Previously Danny Jenkins <dannyjenkins.RemoveThis@ziplip.com> wrote:
> I was advised that in addition to fdisking and formating a hard disk
> drive I should do the following, then fdisk and format again. Are the
> following instructions a sure-fire way of erasing data?
This is rather unreliable. First, it depends on the BIOS seeing the
whole drive. That is not necessarily the case. Int 13 classic sees
only the first 504MB. Since modern OSes do their own disk access the
BIOS only needs to see the beginning of the drive where the boot code
is usually located.
On a closer look into the code below, it does not overwrite the drive
at all! It rather overwrites sector 1 on disk one single
time. You can recover from this. It requires finding the partition
boundaries but is feasible. (If sector 1 is the partition
table, I am not quite sure, since it has been a long time
since I did BIOS calls. If it is the MBR, a rescue floppy/CD
is all it takes fro recovery.)
Fdisk and format will also not erase any data. They will just
remove the administrative information.
Whoever told you to use this for disk erasure does not know
anything about the subject or lied to you.
In addition there is no sure-fire way for disk erasure.
Commercial data recovery companies claim they cannot recover
a single overwrite, and given todays drives that may or may
not be true. There is valid speculation that with enough effort
iy may be possible to recover from one or even a few overwrites.
However that would be expensive and tedious.
My advice: Use one overwrite with zeroes to protect against
most attackers. If you have really important data on the disk
overwrite several times with random data. If it is even
more important destroy the disk physically afterwards. Just
burning a disk is often not enough. Recovery from that is
something data recovery companies can often do. You need to
shred or melt it to be safe.
Best tool for overwrite: Linux.
I use knoppix (-> google) and dd_rescue for this type of task
Boot, go into root shell and do
dd_rescue -w /dev/zero /dev/hda
Overwrites with zeroes and gives you a nice progress indicator
and tells you how much data has actually been overwritten.
Repeat as needed and with /dev/urandom in the first argument for
random data.
Regards,
Arno
> -----
> Enter the following lines at the debug prompt (-) followed by the
> enter key.
> Note: this completely erases the MBR and your whole drive.
> F 200 L200 0
> a 100
> mov ax,301 [note from here on you may see a number like fff:1234
> [type all commands next to this number
> [do _not_ press enter when this number appears.
> mov bx,200
> mov cx,1
> mov dx,0080 [note: use 0081 for second fixed disk
> int 13
> int 3
> (enter a blank line here)
> G=100
> q
--
For email address: lastname AT tik DOT ee DOT ethz DOT ch
GnuPG: ID:1E25338F FP:0C30 5782 9D93 F785 E79C 0296 797F 6B50 1E25 338F
"The more corrupt the state, the more numerous the laws" - Tacitus<!-- ~MESSAGE_AFTER~ -->
>> Stay informed about: Any better way to wipe data from a HDD? 
FAQ
Profile
Private Messages
Log in
