Boards.ie uses cookies. By continuing to browse this site you are agreeing to our use of cookies. Click here to find out more x
Post Reply  
 
 
Thread Tools Search this Thread
18-01-2012, 11:47   #16
Wicklowrider
Registered User
 
Join Date: Sep 2008
Posts: 982
Its a long time since I was involved in this level of support so please bear that in mind before flaming

Does this not still work?

http://www.computerhope.com/rdebug.htm#4


It was simple and free! Reduced any hdd to a physical piece of machinery and the computer couldn't see it until it was newly partitioned and formated
Wicklowrider is offline  
Advertisement
18-01-2012, 12:10   #17
LoLth
Verified Reprehensible
 
LoLth's Avatar
 
Join Date: Feb 1998
Location: little boxes.
Posts: 8,615
one pass is enough with modern hard drives.

http://www.anti-forensics.com/disk-w...pass-is-enough

so yes, a full format (not quick!) should do the trick.

alternatively, get an old PC, connect all the drives to it internally (take out the cd drive to connect up another, use an ide/sata to usb bridge to connect another etc. copy DBAN to a bootable USB (set up manually or maybe unetbootin has a dban option), boot from DBAN and nuke em all! single pass (non-military) wipe should do it.
LoLth is offline  
18-01-2012, 12:13   #18
BostonB
Registered User
 
Join Date: Dec 2006
Posts: 17,745
1 pass with DBAN is enough.
BostonB is offline  
18-01-2012, 13:35   #19
infodox
Registered User
 
Join Date: Dec 2011
Location: On a wet, windy rock in the atlantic.
Posts: 122
As an aside, good luck wiping USB keys. A person I know fairly well tells me that he had USB keys that had been wiped, formatted, and erased so much that they would no longer mount reliably, dating back as far as 2007 or so. Old, well abused and carefully erased devices. Yet one forensics officer with a copy of Encase was able to pull all kinds of **** from the drive, dating as far back as 2008 or so. This was recently as well.

I never feel one wipe is enough, having seen what Encase and a competent forensics person can do. Physical destruction of the drive to NOTHING is the only really secure way to erase data.

I do wonder though, if a person with a habit of using second hand hard drives had their drives seized, how are they meant to prove in court what data is theirs and what is the previous owners? One never knows what the previous owner had on their drives... And a 120gb drive with about 40gb of bad sectors from the previous owner gives one pause to think "what the hell were they doing to that machine?!"
infodox is offline  
18-01-2012, 13:58   #20
BostonB
Registered User
 
Join Date: Dec 2006
Posts: 17,745
Someone who says "wiped, formatted, and erased" doesn't know what they are doing. It was never wiped if they got something off it.

http://www.anti-forensics.com/disk-w...th-screenshots

http://www.anti-forensics.com/disk-w...pass-is-enough

Last edited by BostonB; 18-01-2012 at 14:04.
BostonB is offline  
Advertisement
18-01-2012, 15:16   #21
the_syco
Registered User
 
the_syco's Avatar
 
Join Date: Jun 2001
Location: Leixlip
Posts: 26,340
Quote:
Originally Posted by Damo2k View Post
If its Windows Vista/ 7, full format most likely will do.
I've done a full format, reinstalled Windows ono it, and then found out that I need to get a file from the old OS. With tools on the market, I was able to get teh document back.

I second DBAN.

Quote:
Originally Posted by Random View Post
what programs are you guys using to wipe hard drives these days?
what did you use the HDD for? Business or personal? Who are you selling the HDD to (friends, family, who)?
the_syco is offline  
18-01-2012, 15:24   #22
BostonB
Registered User
 
Join Date: Dec 2006
Posts: 17,745
Quote:
Originally Posted by the_syco View Post
I've done a full format, reinstalled Windows ono it, and then found out that I need to get a file from the old OS. With tools on the market, I was able to get teh document back.

I second DBAN....

This might explain why...

Quote:
Contrary to popular belief, doing a full format with Windows 7 only over-writes the old disk format configuration data (the MBR) with the new and checks for sector errors, then marks the remaining space to be over-written as needed, it does not over-write (remove) any other data at all, it's all still there including code from previous Operating Systems and all of the old personal data.
http://www.sevenforums.com/tutorials...n-methods.html
BostonB is offline  
18-01-2012, 15:28   #23
tommy.obr
Registered User
 
Join Date: Oct 2008
Posts: 36
Pop them in the microwave, about two minutes on full heat should do the job. The microwave might'nt be in great shape after it though..
tommy.obr is offline  
18-01-2012, 15:35   #24
BostonB
Registered User
 
Join Date: Dec 2006
Posts: 17,745
Yes metal in a microwave not so clever.
BostonB is offline  
Advertisement
18-01-2012, 15:43   #25
Damo2k
Registered User
 
Damo2k's Avatar
 
Join Date: Sep 2006
Location: Ireland
Posts: 2,003
Quote:
Originally Posted by BostonB View Post
The windows support page might be incorrect so, as it says it writes 0's to entire drive:
http://support.microsoft.com/kb/941961/en-us
Damo2k is offline  
18-01-2012, 16:00   #26
LoLth
Verified Reprehensible
 
LoLth's Avatar
 
Join Date: Feb 1998
Location: little boxes.
Posts: 8,615
isnt the "quick format" an overwrite of the MBR and set overwrite flag on the contents of any existing MFT while a "full format" is a proper wipe of every sector which is why it takes so much longer?

For raid arrays, a full initialisation is a full write of zeroes.

for USB keys, there was a whitepaper released on SSD and Flash storage, I think the result was up to 85% of data was recoverable even after a "secure" wipe that would have destroyed all data on a standard HDD.

link to tomshardware article:
http://www.tomshardware.com/news/sol...ion,12252.html

link to the whitepaper:
http://www.usenix.org/events/fast11/...papers/Wei.pdf
LoLth is offline  
Thanks from:
18-01-2012, 16:37   #27
BostonB
Registered User
 
Join Date: Dec 2006
Posts: 17,745
The devil is in the details. Assume nothing.

Just do a single wipe. Then you're not left wondering.

Microsoft, it depends which kind of format you do. For the love of mike...

Last edited by BostonB; 18-01-2012 at 16:45.
BostonB is offline  
18-01-2012, 18:34   #28
Solair
Closed Account
 
Join Date: May 2005
Posts: 7,073
Well this is one way of ensuring absolutely no risk of data theft!

Solair is offline  
19-01-2012, 10:18   #29
infodox
Registered User
 
Join Date: Dec 2011
Location: On a wet, windy rock in the atlantic.
Posts: 122
LoLth is correct - with USB keys and flash storage, the way their filesystem and memory actually functions means that standard wiping tricks fail miserably. They are designed to stop you from damaging the drive by read/write to fast, so they simply seem to "contain" your wiping in some way. I do not fully understand the theory behind it all, but in practice I know that EnCase + competent forensics guy does a bloody amazing job of file recovery!

I am sure some of the forensics guys at WIT can concur? A friend suggests the best way to wipe a USB drive is to fill it COMPLETELY with junk data, format, repeat. Or just take a lumphammer or blowtorch to it...

For securing from civilians/average people DBAN is fine. But if one REALLY has something to hide, PHYSICAL OBLITERATION of the drive is needed. Smashing, blowtorching and dissolving followed by filtration (remove any frags left intact) and burial / dumping over a large landmass.

Depends on your paranoia levels!

(of course, we all wish we had an epic hard drive shredding machine, don't we?)
infodox is offline  
19-01-2012, 11:54   #30
BostonB
Registered User
 
Join Date: Dec 2006
Posts: 17,745
Quote:
Originally Posted by infodox View Post
...they simply seem to "contain" your wiping in some way. I do not fully understand the theory behind it all,

...A friend suggests the best way to wipe a USB drive is to fill it COMPLETELY with junk data, format, repeat....

For securing from civilians/average people DBAN is fine....
Do you realise that's all one and the same thing. Overwriting all the disc. EnCase can't recover what isn't there.

Some one advocating formating is not credible IMO. Unless they are specific about what the formatting is doing.

Last edited by BostonB; 19-01-2012 at 11:56.
BostonB is offline  
Post Reply

Quick Reply
Message:
Remove Text Formatting
Bold
Italic
Underline

Insert Image
Wrap [QUOTE] tags around selected text
 
Decrease Size
Increase Size
Please sign up or log in to join the discussion

Thread Tools Search this Thread
Search this Thread:

Advanced Search



Share Tweet