Used space in old e...
 
Notifications
Clear all

Used space in old erased overwritten HDD?

20 Posts
6 Users
0 Likes
1,846 Views
TuckerHST
(@tuckerhst)
Posts: 175
Estimable Member
 

Incidentally, it can't be a SATA disk. SATA isn't 12 years old. You must mean IDE aka PATA.

 
Posted : 29/01/2013 8:10 am
(@williamsonn)
Posts: 85
Trusted Member
Topic starter
 

thanks for your answer.

However,recycle bin´s space. appears on Recuva as 120kb only. The other files can ´t be visible?

 
Posted : 29/01/2013 3:33 pm
(@belkasoft)
Posts: 169
Estimable Member
 

Depending on your setup, you may have VSS (Volume Shadow Copy) stored on that disk as well. What's the new file system you put on it (FAT or NTFS)? NTFS per se occupies A LOT MORE space than FAT due to the many structures such as transaction log files. Either way, if you want a completely empty drive, you need to delete all partitions first… but how do you count free space then? The moment you format the drive with a file system, some space is already "wasted".

 
Posted : 29/01/2013 4:31 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

After you have wiped a hard disk there ARE NO partitions on it NOR filesystems (No drive letter, no other way to access anything if not by direct disk access).
When, after having wiped it, you partition the disk, and later format the partition(s) in it, you are writing new data to it.
Depending on the OS used, on the filesystem chosen, and a number of possible settings, besides the filesystem structures, som data like the pagefile or the Recycle bin may be added first time you boot with that disk attached and/or you merely access it,

WHAT is the point that you don't understand?
The wiping?
The partitioning?
The formatting of the partition(s)?

Try this
Wipe the disk clean. (as an example use Dban, single pass)
DO NOT re-partition/re-format it.
Access the disk through DMDE.
Create a partition on the disk.
Access the disk through DMDE.
Format the partition as FAT32.
Access the disk through DMDE.
RE-format the partition as NTFS.
Access the disk through DMDE.

You should be able to understand what is going on.

jaclaz

 
Posted : 29/01/2013 6:17 pm
(@williamsonn)
Posts: 85
Trusted Member
Topic starter
 

Dear friends

just arrived and read your messages. I have not the disk here at the moment and have little time. I will reply your messages tomorrow. Thanks wink

 
Posted : 30/01/2013 5:20 am
(@williamsonn)
Posts: 85
Trusted Member
Topic starter
 

Sorry for my delay. I´ll try to answer

I am not expert in this field at all. I am just learning a little, and due to this my many questions.
But my knowledge is near 0.

I thought that a deleted disk shouldn´t contain any file. Now, according what I understand from what you are telling me, an empty or deleted disk is NOT 100% empty as it contains files needed for the disk to work. It seems that the size of these files are different depending on tif the format have been made on fAT32 or NFTS. Is correct this understanding?

However, I wonder if I can see directly any of these files?

Thanks again for your messages,

 
Posted : 03/02/2013 2:10 am
(@belkasoft)
Posts: 169
Estimable Member
 

They are not necessarily "files"; for example, there is the file system on a disk that takes up space. There's no problem seeing it. Just use a low-level disk access tool (plenty of them), and you'll be able to analyze the content of the disk in binary mode.

 
Posted : 03/02/2013 1:44 pm
(@williamsonn)
Posts: 85
Trusted Member
Topic starter
 

Thanks for your answer. However, although that space is not necessarily composed by "files", Could part of it to be counted as such by a software like Recuva? As I mentioned out in other recent thread,a supposedly deleted disk, contains 250 ignored files according Recuva test.

 
Posted : 03/02/2013 6:08 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Thanks for your answer. However, although that space is not necessarily composed by "files", Could part of it to be counted as such by a software like Recuva? As I mentioned out in other recent thread,a supposedly deleted disk, contains 250 ignored files according Recuva test.

As you were told Recuva may count as "files" something that is not. (Recuva is NOT "the Bible" and it is a far too "automated/smart" tool to be used as a "reference").

I am not expert in this field at all. I am just learning a little, and due to this my many questions.
But my knowledge is near 0.

If you are interested in these matters you MUST study the very basics, it makes very little sense to ask "random" questions without an even minimal background.

You will simply miss the (needed) knowledge to fully understand the answers (and you will ask more questions, and more and more).

I suggested you a simple set of tests that you can easily perform and that will give you a general idea of what we are talking about. (in an attempt to have you learn by practice since you seem reluctant to learn by theory)

Until you have performed those tests it makes NO sense to try and explain you *everything* and this is probably NOT the "right place" for such a lengthy chore.

JFYI, it doesn't even makes much sense to use "generically" the term filesystem, as the two most common "types" of filesystems used in Windows NT OS's are completely different.
In FAT (12/16/32) *nothing* is a file (and filesystem structures are "before and outside" the actual file space.
In NTFS *everything* is a file (and filesystem structures are inside the actual file space).

If you want to try first a "learn by theory approach", then READ this (at the very least)
http//vlaurie.com/computers2/Articles/filesystems.htm
AND links thereby given.

Also, see if any of the analogies here
http//www.forensicfocus.com/Forums/viewtopic/t=5150/
help you.

jaclaz

 
Posted : 03/02/2013 7:33 pm
(@csericks)
Posts: 99
Trusted Member
 

"Jim, I said, 'The tricorder is picking up signs of life…' not /intelligent/ life!"

"Dammit, Jim! I'm a doctor…not an intergalactic miracle worker!"

 
Posted : 17/03/2013 10:02 am
Page 2 / 2
Share: