Welcome, Guest. Please Login
 
  HomeHelpSearchLogin FAQ Radified Ghost.Classic Ghost.New Bootable CD Blog  
 
Page Index Toggle Pages: 1
Send Topic Print
Partition Recovery Utility and HDD Wiping (Read 7084 times)
NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5801
Olympia, WA--Puget Sound--USA


Back to top
Partition Recovery Utility and HDD Wiping
Nov 26th, 2010 at 12:22pm
 
To All

I responded to this thread here:  Reply # 12 .

I was doing a search on *IBMwipe* and ended up here:  The Hard Disk (IBM) Wipe and Zap Utilities Page .  This page refers to TheStarman's *Zap63* utility.

I have stated any number of times in other threads that zeroing out the first 63 sectors of a HDD will make it appear as a *Factory Fresh* HDD.  But, read on and see that my statement may be somewhat less than accurate--at least as far as using a tool to recover a lost partition table.

I noticed another utility on TheStarman's Tools and References for the MBR and OS Boot Records webpage--TestDisk (Partition Recovery) Utility .  Now, that looks like a handy utility to have around in case of a problem with loss of one's partition table for some reason.

But, also on that page above, there's a link to TheStarman's Wipe Page--How To Permanently Erase Data from a Hard Disk.

Looking down a ways on that page there is this statement:  Why else would you want to Wipe a Drive?

Quote:
2) Whenever you decide to "start all over again" and reformat a drive, it's a very good idea to make sure there are no left over partition data structures (EBRs) just in case you need to run a data recovery program at some time in the future. If you've never had any Extended Partitions on the drive, you can forget about this. Problems for data recovery occur only when there are EBR sectors and Boot Records that were never deleted (zeroed-out) before a new Extended partition (with one or more logical drives) was created. Then if you try to get your data back after accidentally deleting a partition or the MBR, you (or a recovery program) might have a difficult time deciding which EBR sectors were used last! By 'zeroing-out' a disk that has had many Extended partitions created on it, you ensure data recovery programs will see ONLY the correct size of the partitions you are about to create.

Putting the above statement together with the TestDisk (Partition Recovery) Utility mentioned above, it would appear to be a good idea to zero the entire HDD, if it's been used with an extended partition in the past, to help use a partition recovery tool in the future!

But, here's the million dollar question--if you are using a image file from whatever imaging software you might be using--does restoring the image to the *zeroed* HDD bring back any previous EBRs that may have been leftover from previous partition manipulations on the HDD?

I can understand why the EBRs are left behind--they give you a chance to recover your HDD from a mistake like deleting a partition.  But, if those are never cleared away, and you use image backups for restoring your system--I'm guessing that you will still have leftover EBRs!

Probably the only way to truly *start over* is if you do not use restored images (unless it's the image of the HDD before you do any other manipulations to an extended partition and logical drives within), wipe/erase the entire HDD, and then do a *fresh* OS install!
 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 

OldCasper
Radmeister
**
Offline


I Love Ghost!

Posts: 92
Florida, USA


Back to top
Re: Partiton Recovery Utility and HDD Wiping
Reply #1 - Nov 27th, 2010 at 3:36pm
 
Hmmm!
Doesn't anyone use DOS any more?

FDISK will wipe out old partitions and make new ones on any HD.  Then the DOS Format program will write to every sector on the HD's surface, thus verifying it and erasing anything that may have ever been written there.

It's just a question.....
 

A man with experience is never at the mercy of a man with an argument.
 
IP Logged
 
NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5801
Olympia, WA--Puget Sound--USA


Back to top
Re: Partition Recovery Utility and HDD Wiping
Reply #2 - Nov 27th, 2010 at 3:58pm
 
@
OldCasper

Quote:
FDISK will wipe out old partitions and make new ones on any HD.

So, no issues with the larger HDDs these days--no 60 GB limit, or 127 GB or .....other size limitations?
 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 
MrMagoo
Übermensch
*****
Offline


Resident Linux Guru

Posts: 1026
Phoenix, AZ (USA)


Back to top
Re: Partition Recovery Utility and HDD Wiping
Reply #3 - Nov 28th, 2010 at 3:49pm
 
NightOwl wrote on Nov 27th, 2010 at 3:58pm:
So, no issues with the larger HDDs these days--no 60 GB limit, or 127 GB or .....other size limitations? 

Also, I think the DOS version of FDISK has issues w/ NTFS.  Not that it matters when you just want to erase a drive, but it does make it a less versatile tool these days.

Linux has a version of FDISK that will read large drives and can work with most of the existing formats, for those that really like command line tools.  You can run it off most live CD's.

Also, if your aim is to erase the data to prepare the drive for the next phase of its life, this has been a great thread.  For anyone making their way to this thread that is *disposing* of a drive, note that it isn't unreasonalby hard to recover the data on a drive even after the partition information is destroyed.  To securely erase a drive so that the data cannot be recovered, consider these tools:

http://www.dban.org/
http://eraser.heidi.ie/

You should securely erase a drive before disposing of it to prevent determined individuals from recovering your personal data.
 
WWW  
IP Logged
 
Dan Goodell
Special Guest
*****
Offline



Posts: 552
N California


Back to top
Re: Partition Recovery Utility and HDD Wiping
Reply #4 - Nov 28th, 2010 at 9:45pm
 
OldCasper wrote on Nov 27th, 2010 at 3:36pm:
FDISK will wipe out old partitions and make new ones on any HD.Then the DOS Format program will write to every sector on the HD's surface, thus verifying it and erasing anything that may have ever been written there.

Just to elucidate, using fdisk to delete a partition does not delete the partition, it merely removes its descriptor from the partition table.  The partition itself is left completely intact, and can trivially be resurrected.

Using fdisk to create a new partition also does not destroy old data or boot sectors within the new partition's area.  However, formatting the new partition might.  Note that in DOS, partitioning and formatting are two separate steps.  In Windows, they are done at the same time.

Using a short format from DOS (or a quick format from Windows) will write a new partition boot sector and new FATs, but will not touch other parts of the partition.  If the new partition overlaps prior partitions, old data or boot sectors can be left untouched.

A long format from DOS is like a short format, except it additionally writes zeroes to all sectors in the new partition's data area.  That will overwrite any data or boot sectors that may have been leftover from before.

Once a sector has been overwritten, it's highly unlikely any of us could recover the previous contents.  That doesn't apply to the NSA, CIA, or highly skilled hackers or technicians, though, so if you want to make sure it's unrecoverable, see MrMagoo's advice.




 
 
IP Logged
 
NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5801
Olympia, WA--Puget Sound--USA


Back to top
Re: Partition Recovery Utility and HDD Wiping
Reply #5 - Nov 29th, 2010 at 11:17am
 
@
OldCasper

Quote:
Doesn't anyone use DOS any more?

Most of the HDD manufacturers make DOS based test utilities to check a HDD's health--and I have now noted that most of those appear to have a *wipe* function as well--for example SeaGate's SeaTools and the Hitachi's Drive Fitness Tool (DFT).

I know that the Hitachi DFT is drive brand specific for the *wipe* function--only Hitachi/IBM HDDs can be wiped with it.  Can's say for SeaTools.

 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 

MudCrab
Dude
*
Offline



Posts: 19
California


Back to top
Re: Partition Recovery Utility and HDD Wiping
Reply #6 - Nov 30th, 2010 at 11:45am
 
NightOwl wrote on Nov 26th, 2010 at 12:22pm:
But, here's the million dollar question--if you are using a image file from whatever imaging software you might be using--does restoring the image to the *zeroed* HDD bring back any previous EBRs that may have been leftover from previous partition manipulations on the HDD?

Most imaging programs just back up the used sectors (by default). If you restore this type of image to a drive and a sector with existing data isn't written to, its data will be retained.

If you create a backup that includes all sectors on the drive/partition, then any existing "old" unused sectors in the backup will also be restored when all sectors are written.

I suppose you could use a wipe utility that just wipes unused space. This would clear any old data and allow any type of backup to contain only the new/current data.
 
 
IP Logged
 
NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5801
Olympia, WA--Puget Sound--USA


Back to top
Re: Partition Recovery Utility and HDD Wiping
Reply #7 - Dec 1st, 2010 at 12:12am
 
@
MudCrab

Quote:
Most imaging programs just back up the used sectors (by default). If you restore this type of image to a drive and a sector with existing data isn't written to, its data will be retained.

Understood--but, my question is--are there old discarded EBRs that are retained in the *data* part of partitions that are saved to your image files--so when the file is restored--are those old discarded EBRs brought back into the partitions--and can then cause problems with a partition recovery program?

I just don't know how imaging programs handle all that *record keeping* in the background--and I'm not sure how partitioning and formatting programs handle EBRs as changes are made over time!
 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 
OldCasper
Radmeister
**
Offline


I Love Ghost!

Posts: 92
Florida, USA


Back to top
Re: Partition Recovery Utility and HDD Wiping
Reply #8 - Dec 1st, 2010 at 7:17am
 
NightOwl wrote on Nov 27th, 2010 at 3:58pm:
@
OldCasper

Quote:
FDISK will wipe out old partitions and make new ones on any HD.

So, no issues with the larger HDDs these days--no 60 GB limit, or 127 GB or .....other size limitations?


Ah, an interrogative!
The last HD I set up using my ME Utilities floppy disk, was a WD 500 gig SATA II drive.
I set up C: to about 50 gig and let FDISK put the remainder into a second partition.  That worked fine.
Then I DOS formatted C:, again no problem.  Then I DOS formatted D:.  The only problem there, is that the DOS Format program doesn't have enough digits set aside for the drive size, so the size is mis-represented on the screen.  But if I just ignore that and let the format routine do its thing, it will format the drive right out to the end.  It's going to take a while, so I just let it run till it's done.

I know that none of the new OS's (Vista or Win-7) will install to the C: partition formatted FAT-32, but that's OK.  It's not hard to get that first part. reset to NTFS.

In the mean time, I've totally verified the surface of the disk, which an NTFS format will NOT do.  Other programs that can partition and format a HD also DO NOT verify the surface of the HD.

Hey, I'm not OLD Casper for nothing!  I began developing  my methods of handling hard drives way back in the MFM and RLL days.  Setting up a HD should never be rushed.
As has been said many times in many languages, "The Devil is in the details".

Something else, that I have used on occasion, is a Low-Level-Format program.  The naysayers will say it won't work, but I use it very effectively.  It puts a HD back to factory condition, with any questionable sectors blocked out and put in the Bad-Sector list.  I'm not trying to make any converts here, just reminiscing a little. Wink

Happy Holidays Everyone!
Old Casper
 

A man with experience is never at the mercy of a man with an argument.
 
IP Logged
 
MudCrab
Dude
*
Offline



Posts: 19
California


Back to top
Re: Partition Recovery Utility and HDD Wiping
Reply #9 - Dec 1st, 2010 at 10:34am
 
NightOwl wrote on Dec 1st, 2010 at 12:12am:
Understood--but, my question is--are there old discarded EBRs that are retained in the *data* part of partitions that are saved to your image files--so when the file is restored--are those old discarded EBRs brought back into the partitions--and can then cause problems with a partition recovery program?

When an image is created in "used sector" mode, it should only include the sectors that are in the "current" file systems. As such, these sectors should contain "current" data (no old EBR data). When restored to a wiped drive, there shouldn't be any old EBR data on that drive after the restore. When restored to an unwiped drive, any sector that is not overwritten is retained. Some of these may included old EBR data. This old data would be from the "new" drive and not the image.

When you restore a sector-by-sector image of a drive, all sectors are supposed to be restored (since all sectors were backed up).  If the target drive is smaller than the source, the remaining space won't be overwritten and may contain old EBR data. The restored portion will retain any old EBR data that exsited on the source drive.

Please note that I have not run tests on this. I'm just going from experience with how imaging and partitioning works.

I have run into this problem when doing partition recovery operations. Sometimes it can take several attempts to get the correct partition. Sometimes you need to delete the "incorrect/old" partition data (wipe it) before you can find the correct one. Anytime you run a recovery scan and find overlapping partitions, usually only one of them is current.

For what it's worth, I have previously recovered an old partition intact that somehow survived on a test drive through many partition creation/deletion actions (which encompassed it) as well as data being copied to the various test partitions.

Paul
 
 
IP Logged
 
NightOwl
Radministrator
*****
Offline


"I tought I saw a puddy
tat..."

Posts: 5801
Olympia, WA--Puget Sound--USA


Back to top
Re: Partition Recovery Utility and HDD Wiping
Reply #10 - Dec 1st, 2010 at 1:00pm
 
@
OldCasper

Quote:
Something else, that I have used on occasion, is a Low-Level-Format program.  The naysayers will say it won't work, but I use it very effectively.  It puts a HD back to factory condition, with any questionable sectors blocked out and put in the Bad-Sector list.  I'm not trying to make any converts here, just reminiscing a little

No program name, no references, no links = un-usable, unsubstantiated claim(s) (aka--blowing hot air up one's you know what!)!

From Seagate's Knowledge Base:  How Do I Low-Level Format a SATA or ATA (IDE) Hard Drive? [203931]

Quote:
What does "low level formatting" a SATA or ATA (IDE) drive mean?

Actually the term "low level" is a bit of a misnomer. The low-level process first used years ago in MFM hard drives bears little resemblance to what we now call a "low-level format" for today's SATA and ATA (IDE) drives. The only safe method of initializing all the data on a Seagate device is the Zero Fill erase option in SeaTools for DOS. This is a simple process of writing all zeros (0's) to the entire hard disk drive.

Why would I want to Zero Fill my drive?

The most common reasons to Zero Fill a SATA or ATA (IDE) hard drive are:

to remove a virus that cannot be removed without destroying the boot sector.
to change from one operating system to another and wish to remove everything from the drive.
to erase confidential information for privacy reasons.
to scan for bad sectors that can be detected and replaced with good spare sectors when writing to the sectors.

Too bad Seagate doesn't just come out and say that user *low level formatting* does not exist on current new HDDs (since late 1980's or early 1990's!)--only the factory does LLF.  Many programs incorrectly use the term *Low Level Formatting* (LLF), when what they really do is a *Zero Fill Write/Read* of the entire disk surface.

Here's a Wikipedia entry:  Disk formatting

Quote:
Low-level formatting (LLF) of hard disks

Low-level format of a 10-megabyte IBM PC XT hard drive.Hard disk drives prior to the 1990s typically had a separate disk controller that defined how data was encoded on the media. With the media, the drive and/or the controller possibly procured from separate vendors, low level formatting was a potential user activity. Separate procurement also had the potential of incompatibility between the separate components such that the subsystem would not reliably store data.

User instigated low-level formatting (LLF) of hard disk drives was common for minicomputer and personal computer systems until the 1990s. IBM and other mainframe system vendors typically supplied their hard disk drives (or media in the case of removable media HDDs) with a low-level format. Typically this involved subdividing each track on the disk into one or more blocks which would contain the user data and associated control information. Different computers used different block sizes and IBM notably used variable block sizes but the popularity of the IBM PC caused the industry to adopt a standard of 512 user data bytes per block by the middle 1980s.

Depending upon the system, low-level formatting was generally done by an operating system system utility. IBM compatible PCs used the BIOS which is involved using the MS-DOS debug program to transfer control to a routine hidden at different addresses in different BIOSs.  Low-level format function can also be called as "erase" or "wipe" in different tools. For best results it's highly recommended to use tools created by hard disk's manufacturer.

Transition away from LLF

Starting in the late 1980s, driven by the volume of IBM compatible PCs, HDDs became routinely available pre-formatted with a compatible low-level format. At the same time, the industry moved from historical (dumb) bit serial interfaces to modern (intelligent) bit serial interfaces and Word serial interfaces wherein the low level format was performed at the factory.

Today, an end-user, in most cases, should never perform a low-level formatting of an IDE or ATA hard drive, and in fact it is often not possible to do so on modern hard drives outside of the factory.


From PC Guide:  Low-Level Formatting

Quote:
Newer disks use many complex internal structures, including zoned bit recording to put more sectors on the outer tracks than the inner ones, and embedded servo data to control the head actuator. They also transparently map out bad sectors. Due to this complexity, all modern hard disks are low-level formatted at the factory for the life of the drive. There's no way for the PC to do an LLF on a modern IDE/ATA or SCSI hard disk, and there's no reason to try to do so.



Here's a list of various HDD utilities with this info:  Low level format utilities for the hard disk

Quote:
Important drive information (servo, sector layout, and defect management, etc.) is stored in the low-level format at the factory. This information is designed to last the life of the drive and therefore it is not possible to low level the drive outside the factory. Although some drive manufactures and BIOS provided so-called "low level format utilities", they actually perform a write-read verify of the drive’s user data sectors, and do not actually perform a low-level format.

 

____________________________________________________________________________________________

No question is stupid ... but, possibly the answers are Wink !
 
IP Logged
 
Page Index Toggle Pages: 1
Send Topic Print