I have wiped a hard drive in Encase and checked it afterwards. All sectors were wiped and zeroed as it should be, except for one which is the sector 0. Its contents are still the same and contains the information before the wiping. Apparently, Encase does not touch sector 0 even if you want the hdd to be completely wiped.
Do you know why?
try to disable autorun option and wipe again, maybe Encase done the wiping and then the OS find and initialized "new" disk.
No, it was not autorun. It was something else, because after the wiping I checked the hard drive with Encase and saw that it was not touched. And then I initialized the disk.
Anyway, I wiped it again and the results were still inconsistent. This time it wiped sector 0 but left many other sectors untouched.
Finally, I did the wiping in another worktation and it worked fine. All sectors were wiped.
Bear in mind, almost anything could influence the operation of forensic software thus affect your examination and results.
I never use the Wipe function in EnCase since there are a whole host of other, simpler, tools which are as effective, if not more and, usually, my EnCase system is busy doing things that EnCase does particularly well while I can use a cheap PC or hardware device like ImageMasster to handle wiping.. This is not to knock EnCase it is just that for a simple task like wiping I like to use an easily documented tool designed specifically for that purpose,
If you have SIFT or Helix or any of a dozen other Linux distros, you can do an effective wipe with the DD command which is simple and fast, or you can use DBAN which is thorough but slow.
I have wiped a hard drive in Encase and checked it afterwards. All sectors were wiped and zeroed as it should be, except for one which is the sector 0. Its contents are still the same and contains the information before the wiping. Apparently, Encase does not touch sector 0 even if you want the hdd to be completely wiped.
Do you know why?
The answer is probably to find in your setup, not in EnCase.
For instance, on systems with boot sector protection (in BIOS or through some kind of security software), it may be impossible to erase sector 0, no matter if you use EnCase or some other program.
But if you have other reasons for suspecting EnCase, ask in the Guidance EnCase support forum.