±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 4
New Yesterday: 6
Overall: 27389
Visitors: 74

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Used space in old erased overwritten HDD?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page Previous  1, 2, 3  Next 
  

Re: Used space in old erased overwritten HDD?

Post Posted: Mon Jan 28, 2013 9:17 pm

It is an IBM SATA disk, 12 years old. 5GB.

By saying "Erase", I mean, first I formated it with Windows 7( not quick format), then I usedccleaner and selected option "delete all the disk" I used 7 passes(This was before I learnt that only one had been enough).  

williamsonn
Senior Member
 
 
  

Re: Used space in old erased overwritten HDD?

Post Posted: Mon Jan 28, 2013 9:54 pm

Now I am seeing again the $recycle bin  

williamsonn
Senior Member
 
 
  

Re: Used space in old erased overwritten HDD?

Post Posted: Mon Jan 28, 2013 10:06 pm

Williamsonn, seeing files in the recycle bin doesn't mean all data hasn't been wiped. It's simply an artifact of CCleaner's wiping methodology. If you're curious about what CCleaner does, check out David Cowen's anti-anti-forensics presentation (related to his $LOGFILE research).

If you want absolutely nothing to remain on the drive, try using Diskpart, select the drive (be very careful to select the correct drive!) and use "clean all." This will overwrite the entire drive, including the partition table. No file system left, therefore no recycle bin, no $logfile, etc.
_________________
Scott Tucker
Aptegra Consulting, LLC
www.aptegra.com 

TuckerHST
Senior Member
 
 
  

Re: Used space in old erased overwritten HDD?

Post Posted: Mon Jan 28, 2013 10:10 pm

Incidentally, it can't be a SATA disk. SATA isn't 12 years old. You must mean IDE aka PATA.
_________________
Scott Tucker
Aptegra Consulting, LLC
www.aptegra.com 

TuckerHST
Senior Member
 
 
  

Re: Used space in old erased overwritten HDD?

Post Posted: Tue Jan 29, 2013 5:33 am

thanks for your answer.


However,recycle bin´s space. appears on Recuva as 120kb only. The other files can ´t be visible?  

williamsonn
Senior Member
 
 
  

Re: Used space in old erased overwritten HDD?

Post Posted: Tue Jan 29, 2013 6:31 am

Depending on your setup, you may have VSS (Volume Shadow Copy) stored on that disk as well. What's the new file system you put on it (FAT or NTFS)? NTFS per se occupies A LOT MORE space than FAT due to the many structures such as transaction log files. Either way, if you want a completely empty drive, you need to delete all partitions first... but how do you count free space then? The moment you format the drive with a file system, some space is already "wasted".
_________________
Digital Evidence Extraction Software
belkasoft.com 

Belkasoft
Senior Member
 
 
  

Re: Used space in old erased overwritten HDD?

Post Posted: Tue Jan 29, 2013 8:17 am

After you have wiped a hard disk there ARE NO partitions on it NOR filesystems (No drive letter, no other way to access anything if not by direct disk access).
When, after having wiped it, you partition the disk, and later format the partition(s) in it, you are writing new data to it.
Depending on the OS used, on the filesystem chosen, and a number of possible settings, besides the filesystem structures, som data like the pagefile or the Recycle bin may be added first time you boot with that disk attached and/or you merely access it,

WHAT is the point that you don't understand?
The wiping?
The partitioning?
The formatting of the partition(s)?

Try this:
Wipe the disk clean. (as an example use Dban, single pass)
DO NOT re-partition/re-format it.
Access the disk through DMDE.
Create a partition on the disk.
Access the disk through DMDE.
Format the partition as FAT32.
Access the disk through DMDE.
RE-format the partition as NTFS.
Access the disk through DMDE.

You should be able to understand what is going on.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 2 of 3
Go to page Previous  1, 2, 3  Next