Hi All,
Would anyone happen to have a list of hashes for wiping utilities (install.exe's and extracted files) they would be willing to share? I received a drive that was supposedly heavily used, but the 2nd partition is filled with zeros. Thinking there may have been some sort of wiping utility utilized.
Thanks much in advance.
A full format on Windows 7 (and possibly Vista?) will initialise sectors.
The partition could have just been formatted.
Is the whole partition zeros, or does it have a basic $MFT etc
It is a Windows 7 machine and it does have the basic post-formatted files on it. That might make sense then! This is actually the first windows 7 machine i've encountered, so I'll do some research on how it's formatting works (unless you have a good link you'd like to share). Many thanks.
A full format on Windows 7 (and possibly Vista?) will initialise sectors.
The partition could have just been formatted.
Doesn't formatting place a basic file system on the volume also? After all, that's what formatting is about – creating a volume boot record, and placing the file system of choice on the volume. A full formatting then proceeds to wipe remaining unused space, but the file system structures will be present.
If all sectors in the partition are zero, a wiping tool seems to make more sense, if there is evidence that the partition at some time did contain information. Otherwise, it may be that it never was formatted.