Erasing Data

I'll be passing on some computer equipment shortly, including hard drives. Can anyone tell me whether a full format (as opposed to quick format) overwrites data sufficiently to stop someone else recovering it?

I had thought of inserting any boot disc, vista or xp or whatever, and going as far as deleting the partitions and then formatting the whole drive, before cancelling the rest of the install. The drive would still emerge formatted?

There's a hidden partition with recovery data on one of the drives (my Dad's), I'm assuming this will show in a boot disc? I don't see how else I can do it, I could scrub data but it would still leave Windows on the drive and I'd never be able to erase the partition containing Windows from within Windows.

Sorry Moira,

Formatting does not erase data unless you use Vista, which will overwrite it with zeros.

Try this:

http://www.heidi.ie/eraser/

or this:

http://dban.sourceforge.net/

You should run them from a boot disk or with the drive as a slave.

As for the drive with a recovery partition, DBAN should do the job. That's the second link, and runs off a boot disk.

:)

Well, I can use Vista, that isn't a problem. Surely that would be simpler?

Hi Moira,

I am not sure as I have never done it. The one question I would have is at what point does Vista check the hardware for suitability, compatibility and whatever? That might be an issue? I would very much appreciate it if you would try on the weakest machine and let me know what happens.............I know, I must buy myself a copy for Christmas elkgrin( that's the closest to a grinning reindeer we seem to have!)

I generally overwrite with zeros or ones when I am doing a reinstall. For a redeployment I usually overwrite three times. That is a security issue. Nobody can recover anything useful from a triple overwrite.

IMHO, a single overwrite would be adequate if you know where the stuff is going. If it is e-bay, then I guess I would add a couple of ounces of PE4 after a x3 overwrite :xbones:

Now that we have exchanged addresses I could always make you a few CDs/floppies and bung them in the post. I guess I ought to do that with copies of my toolkits anyway?

Cheers,

John

That would be fantastic, thanks John! When I was trying to get OSX on an old mac, eventually someone from a mac forum offered to take my hard drive and install it up to the point where it would check for particular hardware etc. This was clearly after the OS was fairly comprehensively installed, as I took it back, put it in my mac and carried on with the install.

The point is, while I have software to overwrite data many times, it works from within Windows so it won't overwrite Windows. That may not be critical as you could get away with just using it on the personal data and leave the system files to be overwritten when Windows was reinstalled - nobody is going to learn much from system files :) But if I want the entire disk wiped, I'm going to have to do it from outside the C drive. A linux boot disk might do it - formatting with the linux file system (ext 23) and then formatting again with NTFS wouldn't leave much!

Quote:

---

formatting with the linux file system (ext 23) and then formatting again with NTFS wouldn't leave much

---

I could only manage a 97% recovery........... latest linuxes will overwite rather more?

:)

You mean your drive never again allowed you to use the full size? I wasn't intending to leave the drive formatted in ext 3 - err, where did the 2 come from, sorry that was a typo I failed to spot! I think since I've got a vista CD I should just format this drive using that. As this person probably doesn't know how to install an OS I'll probably have to put one on. The PC going first is a Dell Dimension belonging to my Dad who's getting a new imac - it would be easiest just to leave the hard drive where it was. The other option is to put the drive in my PC as a slave here and format it. The main query was whether using the format command in windows and opting for a full format instead of a quick one, erased data thoroughly enough. The Dell won't run Vista so it looks like I'll have to put XP on, but formatting in Vista first. I was hoping it would be sufficient to cancel the install after formatting the drive and then install XP.

Hi Moira,

What I meant was that I could recover around 97% of the contents of a folder that had accidentally been "overwritten" (formatted) with a Linux file system.

With DOS there was an option to overwrite with a pattern but Windows did not do that (unless you booted with a DOS disk first and ran the format from there).

Vista is the first Windows to actually overwrite the drive, so you need to bear that in mind if you use it to format. In the past you could format the drive and still recover the data.......... with Vista you can't.

Do all these machines have a working CD or 3.5" floppy drive?

My Dad's doesn't. But I can take over a Vista CD and format the drive - it should do the format even if the install is subsequently cancelled. Even if the install runs its course it'll be easy enough to subsequently install XP. I could bring it over here (and attach as a slave), but it would be easier to take it straight from his house to the place it's going to.

Hi,

Does your dad's have a 3.5" floppy drive and do the others?

I have just made a DBAN (Darik's Boot And Nuke") bootable floppy that will wipe the lot for you. I can stick it in the post to you Monday if you like?

:)

Cheers, that would be great! I'm certain my Dad's doesn't have a floppy drive, though I can ask him again. My two computers here do though, so I could use it for the drives being given away here.

If he only has a CD/DVD then I can make you a bootable one of those as well..........it only takes a few minutes :)

Many thanks, that would be really useful! It probably takes more than a few minutes to go to the post office and get it checked out for "large letter" category, so I know you're going to more trouble than you're saying :) I'm not absolutely certain his drive is DVD - it probably is, but since it will fit on a CD that's a safer option. :)

No problems Moira, they will both fit in the same bag ;) I guess the post office is only about 1/2 a mile from my house.

:)

Will the software also view and format the hidden partition?

I would have thought so Moira,

Those partitions are normally defined within Windows, and we will boot outside of the OS.

Not sure about Vista, but a reformat from a "proper" Windows CD (not a "repair" or "recovery" disk) will get rid of those hidden partitions.

:)

I was wondering about your software actually ... I can certainly get rid of it with a full XP or Vista disc.

The software I am sending will get rid of everything on the disk............. like everything :shocked:............ hidden or not!

That's exactly what I'm looking for! It will leave basic CD drivers on though? I remember doing a very low level format in the BIOS once (in my early days with computers) and literally wiping everything off! It took quite something to get an operating system back on, I can tell you!

No, these wiping utilities do just that, they wipe the lot. If you are going to reload the same OS then make sure that you save the drivers or get them off the internet if you are not using the Microsoft defaults.

If you are going to load Win XP after an earlier OS then I would check that you can boot from an XP CD before proceeding. This will load the default installation drivers and you will see if there is a compatibility issue.

If you think about it, exactly the same thing will happen if you do a full format with the Vista CD or even XP, except that in the case of XP the data would still be there, although you wouldn't be able to access it.

Well no, because a normal format does leave CD drivers, otherwise how would you even be able to insert and run an XP or Vista CD to install another operating system? That was my problem when I inadvertently did this BIOS format years ago. Someone else had to come round with a floppy containing drivers for nearly every type of CD.

No problems Moira!

These utilities only wipe the hard drive; they do not touch the BIOS. What they do is securely overwrite the existing data on the hard drive, so it looks to your system as if you have simply put a new HDD in there :)

Your BIOS lives on it's own EEPROM chip on the motherboard (these days there are generally two, one of them being a backup of the BIOS). When you boot, the BIOS recognises your hardware, including CD/DVD optical drives.

It finds the boot sector on the Windows CD and starts to load that. In the OS boot process it loads a generic driver for the CD that allows Windows to use it.

For example, this machine has a CD RW and a DVD. Both are running with the drivers supplied by Windows XP.

Back in the days before Windows came on a bootable CD, you used an installation disk (3.5" floppy) This would load something like Oak Technologies CD driver to let you get to the drive, and install windows.

Where you are more likely to encounter problems is with modems, audio cards and video cards. Particularly with the latter two, as they come with advanced drivers and management application "bundles" that let you get the best out of them.

For example, using Windows, this machine will support video with a refresh rate of 85 Hz at 32bit. With the ATi Radeon software that becomes 120 Hz, because it recognises the VDU and video card for what they are, rather than generic ones.

In the case of RW CD/DVDs you will lose the software such as Nero and Roxio that come with the drive, so you will have to reinstall them from the CD or use the inbuilt burning software in XP.

:)

Yeah, I understand that I'll lose everything on the disk .... what on earth did I do to wipe off the computer's ability to recognise the CD drive then? All I can remember is it took ages and was done in the BIOS (a much older BIOS than nowadays). I'm surprised you only get up to 85 hz? I understood XP drivers would display a refresh rate of 100 hz with their generic drivers.

Hi,

I have no idea what you might have done. Earlier BIOSes did far less than those of the last 12 years. Remember having to tweak autoexec.bat and sys.ini? :D back when Windows was more of a GUI than an OS.

The refresh rate will depend on a number of factors:

1. What video chipset the system thinks that you have
2. What VDU the system thinks you have
3. What resolution and number of colours you set.

If it doesn't know the equipment it will default to whatever options it considers "safe"

Yes, but if you have a setup which can take 100 hz then Windows XP has the drivers, whereas in the past, I had monitors that needed specific drivers to get them to display 100 hz (not mhz as I put in my last post, sorry!)

That's progress Moira :D

In the past, even the simplest devices shipped with their own drivers because Windows didn't support much more than basic functionality. The old "safe mode" concept? Like the display would default to 640x480 16 colours @60Hz, and a serial mouse or trackball would work when PS/2 or USB devices wouldn't.

I noticed the other day that with Win XP a serial mouse won't work in safe mode but a USB one will........... it used to be the other way round. I just opened up a Kensington mouse box............. device has never been used . In it there are 2 3.5" floppies with the drivers etc. I just took a look and they are for Win 3.1x, 95, 98 and NT 3.5x/4.0. More recent devices have drivers for the old OSes but not for Win 2000 or XP, particularly XP. I think that was when MS introduced the concept of "signed drivers"?

Yes, I have several monitors that need their own drivers to be recognised properly. This one for example, although it is "signed", it is not in the default list.

Of course, the driver problems with Vista were a quite different issue:D

UPDATE:

Your CD and floppy disk are in the post. Please remember to change the boot sequence............ I forgot that on Eileen's Dell (well I wasn't going to test them on mine :shocked:) and it only has three boot options............ I needed to put the CD in the DVD drive.

I believe that you have one with a hidden/recovery partition? Have a look in the BIOS and see if you can disable the protection first.

:)

I think I have to use my dvd drive, but don't worry, I know how to change the boot sequence on Dad's old PC. He ordered his imac yesterday - I'm quite envious, it looks good :)

And thank you very much for your time and effort nihil

You think the hidden partition will be protected to that extent? I have some hidden partitions on my PC but it's just done through the registry.

Quote:

---

Originally Posted by nihil
Sorry Moira,

Formatting does not erase data unless you use Vista, which will overwrite it with zeros.

:)

---

Actually I heard something a bit different tonight from someone who knows far more about the subject than I do. If I can just paste his comments - regarding formatting during an XP install:

Quote:

---

It overwrites all data with 0s. That's it. The data is gone for all intents and purposes. The drive certainly can't read it again...

it's technically possible that the old data still "shines through" - as in where there used to be a 1, there's now a 0.0001, and where there used to be a 0, there's now a 0.

However unless you happen to have lost the meaning of life, or the location of Osama Bin Laden on that drive, you're unlikely to get half the scientists in the world working on recovering it.

---

That is Vista not XP, this is from the GetData site. They sell data recovery software so they should know:;) They are explaining why their software won't work with a Vista full format.

Quote:

---

The warnings are there on the Microsoft site and in the instructions. But the majority of us don’t often bother to read the volumes of information and assume that they will be able to recover their data if they do a full format under Vista, as they were able to do with previous versions of Windows.

---

Prior to Vista, a full format did not overwrite the data, and you had to use a separate utility first.

Under DOS there was an option to format with overwriting. It wasn't zeros, but some repetitive pattern.

This was referring to XP actually .... but good news! I got your package with the CD and floppy today! Thank you so much, I can now just use these utilities :)

It is Darik's Boot And Nuke (DBAN)

The comment about XP writing zeros is incorrect. It, does not, and there is no option to get it to do so.

In versions of Windows before Vista the difference between a "quick format" and a "full format" was that you could use the QF on known good drives that were already formatted. FF is for drives that are unformatted or formatted for something other than the version of Windows you want to use.

Here is the site of a well-known data recovery software house:

http://www.stellarinfo.com/

You will notice that they specifically mention recovery from drives that have been "formatted".

This is slightly misleading as they also imply that it will work with Vista, well it probably does, and will recover from most things except a full format:)

I have done many formats and reinstalls in my time and I normally use the HDD drive manufacturer's toolkit when I want to overwrite the existing data prior to reinstallation. Mostly this is because the tool is better at detecting and repairing disk problems than Windows;)

I have also recovered data from many drives that have been accidentally formatted, even one that had been formatted for Linux!, although that wasn't 100%.:(

So far, I have only been brought one drive that was reformatted in Vista. I couldn't find any data on it, because it had all been overwritten.

The theory of being able to recover data once it has been overwritten is just that: a theory. I have seen the results in carefully controlled laboratory conditions (i.e. artificial conditions) but have never heard of it in real life.

There is certainly no software recovery method, and the physical process is destructive. It also takes a very long time and is very expensive.

LOL, sorry about messing up the original post, I've more or less restored it to the original format!

I'll check whether martin was specifically referring to Vista or XP or both there. However, the bulk of that statement has also been clarified by another expert in the field. I accept recovery is possible, but it would be hightly unlikely anyone would try to recover data from a fully formatted drive and a new OS install (and very expensive).

I can't argue with either Sean's or Martin's statements as they both are really off the planet with this sort of knowledge, but I'm also not saying you're wrong either.

In particular, this line is hard to refute - I wouldn't have thought someone without the knowledge could have made it up:

Quote:

---

it's technically possible that the old data still "shines through" - as in where there used to be a 1, there's now a 0.0001, and where there used to be a 0, there's now a 0.

---

Quote:

---

I accept recovery is possible, but it would be hightly unlikely anyone would try to recover data from a fully formatted drive and a new OS install (and very expensive).

---

Wrong! relatively inexpensive or possibly even free software will do the job. I base that on my own experience and what is on the Microsoft site regarding full formatting in various versions of Windows.

Only a full format in Vista will overwrite data areas. The others just overwrite the references to the files & folders........... the actual raw data are still there and can be recovered.

It helps if you consider your disk space utilisation?

Say you take a brand new hard drive, format it, then load some applications. Then you re-format it and do the same thing. All you will do is overwrite the exact same data areas on the drive?

Now, when you start using the apps to create data, start adding new apps and so on, you are writing to a different area of the HDD? This will not be overwritten by a format and re-install of the OS, and is available for recovery.

To make your proposal work, you would need to check your diskspace utilisation first. Follow the reformat and reinstall routine THEN:

Load some very large games, demos or whatever so that you go well beyond the previous used space total. Then just delete the games etc.

Hopefully, all the recovery software will find will be the deleted games, as they should have overwritten what was previously there.

I can't say that I would like to rely on that method though. Using a proper erasing tool is far more reliable, particularly as it addresses the problem of cluster tips or slack space.

Quote:

---

it's technically possible that the old data still "shines through" - as in where there used to be a 1, there's now a 0.0001, and where there used to be a 0, there's now a 0.

---

That is called "magnetic remnance", the other concept is "track overlay", which is where the heads don't write to exactly the same spot each time, so there are traces of previous data at the edges.

Yes, I too have read Dr. Peter Gutmann's paper of 1996 (" Secure Deletion of Data from Magnetic and Solid-State Memory "). It was based on research conducted previously so the hard drive technology has changed a lot since then. I would chose the word "theoretically" as opposed to "technically" because I do not think that the technology actually exists in the real World.

Sure, I have seen proof of concept exercises but they were not very good and in totally artificial environments.

The bottom line is that all you need to do is fully wipe the drive with a tool such as DBAN and you will be secure. No software recovery technique will work, which puts it out of the budgets of individuals and even police forces.

:)

EDIT: This is a little tool I use to check out file recoverability and whether everything has actually been erased?................ it is free.

http://www.theabsolute.net/sware/dskinv.html

Be prepared for a shock!

Yes a double post.

Here is a free disk defragmenter:

http://www.auslogics.com/disk-defrag/

Download and run it (Win 2000, XP, Vista only) then look at where Billy Windoze has put your data on your HDD................

I rest my case :D:cool:

I've actually got that utility. Really I can't say more until I've had a word with the people who gave me the previous information and I just haven't had time yet. But I won't forget, and in any case intend to use DBAN as you so kindly sent it.

Quote:

---

Originally Posted by Moira

This was referring to XP actually .... but good news! I got your package with the CD and floppy today! Thank you so much, I can now just use these utilities :)

---

I know this is an old thread, but I came across it and I think we got rather muddled because I made a fundamental mistake in the first sentence of this post - I should have said "This was referring to Vista actually".

No big deal ..... but I just thought I'd post this so the thread made a bit more sense. :)