A disk contains a very large amount of slack, and can also contain slack runs often upto 32K in length. Slack is fairly recent. Each file on average will produce slack of 50% the cluster size. Slack is therefore many many times more useful than remapped sectors. However, if it is considered that slack is so limited in value, then ignore remapped sectors.
The number of remapped sectors on a disk is fairly small, otherwise disks could have much higer capacity, and if as suggested above the size if 512 bytes, then this does not give a good run of information.
I have just looked at a 5 year old, 40GB drive with 78 million sectors. It reports defects in 330 of them, scattered around the drive. This gives it a chance of 1 in 250,000 that the required sector will have failed when it was holding the required data.
It is possible, but so unlikely to be of use.
Look at the current thread on 'Single pass wipe sufficent'. It will answer all of your questions
Will it?
You write some offending data to your hard drive. One or more of the sectors containing the material goes bad so the drive maps out those sectors and maps in new ones. All without the OS knowing. You see the Feds coming up the road and run your favourite cleaning software. The drive is clean as far as the OS is concerned but the offending data is still there.
Well, it may.
If you used the inner Erase function of the ATA/SATA, all drive sectors, included those mapped as bad will be re-written, thus you need to have both the chance of the compromising data being on one of those very few sectors AND the internal 00 writing completely failing.
Using an "external" software, those remapped sectors may be skipped.
Bad sectors (as well as good ones wink ) are "stored" on the disk surface, their address is written in a so-called G-list that has the address of the sector gone bad and the address of the "spare sector" to which it is re-mapped.
The G-list is in a part of the hard disk that is not normally accessible, if not by a dedicated program, cannot say if we can say that it is part of the "firmware" ?
This is unlikely
You see the Feds coming up the road and run your favourite cleaning software.
To completely wipe a hard disk takes several minutes, if not hours, with a single pass, let alone the 35 pass voodoo.
You'd better have some explosive or a way to generate a very, very strong magnetic field if you want to do a "quick" job.
jaclaz
In short, if you wipe a drive with dban 70 times you would need a miracle to get anything remotely useful from it.
I suspect there would be more chance of you simultaneously winning every lottery in the world on the same day as being struck by lightning and being abducted by aliens.
The swapped sectors would tend to contain your favourite data because they would take the most wear.
The read write heads float just above the disk surface so in a drive that is working correctly the sectors containing your most frequently accessed data get no wear at all.
If the read write heads do impact the disk surface then damage is pretty much guaranteed on the first occurence.
The read write heads float just above the disk surface so in a drive that is working correctly the sectors containing your most frequently accessed data get no wear at all.
I know the theory but at least one major manufacturer, Western Digital, thought that it was worth implementing what they called "wear levelling" whereby the heads were moved ever 15 seconds when the drive was not being accessed so that each track took its share of "wear".
If you used the inner Erase function of the ATA/SATA, all drive sectors, included those mapped as bad will be re-written, thus you need to have both the chance of the compromising data being on one of those very few sectors AND the internal 00 writing completely failing.jaclaz
The OP had specified the erasing software as dban PRNG stream, this does not use the ATA erase function. However "The current ATA specification for Normal Erase mode states that the SECURITY ERASE UNIT command shall write binary zeroes to all user accessible data areas. (ATA reassigned blocks are not user accessible because they have no user address)."
There is an Enhanced Erase Mode that will get the re-mapped sectors.
Hi,
Just wishing to inject a little humour into the post…….
- "Doctor Evil I have good news and bad news".
- "What's the good news Number 2?"
- "You've won the lottery in every country on the same day"
- "And what's the bad news?"
- "Austin Powers has successfully recovered the master plan from your 70 times wiped hard disk"……."May I suggest you put on your rubber soled wellies".
Sorry I couldn't resist.
Steve
lol
I think it is more likely to find useful data in bad sectors than an accidental MD5 collision, but much less likely than finding useful data in slack.
As mentioned, aside from design failures in your disk-wiping software (like not erasing bad sectors), in practice, people will not recover data from a drive simply erased once with zeros.
Hi,
Just wishing to inject a little humour into the post…….
- "Doctor Evil I have good news and bad news".
- "What's the good news Number 2?"
- "You've won the lottery in every country on the same day"
- "And what's the bad news?"
- "Austin Powers has successfully recovered the master plan from your 70 times wiped hard disk"……."May I suggest you put on your rubber soled wellies".
Sorry I couldn't resist.
Steve
Brilliant! - You've just made my day