±Your Account
Membership:
New Today: 0
New Yesterday: 8
Overall: 24189
Visitors: 39±Latest Webinar
±Latest Articles
· Geo-tagging & Photo Tracking On iOS
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Windows 8: Important Considerations for Computer Forensics and Electronic Discovery
· KS – an open source bash script for indexing data
· Mobile Device Geotags & Armed Forces
· Categorization of embedded system forensic collection methodologies
· Interpretation of NTFS Timestamps
· What are ‘gdocs’? Google Drive Data – part 2
· What are ‘gdocs’? Google Drive Data
· Bad Sector Recovery
· Forensic Artifact: Malware Analysis in Windows 8
· Windows 8: Important Considerations for Computer Forensics and Electronic Discovery
±Follow Us
±Latest Jobs
Back to top
Skip to content
Skip to menu
Back to top
Back to main
Skip to menu
Go to page Previous 1, 2, 3 Next
Used space in old erased overwritten HDD?
Re: Used space in old erased overwritten HDD?
Posted: Mon Jan 28, 2013 9:17 pm
It is an IBM SATA disk, 12 years old. 5GB.
By saying "Erase", I mean, first I formated it with Windows 7( not quick format), then I usedccleaner and selected option "delete all the disk" I used 7 passes(This was before I learnt that only one had been enough).
By saying "Erase", I mean, first I formated it with Windows 7( not quick format), then I usedccleaner and selected option "delete all the disk" I used 7 passes(This was before I learnt that only one had been enough).
-
williamsonn - Senior Member
Re: Used space in old erased overwritten HDD?
Posted: Mon Jan 28, 2013 9:54 pm
Now I am seeing again the $recycle bin
-
williamsonn - Senior Member
Re: Used space in old erased overwritten HDD?
Posted: Mon Jan 28, 2013 10:06 pm
Williamsonn, seeing files in the recycle bin doesn't mean all data hasn't been wiped. It's simply an artifact of CCleaner's wiping methodology. If you're curious about what CCleaner does, check out David Cowen's anti-anti-forensics presentation (related to his $LOGFILE research).
If you want absolutely nothing to remain on the drive, try using Diskpart, select the drive (be very careful to select the correct drive!) and use "clean all." This will overwrite the entire drive, including the partition table. No file system left, therefore no recycle bin, no $logfile, etc.
_________________
Scott Tucker
Aptegra Consulting, LLC
www.aptegra.com
If you want absolutely nothing to remain on the drive, try using Diskpart, select the drive (be very careful to select the correct drive!) and use "clean all." This will overwrite the entire drive, including the partition table. No file system left, therefore no recycle bin, no $logfile, etc.
_________________
Scott Tucker
Aptegra Consulting, LLC
www.aptegra.com
-

TuckerHST - Senior Member
Re: Used space in old erased overwritten HDD?
Posted: Mon Jan 28, 2013 10:10 pm
Incidentally, it can't be a SATA disk. SATA isn't 12 years old. You must mean IDE aka PATA.
_________________
Scott Tucker
Aptegra Consulting, LLC
www.aptegra.com
_________________
Scott Tucker
Aptegra Consulting, LLC
www.aptegra.com
-

TuckerHST - Senior Member
Re: Used space in old erased overwritten HDD?
Posted: Tue Jan 29, 2013 5:33 am
thanks for your answer.
However,recycle bin´s space. appears on Recuva as 120kb only. The other files can ´t be visible?
However,recycle bin´s space. appears on Recuva as 120kb only. The other files can ´t be visible?
-
williamsonn - Senior Member
Re: Used space in old erased overwritten HDD?
Posted: Tue Jan 29, 2013 6:31 am
Depending on your setup, you may have VSS (Volume Shadow Copy) stored on that disk as well. What's the new file system you put on it (FAT or NTFS)? NTFS per se occupies A LOT MORE space than FAT due to the many structures such as transaction log files. Either way, if you want a completely empty drive, you need to delete all partitions first... but how do you count free space then? The moment you format the drive with a file system, some space is already "wasted".
_________________
Digital Evidence Extraction Software
belkasoft.com
_________________
Digital Evidence Extraction Software
belkasoft.com
-

Belkasoft - Senior Member
Re: Used space in old erased overwritten HDD?
Posted: Tue Jan 29, 2013 8:17 am
After you have wiped a hard disk there ARE NO partitions on it NOR filesystems (No drive letter, no other way to access anything if not by direct disk access).
When, after having wiped it, you partition the disk, and later format the partition(s) in it, you are writing new data to it.
Depending on the OS used, on the filesystem chosen, and a number of possible settings, besides the filesystem structures, som data like the pagefile or the Recycle bin may be added first time you boot with that disk attached and/or you merely access it,
WHAT is the point that you don't understand?
The wiping?
The partitioning?
The formatting of the partition(s)?
Try this:
Wipe the disk clean. (as an example use Dban, single pass)
DO NOT re-partition/re-format it.
Access the disk through DMDE.
Create a partition on the disk.
Access the disk through DMDE.
Format the partition as FAT32.
Access the disk through DMDE.
RE-format the partition as NTFS.
Access the disk through DMDE.
You should be able to understand what is going on.
jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. -
When, after having wiped it, you partition the disk, and later format the partition(s) in it, you are writing new data to it.
Depending on the OS used, on the filesystem chosen, and a number of possible settings, besides the filesystem structures, som data like the pagefile or the Recycle bin may be added first time you boot with that disk attached and/or you merely access it,
WHAT is the point that you don't understand?
The wiping?
The partitioning?
The formatting of the partition(s)?
Try this:
Wipe the disk clean. (as an example use Dban, single pass)
DO NOT re-partition/re-format it.
Access the disk through DMDE.
Create a partition on the disk.
Access the disk through DMDE.
Format the partition as FAT32.
Access the disk through DMDE.
RE-format the partition as NTFS.
Access the disk through DMDE.
You should be able to understand what is going on.
jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. -
-

jaclaz - Senior Member
















