I have some questions about hard disk and deletion of files/fragmented files. If anyone could help me out if they have any answers to them. In the following, text means just regular ascii characters, no special formatting or anything. Thanks. So if files are stored on your hard drive by cluster. Cluster may or may not be multiple sectors, depending on O.S.. And say one of those files is only a portion of the cluster size. Is there some way, to be able to physically go to that cluster and write something else after that file on that hard drive space for that cluster; text or otherwise? Is there some program to allow someone to not only look at files but what may be written after them in a cluster on hard disk space, not as a file, but as text written to the disk? Also, say that a file was deleted, and a new file is written on that now "clean" cluster, but only part of the deleted file has been written over, would someone be able to retrieve that part of the deleted file as text or would they be able to not read any of it? Last question is; is it possible that if someone were to make a file the exact size of a cluster and then write that file to every cluster, would that effectively wipe the hard disk of all previously written information?
I have some questions about hard disk and deletion of files/fragmented files. If anyone could help me out if they have any answers to them. In the following, text means just regular ascii characters, no special formatting or anything. Thanks. So if files are stored on your hard drive by cluster. Cluster may or may not be multiple sectors, depending on O.S.. And say one of those files is only a portion of the cluster size. Is there some way, to be able to physically go to that cluster and write something else after that file on that hard drive space for that cluster; text or otherwise?
Yes, there are many commercial and freeware tools which will allow you to examine the hard disk and the files on it in that way, and some will allow you to modify the data in the slack space in the sector/cluster.
Is there some program to allow someone to not only look at files but what may be written after them in a cluster on hard disk space, not as a file, but as text written to the disk?
Most disk editing tools will allow the data on the hard disk to be examined as binary, and also viewed as text, as per a standard hex editor. Many will also allow you to cut and paste such sections to a new file.
Also, say that a file was deleted, and a new file is written on that now "clean" cluster, but only part of the deleted file has been written over, would someone be able to retrieve that part of the deleted file as text or would they be able to not read any of it?
Yes, that part of the file text can be retrieved if it has not been overwritten. n.b. following file deletion (and emptying from the recycle bin, if appropriate, depending on OS) the cluster would be considered to be unallocated, rather than clean (which normally implies that the data has been erased/overwritten/wiped).
Last question is; is it possible that if someone were to make a file the exact size of a cluster and then write that file to every cluster, would that effectively wipe the hard disk of all previously written information?
Yes, some disk cleaning tools do this, though many simply write directly to the disk rather than via the file system, in order to perform more thorough cleaning.
If you search online for descriptions of memory slack, file slack and data recovery, you should find lots of information describing exactly the processes you are asking about.
Hope that helps,
Phil.
Thanks, i'll try that
Just some additional notes
Cluster may or may not be multiple sectors, depending on O.S.
It depends more on the file system – FAT, for instance, will use different-sized clusters depending on how large the volume is, and FAT is supported by many OSes.
Is there some way, to be able to physically go to that cluster and write something else after that file on that hard drive space for that cluster; text or otherwise?
You need to go backwards from the cluster, to the file system, to figure out a) is the cluster the last one in the file, and b) how many bytes in that cluster are valid (file size modulo cluster size). Once you know, open the corresponding file in 'append' mode, and just write enough data to fill the cluster. Then, set file size back to what it was before you opened it.
In order to do this, you essentially need to be able to interpret the file system data structures by yourself.
Is there some program to allow someone to not only look at files but what may be written after them in a cluster on hard disk space, not as a file, but as text written to the disk?
Not sure what the difference is, but try HxD – freeware file and disk editor for Windows.
Last question is; is it possible that if someone were to make a file the exact size of a cluster and then write that file to every cluster, would that effectively wipe the hard disk of all previously written information?
No – but you may just have used the wrong term. Clusters are 'things' inside file systems, and file systems don't cover every sector of an entire disks. Thus, by writing clusters you can't overwrite a) the parts of the file system that are outside the cluster area, and b) the parts of the disk that are outside any file system.
Change the word 'cluster' to 'sector' instead, and you're home and dry by writing every sector on the disk, you can overwrite all of the hard disk. Well, almost all.
The only exception are the disk sectors that have been remapped (because of faults) to other sectors. They must be erased by other methods. The drive does this on its own – it requires special HDD commands to know what sectors have been remapped. Modern hard drives (ATA-type) have a built-in command for erasing *everything* 'SECURE ERASE'.