±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 3 Overall: 35980
New Yesterday: 5 Visitors: 369

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

List of Wiping Utilities

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

isth
Senior Member
 

List of Wiping Utilities

Post Posted: Apr 26, 11 02:54

Hi All,

Would anyone happen to have a list of hashes for wiping utilities (install.exe's and extracted files) they would be willing to share? I received a drive that was supposedly heavily used, but the 2nd partition is filled with zeros. Thinking there may have been some sort of wiping utility utilized.

Thanks much in advance.  
 
  

mscotgrove
Senior Member
 

Re: List of Wiping Utilities

Post Posted: Apr 26, 11 03:03

A full format on Windows 7 (and possibly Vista?) will initialise sectors.

The partition could have just been formatted.

Is the whole partition zeros, or does it have a basic $MFT etc
_________________
Michael Cotgrove
www.cnwrecovery.com
www.goprorecovery.co.uk 
 
  

isth
Senior Member
 

Re: List of Wiping Utilities

Post Posted: Apr 26, 11 03:09

It is a Windows 7 machine and it does have the basic post-formatted files on it. That might make sense then! This is actually the first windows 7 machine i've encountered, so I'll do some research on how it's formatting works (unless you have a good link you'd like to share). Many thanks.  
 
  

athulin
Senior Member
 

Re: List of Wiping Utilities

Post Posted: Apr 26, 11 11:05

- mscotgrove
A full format on Windows 7 (and possibly Vista?) will initialise sectors.

The partition could have just been formatted.


Doesn't formatting place a basic file system on the volume also? After all, that's what formatting is about -- creating a volume boot record, and placing the file system of choice on the volume. A full formatting then proceeds to wipe remaining unused space, but the file system structures will be present.

If all sectors in the partition are zero, a wiping tool seems to make more sense, if there is evidence that the partition at some time did contain information. Otherwise, it may be that it never was formatted.  
 

Page 1 of 1