD Wiping http://radified.com/cgi-bin/yabb2/YaBB.pl?num=1290795772 Message started by NightOwl on Nov 26th, 2010 at 12:22pm |
Title: Partition Recovery Utility and HDD Wiping Post by NightOwl on Nov 26th, 2010 at 12:22pm
To All
I responded to this thread here: Reply # 12 . I was doing a search on *IBMwipe* and ended up here: The Hard Disk (IBM) Wipe and Zap Utilities Page . This page refers to TheStarman's *Zap63* utility. I have stated any number of times in other threads that zeroing out the first 63 sectors of a HDD will make it appear as a *Factory Fresh* HDD. But, read on and see that my statement may be somewhat less than accurate--at least as far as using a tool to recover a lost partition table. I noticed another utility on TheStarman's Tools and References for the MBR and OS Boot Records webpage--TestDisk (Partition Recovery) Utility . Now, that looks like a handy utility to have around in case of a problem with loss of one's partition table for some reason. But, also on that page above, there's a link to TheStarman's Wipe Page--How To Permanently Erase Data from a Hard Disk. Looking down a ways on that page there is this statement: Why else would you want to Wipe a Drive? Quote:
Putting the above statement together with the TestDisk (Partition Recovery) Utility mentioned above, it would appear to be a good idea to zero the entire HDD, if it's been used with an extended partition in the past, to help use a partition recovery tool in the future! But, here's the million dollar question--if you are using a image file from whatever imaging software you might be using--does restoring the image to the *zeroed* HDD bring back any previous EBRs that may have been leftover from previous partition manipulations on the HDD? I can understand why the EBRs are left behind--they give you a chance to recover your HDD from a mistake like deleting a partition. But, if those are never cleared away, and you use image backups for restoring your system--I'm guessing that you will still have leftover EBRs! Probably the only way to truly *start over* is if you do not use restored images (unless it's the image of the HDD before you do any other manipulations to an extended partition and logical drives within), wipe/erase the entire HDD, and then do a *fresh* OS install! |
Title: Re: Partiton Recovery Utility and HDD Wiping Post by OldCasper on Nov 27th, 2010 at 3:36pm
Hmmm!
Doesn't anyone use DOS any more? FDISK will wipe out old partitions and make new ones on any HD. Then the DOS Format program will write to every sector on the HD's surface, thus verifying it and erasing anything that may have ever been written there. It's just a question..... |
Title: Re: Partition Recovery Utility and HDD Wiping Post by NightOwl on Nov 27th, 2010 at 3:58pm
@ OldCasper
Quote:
So, no issues with the larger HDDs these days--no 60 GB limit, or 127 GB or .....other size limitations? |
Title: Re: Partition Recovery Utility and HDD Wiping Post by MrMagoo on Nov 28th, 2010 at 3:49pm NightOwl wrote on Nov 27th, 2010 at 3:58pm:
Also, I think the DOS version of FDISK has issues w/ NTFS. Not that it matters when you just want to erase a drive, but it does make it a less versatile tool these days. Linux has a version of FDISK that will read large drives and can work with most of the existing formats, for those that really like command line tools. You can run it off most live CD's. Also, if your aim is to erase the data to prepare the drive for the next phase of its life, this has been a great thread. For anyone making their way to this thread that is *disposing* of a drive, note that it isn't unreasonalby hard to recover the data on a drive even after the partition information is destroyed. To securely erase a drive so that the data cannot be recovered, consider these tools: http://www.dban.org/ http://eraser.heidi.ie/ You should securely erase a drive before disposing of it to prevent determined individuals from recovering your personal data. |
Title: Re: Partition Recovery Utility and HDD Wiping Post by Dan Goodell on Nov 28th, 2010 at 9:45pm OldCasper wrote on Nov 27th, 2010 at 3:36pm:
Just to elucidate, using fdisk to delete a partition does not delete the partition, it merely removes its descriptor from the partition table. The partition itself is left completely intact, and can trivially be resurrected. Using fdisk to create a new partition also does not destroy old data or boot sectors within the new partition's area. However, formatting the new partition might. Note that in DOS, partitioning and formatting are two separate steps. In Windows, they are done at the same time. Using a short format from DOS (or a quick format from Windows) will write a new partition boot sector and new FATs, but will not touch other parts of the partition. If the new partition overlaps prior partitions, old data or boot sectors can be left untouched. A long format from DOS is like a short format, except it additionally writes zeroes to all sectors in the new partition's data area. That will overwrite any data or boot sectors that may have been leftover from before. Once a sector has been overwritten, it's highly unlikely any of us could recover the previous contents. That doesn't apply to the NSA, CIA, or highly skilled hackers or technicians, though, so if you want to make sure it's unrecoverable, see MrMagoo's advice. |
Title: Re: Partition Recovery Utility and HDD Wiping Post by NightOwl on Nov 29th, 2010 at 11:17am
@ OldCasper
Quote:
Most of the HDD manufacturers make DOS based test utilities to check a HDD's health--and I have now noted that most of those appear to have a *wipe* function as well--for example SeaGate's SeaTools and the Hitachi's Drive Fitness Tool (DFT). I know that the Hitachi DFT is drive brand specific for the *wipe* function--only Hitachi/IBM HDDs can be wiped with it. Can's say for SeaTools. |
Title: Re: Partition Recovery Utility and HDD Wiping Post by MudCrab on Nov 30th, 2010 at 11:45am NightOwl wrote on Nov 26th, 2010 at 12:22pm:
Most imaging programs just back up the used sectors (by default). If you restore this type of image to a drive and a sector with existing data isn't written to, its data will be retained. If you create a backup that includes all sectors on the drive/partition, then any existing "old" unused sectors in the backup will also be restored when all sectors are written. I suppose you could use a wipe utility that just wipes unused space. This would clear any old data and allow any type of backup to contain only the new/current data. |
Title: Re: Partition Recovery Utility and HDD Wiping Post by NightOwl on Dec 1st, 2010 at 12:12am
@ MudCrab
Quote:
Understood--but, my question is--are there old discarded EBRs that are retained in the *data* part of partitions that are saved to your image files--so when the file is restored--are those old discarded EBRs brought back into the partitions--and can then cause problems with a partition recovery program? I just don't know how imaging programs handle all that *record keeping* in the background--and I'm not sure how partitioning and formatting programs handle EBRs as changes are made over time! |
Title: Re: Partition Recovery Utility and HDD Wiping Post by OldCasper on Dec 1st, 2010 at 7:17am NightOwl wrote on Nov 27th, 2010 at 3:58pm:
Ah, an interrogative! The last HD I set up using my ME Utilities floppy disk, was a WD 500 gig SATA II drive. I set up C: to about 50 gig and let FDISK put the remainder into a second partition. That worked fine. Then I DOS formatted C:, again no problem. Then I DOS formatted D:. The only problem there, is that the DOS Format program doesn't have enough digits set aside for the drive size, so the size is mis-represented on the screen. But if I just ignore that and let the format routine do its thing, it will format the drive right out to the end. It's going to take a while, so I just let it run till it's done. I know that none of the new OS's (Vista or Win-7) will install to the C: partition formatted FAT-32, but that's OK. It's not hard to get that first part. reset to NTFS. In the mean time, I've totally verified the surface of the disk, which an NTFS format will NOT do. Other programs that can partition and format a HD also DO NOT verify the surface of the HD. Hey, I'm not OLD Casper for nothing! I began developing my methods of handling hard drives way back in the MFM and RLL days. Setting up a HD should never be rushed. As has been said many times in many languages, "The Devil is in the details". Something else, that I have used on occasion, is a Low-Level-Format program. The naysayers will say it won't work, but I use it very effectively. It puts a HD back to factory condition, with any questionable sectors blocked out and put in the Bad-Sector list. I'm not trying to make any converts here, just reminiscing a little. ;) Happy Holidays Everyone! Old Casper |
Title: Re: Partition Recovery Utility and HDD Wiping Post by MudCrab on Dec 1st, 2010 at 10:34am NightOwl wrote on Dec 1st, 2010 at 12:12am:
When an image is created in "used sector" mode, it should only include the sectors that are in the "current" file systems. As such, these sectors should contain "current" data (no old EBR data). When restored to a wiped drive, there shouldn't be any old EBR data on that drive after the restore. When restored to an unwiped drive, any sector that is not overwritten is retained. Some of these may included old EBR data. This old data would be from the "new" drive and not the image. When you restore a sector-by-sector image of a drive, all sectors are supposed to be restored (since all sectors were backed up). If the target drive is smaller than the source, the remaining space won't be overwritten and may contain old EBR data. The restored portion will retain any old EBR data that exsited on the source drive. Please note that I have not run tests on this. I'm just going from experience with how imaging and partitioning works. I have run into this problem when doing partition recovery operations. Sometimes it can take several attempts to get the correct partition. Sometimes you need to delete the "incorrect/old" partition data (wipe it) before you can find the correct one. Anytime you run a recovery scan and find overlapping partitions, usually only one of them is current. For what it's worth, I have previously recovered an old partition intact that somehow survived on a test drive through many partition creation/deletion actions (which encompassed it) as well as data being copied to the various test partitions. Paul |
Title: Re: Partition Recovery Utility and HDD Wiping Post by NightOwl on Dec 1st, 2010 at 1:00pm
@ OldCasper
Quote:
No program name, no references, no links = un-usable, unsubstantiated claim(s) (aka--blowing hot air up one's you know what!)! From Seagate's Knowledge Base: How Do I Low-Level Format a SATA or ATA (IDE) Hard Drive? [203931] Quote:
Too bad Seagate doesn't just come out and say that user *low level formatting* does not exist on current new HDDs (since late 1980's or early 1990's!)--only the factory does LLF. Many programs incorrectly use the term *Low Level Formatting* (LLF), when what they really do is a *Zero Fill Write/Read* of the entire disk surface. Here's a Wikipedia entry: Disk formatting Quote:
From PC Guide: Low-Level Formatting Quote:
Here's a list of various HDD utilities with this info: Low level format utilities for the hard disk Quote:
|
Radified Community Forums » Powered by YaBB 2.4! YaBB © 2000-2009. All Rights Reserved. |