Page 2 of 4 FirstFirst 1234 LastLast
Results 11 to 20 of 33

Thread: mbr and partition table recovery

  1. #11
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    Errrrrrrr?????????????

    I stand open to correction, but I am pretty sure that Windows Vista "formats" by overwriting with zeroes. Maybe that is what WolfeTone is referring to?
    Last edited by nihil; June 28th, 2007 at 08:18 PM.

  2. #12
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,401
    I have no idea how Vista does this. But all other Windows versions never did so I'm assuming it's still the same.
    Oliver's Law:
    Experience is something you don't get until just after you need it.

  3. #13
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    I guess that is why it kind of stuck in the back of my mind? I don't know if it ever got implemented though.............. quite a lot of things got dropped from the original "longhorn" model?


  4. #14
    Senior Member
    Join Date
    Aug 2006
    Location
    India
    Posts
    289
    WinFS was one thing which was too much in discussion while Vista BETA 1 rolled out. But I do not hear any fuss about WinFS. They dropped it. Many other things were dropped too I think.
    Last edited by jockey0109; October 14th, 2007 at 07:41 PM.
    "Everything should be made as simple as possible, but not simpler."

    - Albert Einstein

  5. #15
    Senior Member nihil's Avatar
    Join Date
    Jul 2003
    Location
    United Kingdom: Bridlington
    Posts
    17,188
    I am still pretty sure that the overwriting of the HDD with zeroes is still in there though?

    I would be interested to find out

  6. #16
    Junior Member
    Join Date
    Jun 2007
    Posts
    3
    Thanks for all the replies.
    I have managed to retrieve all the partitions and files. Almost.
    Last edited by reiserfs; June 29th, 2007 at 04:10 AM.

  7. #17
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,401
    Some files are probably a bit mangled. The standard newfs writes so-called superblocks all over the partition. This could damage the files/data that was on it.

    But, at least you managed to get some data back

    And if someone can point me to a MS knowledge base article that states that a format actually overwrites or nulls the data I'd be happy to apologize. Until then I stand by my statement.
    Oliver's Law:
    Experience is something you don't get until just after you need it.

  8. #18
    Right turn Clyde Nokia's Avatar
    Join Date
    Aug 2003
    Location
    Button Moon
    Posts
    1,696
    This is true when say, you are formatting a floppy disc using the FAT12 file system and when formatted within DOS.
    A high-level format carried out by a user will only mark all areas of a disc as available. If the format is done with a different file system than was previously on the hard drive then some of the data will be overwritten that may otherwise not have been had the file system been kept the same.

    Likewise if the partition sizes are altered more data may again be overwritten that would have been if the partitions had remained consistent.

    To answer the question like this you need to know hard drive was formatted (what application and with what commands) as some formatting utilities will either fill up the free space with zeros prior to formatting or will do it during the format.

  9. #19
    Senior Member WolfeTone's Avatar
    Join Date
    Jun 2007
    Location
    Ireland
    Posts
    197
    Just for reference, there are two types of formatting available.

    1) High-Level Formatting
    High-level formatting is the process of setting up an empty file system on the disk, and installing a boot sector. This alone takes little time, and is sometimes referred to as a "quick format".

    In addition, the entire disk may optionally be scanned for defects, which takes considerably longer, up to several hours on larger harddisks.
    2. Low-Level Formatting
    User instigated low-level formatting (LLF) of hard disks involves setting up the MFM pattern on the disk, so that sectors of bytes could be successfully written to it. With the advent of RLL encoding, low-level formatting grew increasingly uncommon, and most modern hard disks are embedded systems, which are low-level formatted at the factory with the physical geometry dimensions and thus not subject to user intervention.

    Low-level formatting of early hard disks was generally done by the BIOS rather than by the operating system. This process involved using the MS-DOS debug program to transfer control to a routine hidden at different addresses in different BIOSs.

    Rather than face ever-escalating difficulties with BIOS versioning, disk vendors started doing low-level formatting at the factory.
    Also note:

    Disk Reinitialization
    While it's impossible to perform an LLF on most modern hard drives outside the factory, the term "low-level format" is still being used for what should be called the reinitialization of an IDE or ATA hard drive to its factory configuration. Reinitialization should include identifying any sectors which cannot be written to and read back from the drive, correctly. The term has, however, been used by some to refer to only a portion of that process, in which every sector of the drive is written to; usually by writing a zero byte to every addressable location on the disk; sometimes called zero-filling.

    The present ambiguity in the term "low-level format" seems to be due to both inconsistent documentation on web sites and the belief by many users that any process below a "high-level (file system) format" must be called a low-level format. Instead of correcting this mistaken idea various drive manufacturers have actually described reinitialization software as LLF utilities on their web sites. Since users generally have no way to determine the difference between a true LLF and reinitialization (they simply observe running the software results in a hard disk that must be partitioned and "high-level formatted"), both the misinformed user and mixed signals from various drive manufacturers have perpetuated this error.

    One popular method for performing only the "zero-fill" operation on a hard disk is by writing zero-bytes to the drive using the Unix dd utility (available under Linux as well) with the "/dev/zero" stream as the input file (if=) and the drive itself (either the whole disk, or a specific partition) as the output file (of=).
    So although my initial answer was short, I was referring to:
    Data on a disk is not fully destroyed during a high-level format. Instead, the area on the disk containing the data is merely marked as available (in whatever file system structure the format uses), and retains the old data until it's overwritten.

    If the reformatting is done with a different file system than previously existed in the partition, some data may be overwritten that wouldn't be if the same file system had been used. However, under some file systems (e.g., NTFS; but not FAT), the file indexes (such as $MFTs under NTFS, "inodes" under ext2/3, etc.) may not be written to the same exact locations. And if the partition size is increased, even FAT file systems will overwrite more data at the beginning of that new partition.

    From the perspective of preventing the recovery of sensitive data through recovery tools, the data must either be completely overwritten (every sector) with random data before the format, or the format program itself must perform this overwriting; filling every data sector with F6h bytes.
    So therefore I concluded that the format program itself can indeed write F6h bytes to the hard drive.

  10. #20
    Just Another Geek
    Join Date
    Jul 2002
    Location
    Rotterdam, Netherlands
    Posts
    3,401
    On a related note.. True low-level formats indeed cannot be done by us for some very long time (MFM is really old).

    http://www.seagate.com/ww/v/index.js...D&locale=en-GB

    Zero-filling the drive DOES destroy any and all data that was on it. Formatting doesn't.
    Last edited by SirDice; June 29th, 2007 at 10:41 AM.
    Oliver's Law:
    Experience is something you don't get until just after you need it.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •