hello everyone!
We want to sell a few of my 2-3 years old laptops and pcs as we have upgraded to new models.
However we´d like to leave the computers -although obviously used- totally as new, so nobody, in the future although being and expert could not recover none of the old stored data.
We don´t know much about computers and even less about forensic. A friend, PC technician adviced us to ask forensic professionals, being the only ones knowing about this matter. So, we would like to ask the following questions.
a) Does a simple "System Recovery" leave a computer absolutely as if it is new or there are remnant significant data which can be recovered?
b) Would add any extra security, after system recovery, using a wiping tool for free space as dban or ccleaner?
b)We have been told about HPA DCO as certain hdd areas not accesible to wiping software Do these arears keep-store significant past user´s data which should be erased for a total secure wiping?
thank you very much
Wipe before then recover. Or do recover and wipe free space. Prefer the former however.
HPA/DCO does not store significant user data.
hello everyone!
However we´d like to leave the computers -although obviously used- totally as new, so nobody, in the future although being and expert could not recover none of the old stored data.
thank you very much
It all really depends upon the type of information upon the hard drive, and how you are going to dispose of the equipment.
for example a manufacturers reset can be sufficient in some circumstances.
however if I have a hard drive full of names, addresses, bank details, NI numbers, wage slips… I would create a full proof documented policy that would ensure data has been removed and verified by me that it has been removed. This is time consuming.
You could always for the cost element buy some new hard drives remove old ones JOB DONE !!!
mitch
So, it is not enough to wipe free space and then reinstalling Windows?
If it not so easy then, what to do withs hdds if I remove them? I suspect that data(if it is not so easy as I believed)will be there for ever! 😯
So, it is not enough to wipe free space and then reinstalling Windows?
If it not so easy then, what to do withs hdds if I remove them? I suspect that data(if it is not so easy as I believed)will be there for ever! 😯
It is actually very easy.
Do a single 00 pass on the whole disk.
Reinstall Windows or use the "recovery CD/DVD".
The advised method because it is faster and "more secure" is to use the INTERNAL ATA command SafeErase, through the DOS CMRR program
http//
or hdparm (under Linux as there are issues under Windows)
See (examples) here
http//
For the needs you have it may be easier to use a pre-made .iso with DBAN
http//
and/or make yourself a USB stick
http//
jaclaz
very interesting answers.
a)However, I am not sure of this If I use HDDERASE and reboot from a pendrive and erase all, I suppose I will totally lost in the future the option "System Recovery" and always I will have to install Windows fom the CD?
b)If my previous reasoning is correct, then, installing again Windows from the original CD will automatically install again the "recovery partition"?
c)What do you think for erasing purposes about certain software called BCWipe and ccleaner compared with HDDERASE?
Thank you!
a)However, I am not sure of this If I use HDDERASE and reboot from a pendrive and erase all, I suppose I will totally lost in the future the option "System Recovery" and always I will have to install Windows fom the CD?
Yes (or you can image the "system recovery" partition, and re-deploy it after the wipe).
b)If my previous reasoning is correct, then, installing again Windows from the original CD will automatically install again the "recovery partition"?
No, the "recovery partition" is not a "MS" or "Windows" standard, it is something the various OEM (independently) may or may not provide.
Additionally a "recovery partition" may be of two different "kinds"
- a "bare-metal" recovery one
- a "unattended" (or "partially attended") "install partition" one
IF it is the former, it may be a (compressed) image of the volume where windows was installed, and consequesntly there is not any need of wiping before re-applying, if th elatter, the wipe is *needed*.
c)What do you think for erasing purposes about certain software called BCWipe and ccleaner compared with HDDERASE?
Does the sentence "Search on the board, first" ring any bell?
Here, first few relevant results
http//www.forensicfocus.com/Forums/viewtopic/t=10233/
http//www.forensicfocus.com/Forums/viewtopic/t=9977/
http//www.forensicfocus.com/Forums/viewtopic/t=9821/
BTW, you were already given a link where the matter has been talked about to death.
Wiping a disk means to write 00's to each and every byte of it (of the "whole" device or "totally").
Point mught be if that is actually *needed* or partial wiping is enough for the scope at hand.
There are tens or hundreds softwares that can do that.
If the idea is to to "totally erase", then the internal ATA SafeErase command is
- Faster (takes way less time than any software)
- As thoroughful as it is possible (i.e. it can "reach" areas that a plainer software in some cases may not)
jaclaz
All right. All understood now about erasing the entire device on the one hand or wiping files and free space n the other hand.
As a partial wiping fills with random data all free space, and previously such a software also erases logs, cookies, etc. BUT NOT affects certain parts of the disks, i.e. DCO HPA G-Lists, the question now, for deciding if is better performing a partial wiping and then a system restore or reinstalling Windows, is Is there any sensitive, personal user tracks into these not wiped areas before mentioned which could be recovered? (same question referred both an used computer, and an eexternal used HDD).
All right. All understood now about erasing the entire device on the one hand or wiping files and free space n the other hand.
Not yet fully, but very near ) .
There are 4 "options"
- Entire disk
- Parts of the entire disk accessible by software (\\.\PhysicalDrive)
- Parts of the disk accessible as "volume" (please read as "drive letter" or \\.\LogicalDrive)
- Parts of the disk not used by files and filesystem.
[/listo]
#1 is "most secure" BUT unneeded in most cases.
#2 is "secure" BUT unneeded in most cases.
#3 is "secure enough" (and corresponds to running FORMAT on the volumes without the /q switch in recent - since Vista - Windows)
#4 is "largely insecure" because it only relies on the "wiping software" capabilities and features, but still it might be "secure enough", as long as it is a "good, reliable" software and if it doesn't "botch"anything.
(a computer that has been used a few years will most probably be at least partially "botched" by meaningless Registry entries, failed uninstalls, duplicates, failed KB updates and what not anyway).
Personally I wouldn't even THINK of trusting any of these apps, but that's me.
Options #1 to #3 require a new install (and are advised, though less convenient than #4)
As a partial wiping fills with random data all free space, and previously such a software also erases logs, cookies, etc.
Partial wiping partially writes 00's (and not random data wink ), random data is unneeded ( and BTW writing it will be slower), partial writing "random data" does that.
As said you have to rely on the fact that the Author of the software wipes (or writes random data to ) EVERYTHING that is not needed but not a single byte that is actually needed.
BUT NOT affects certain parts of the disks, i.e. DCO HPA G-Lists, the question now, for deciding if is better performing a partial wiping and then a system restore or reinstalling Windows, is Is there any sensitive, personal user tracks into these not wiped areas before mentioned which could be recovered? (same question referred both an used computer, and an eexternal used HDD).
No, normally even #3 is "good enough".
The only exception may be if some Virus (or malware) did run on the machine and stored a database of passwords/whatever in one of the less used and accessible areas.
jaclaz
Really, better understood now 😉
a) How is #2 performed?
b) #3 corresponds to a format(not quick format) that on vista, Windows 7 and 8 does perform a 0s wiping, correct?. This format is only done by inserting Windows CD (or using a Recovering System), or can be done from DOS using any command?
c) If I decided to make a copy of recovery partition and then installing after the new Windows installation has that partition to be wiped, or that one doesn´t contain any sensitive data?
d)As it seems that HPA/DCO nor G-lists do not contain any kind of data linked to the user nor his activity, then..what does it contain?
thank you )