Tom's Hardware > Forum > Storage > General Storage > I know about wiping the disk, but what about the MBR and P..

I know about wiping the disk, but what about the MBR and P..

Forum Storage : General Storage - I know about wiping the disk, but what about the MBR and P..

Tom's Hardware: Over 1.4 million members in 6 different countries available to answer all your high-tech questions. Sign up now! Its free!
Word :    Username :           
 

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

 

You can, of course, wipe your hard disk with complicated software that
do more or less their jobs.

let's say I am working on an important project. Company wise.

I delete the partition, remove all partitions and wipe the hard drive
from DOS.

Now, if someone installs an OS over it with a new partition, can't he
dig up a MFT mirror from the hard disk or collect MBR records and logs
that are present on certain physical parts of the hard disk ?

If is able to, maybe he can't get back the files, but at least, he
knows the names of the files, and the directory structure of past
partition tables.

Sponsored Links
Register or log in to remove.

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

 

On 10 Jul 2004 12:58:33 -0700, shalowfate@yahoo.com (nh2) wrote:

>You can, of course, wipe your hard disk with complicated software that
>do more or less their jobs.
>
>let's say I am working on an important project. Company wise.
>
>I delete the partition, remove all partitions and wipe the hard drive
>from DOS.
>
>Now, if someone installs an OS over it with a new partition, can't he
>dig up a MFT mirror from the hard disk or collect MBR records and logs
>that are present on certain physical parts of the hard disk ?
>
>If is able to, maybe he can't get back the files, but at least, he
>knows the names of the files, and the directory structure of past
>partition tables.

Yes, but only in weeks with two Wednesdays.

Assuming wiping means writing zeroes to the entire disk.
--
Svend Olaf

Reply to Anonymous

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

 

nh2 wrote:

> You can, of course, wipe your hard disk with complicated software that
> do more or less their jobs.

Or very simple software. IBM used to have a utility called "zerodisk" on
their site that ran from a DOS command prompt, took no parameters, and
wrote zeroes over the entire disk. About as simple as it gets.
>
> let's say I am working on an important project. Company wise.
>
> I delete the partition, remove all partitions and wipe the hard drive
> from DOS.

If you mean you erase all the files, that doesn't remove any data from the
disk, if you mean format that clears the FAT and directory structure but
doesn't remove any data beyond that.

> Now, if someone installs an OS over it with a new partition, can't he
> dig up a MFT mirror from the hard disk or collect MBR records and logs
> that are present on certain physical parts of the hard disk ?

Depends on the OS, it may wipe enough information to make this difficult.
But someone who is going after your data won't install an OS on the disk
he's attacking, he'll connect it to a machine that has an OS already
installed.

> If is able to, maybe he can't get back the files, but at least, he
> knows the names of the files, and the directory structure of past
> partition tables.

The only way to be absolutely sure the data won't be recovered is to
physicially destroy the surfaces of the platters by grinding off the
magnetic coating or melting them down.

--
--John
Reply to jclarke at ae tee tee global dot net
(was jclarke at eye bee em dot net)

Reply to Anonymous

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

 

On 10 Jul 2004 12:58:33 -0700, shalowfate@yahoo.com (nh2) wrote:

>If is able to, maybe he can't get back the files, but at least, he
>knows the names of the files, and the directory structure of past
>partition tables.

It is possible to get back partial directory or even files that you
deleted. If you really want to destroy the file and the partition,
I'd suggest a program called mutilate file wiper. It's available for
free (trial) and if you use high security setting, it'd be close to
the level for government file destruction. There is a time limit on
trial version so higher wipe setting or wiping really big hard drive
may not work.
--
To reply, replace digi.mon with tds.net

Reply to Anonymous

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

 

Ok. Thanks for your answers. I thout wiping doesn't write where the
MFT and MFT Mirror log files and MBR are located.

shalowfate@yahoo.com (nh2) wrote in message news:<e018d27.0407101158.5544d2e8@posting.google.com>...
> You can, of course, wipe your hard disk with complicated software that
> do more or less their jobs.
>
> let's say I am working on an important project. Company wise.
>
> I delete the partition, remove all partitions and wipe the hard drive
> from DOS.
>
> Now, if someone installs an OS over it with a new partition, can't he
> dig up a MFT mirror from the hard disk or collect MBR records and logs
> that are present on certain physical parts of the hard disk ?
>
> If is able to, maybe he can't get back the files, but at least, he
> knows the names of the files, and the directory structure of past
> partition tables.

Reply to nh2

Archived from groups: comp.sys.ibm.pc.hardware.storage (More info?)

 

Previously J. Clarke <jclarke@nospam.invalid> wrote:
> nh2 wrote:

>> You can, of course, wipe your hard disk with complicated software that
>> do more or less their jobs.

> Or very simple software. IBM used to have a utility called "zerodisk" on
> their site that ran from a DOS command prompt, took no parameters, and
> wrote zeroes over the entire disk. About as simple as it gets.

I use "dd_rescue /dev/zero /dev/<target>", also not complicated.

>> let's say I am working on an important project. Company wise.
>>
>> I delete the partition, remove all partitions and wipe the hard drive
>> from DOS.

Should be enough, unless
a) an attacker suspects what on that specific disk
b) an attacker can spend a lot of money on the small chance of
reading something.

Today the only real risk are reallocated defect
sectors, since they are not wiped. But the chance of some useful
information residing is small and getting to tem is complicated.

Arno
--
For email address: lastname AT tik DOT ee DOT ethz DOT ch
GnuPG: ID:1E25338F FP:0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
"The more corrupt the state, the more numerous the laws" - Tacitus

Reply to Anonymous
Tom's Hardware > Forum > Storage > General Storage > I know about wiping the disk, but what about the MBR and P..
Go to:

There are 1190 identified and unidentified users. To see the list of identified users, Click here.

Please mind

You are about to answer a thread that has been inactive for more than 6 months.
If you still wish to proceed, please ensure that your posting is original and does not duplicate or overlap any prior responses to this thread.

Add a reply Cancel
Sponsored links
  • Ask the community now
  • Publish
Ad
They won a badge
Join us in greeting them