±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 1
Overall: 27487
Visitors: 47

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Do several full formats erase all data?

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Go to page 1, 2, 3  Next 
  

Do several full formats erase all data?

Post Posted: Sun Nov 18, 2012 4:31 pm

hello

I know that a safe erasing of data must be done using at least 1 wipe pass. However my question is: do, also, several full formats the same effect? thanks  

williamsonn
Senior Member
 
 
  

Re: Do several full formats erase all data?

Post Posted: Sun Nov 18, 2012 4:57 pm

- williamsonn
hello

I know that a safe erasing of data must be done using at least 1 wipe pass. However my question is: do, also, several full formats the same effect? thanks


Generally no. This is dependent on the particulars of the OS involved, the media (floppy or hd) and what switches have been applied with the format command (eg. DOS /u switch on a floppy).
Also, what do you mean by a " full" format?  

Beetle
Senior Member
 
 
  

Re: Do several full formats erase all data?

Post Posted: Sun Nov 18, 2012 5:24 pm

- williamsonn

I know that a safe erasing of data must be done using at least 1 wipe pass. However my question is: do, also, several full formats the same effect? thanks


Depends on the OS, and how a full format is implemented. For example, a full format under XP is not the same thing as a full format under Win7.  

keydet89
Senior Member
 
 
  

Re: Do several full formats erase all data?

Post Posted: Mon Nov 19, 2012 5:25 am

In more detail, any "full format" in a NT based OS BEFORE Vista is not "destructive".
"Full format" in Vista and later does fill each and every sector of the volume with 00's (besides the sectors for the filesystem structures that will be re-written), so while not being a "complete" wipe (as anything outside the volume is left "as is") it is effectively destructive.
(the target of disk wiping is the disk, the target of "format" full or not is the volume).

For the record the notion
that a safe erasing of data must be done using at least 1 wipe pass

is inaccurate as there is not any documented report of anyone ever recovering anything after a single 00 pass, at least on "modern" hard disk, which means roughly those made in the last 10 years.


jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

jaclaz
Senior Member
 
 
  

Re: Do several full formats erase all data?

Post Posted: Mon Nov 19, 2012 10:29 am

I guess I am wondering why you are asking? It takes little time, and little expertise to seed a flash drive with dummy data, make a few notes of what is on there and where, and then format it with various OSes.

In the time it takes for you to post and wait for a reply, you'd have your answer first hand, rather than having an answer from unknown sources.  

twjolson
Senior Member
 
 
  

Re: Do several full formats erase all data?

Post Posted: Wed Nov 21, 2012 5:12 am

In addition to what's been already said, full (or even quick) format of an SSD drive will normally destroy its content due to the TRIM/garbage collection operation. However, some remnants of original data may still appear in SSD's reserved memory areas, so saying that several cycles of full format destroy 100% of data on an SSD drive would not be technically correct.

Also, formatting a traditional (magnetic) hard disk, even if you're filling the sectors with zeroes, is not the same as using a cryptographically sound wipe. Properly implemented wiping fills disk content with random data (that must be cryptographically sound random data in order to pass certain certifications). This is due to the fact that, theoretically, data overwritten with zeroes can still be recovered off magnetic plates with dedicated hardware. Note that I said "theoretically", as I don't really know what happens if such hardware is used with a modern drive with high storage density and perpendicular writing.
_________________
Digital Evidence Extraction Software
belkasoft.com 

Belkasoft
Senior Member
 
 
  

Re: Do several full formats erase all data?

Post Posted: Wed Nov 21, 2012 5:33 am

- Belkasoft
Properly implemented wiping fills disk content with random data (that must be cryptographically sound random data in order to pass certain certifications).


Belkasoft, would you recommend this for SSD?
_________________
Institute for Digital Forensics (IDF) - LinkedIn
Mobile Telephone Examination Board (MTEB) - LinkedIn
Mobile Telephone Evidence & Forensics trewmte.blogspot.com
ForensicMobex now MTEB Linkedin Subgroup 

trewmte
Senior Member
 
 
Reply to topicReply to topic

Share this forum topic to encourage more replies



Page 1 of 3
Go to page 1, 2, 3  Next