I know about wiping the disk, but what about the MBR and Partition tables ?

  • Thread starter Thread starter nh2
  • Start date Start date
N

nh2

You can, of course, wipe your hard disk with complicated software that
do more or less their jobs.

let's say I am working on an important project. Company wise.

I delete the partition, remove all partitions and wipe the hard drive
from DOS.

Now, if someone installs an OS over it with a new partition, can't he
dig up a MFT mirror from the hard disk or collect MBR records and logs
that are present on certain physical parts of the hard disk ?

If is able to, maybe he can't get back the files, but at least, he
knows the names of the files, and the directory structure of past
partition tables.
 
You can, of course, wipe your hard disk with complicated software that
do more or less their jobs.

let's say I am working on an important project. Company wise.

I delete the partition, remove all partitions and wipe the hard drive
from DOS.

Now, if someone installs an OS over it with a new partition, can't he
dig up a MFT mirror from the hard disk or collect MBR records and logs
that are present on certain physical parts of the hard disk ?

If is able to, maybe he can't get back the files, but at least, he
knows the names of the files, and the directory structure of past
partition tables.
Click to expand...

Yes, but only in weeks with two Wednesdays.

Assuming wiping means writing zeroes to the entire disk.
 
nh2 said:
You can, of course, wipe your hard disk with complicated software that
do more or less their jobs.
Click to expand...

Or very simple software. IBM used to have a utility called "zerodisk" on
their site that ran from a DOS command prompt, took no parameters, and
wrote zeroes over the entire disk. About as simple as it gets.
let's say I am working on an important project. Company wise.

I delete the partition, remove all partitions and wipe the hard drive
from DOS.
Click to expand...

If you mean you erase all the files, that doesn't remove any data from the
disk, if you mean format that clears the FAT and directory structure but
doesn't remove any data beyond that.
Now, if someone installs an OS over it with a new partition, can't he
dig up a MFT mirror from the hard disk or collect MBR records and logs
that are present on certain physical parts of the hard disk ?
Click to expand...

Depends on the OS, it may wipe enough information to make this difficult.
But someone who is going after your data won't install an OS on the disk
he's attacking, he'll connect it to a machine that has an OS already
installed.
If is able to, maybe he can't get back the files, but at least, he
knows the names of the files, and the directory structure of past
partition tables.
Click to expand...

The only way to be absolutely sure the data won't be recovered is to
physicially destroy the surfaces of the platters by grinding off the
magnetic coating or melting them down.
 
If is able to, maybe he can't get back the files, but at least, he
knows the names of the files, and the directory structure of past
partition tables.
Click to expand...

It is possible to get back partial directory or even files that you
deleted. If you really want to destroy the file and the partition,
I'd suggest a program called mutilate file wiper. It's available for
free (trial) and if you use high security setting, it'd be close to
the level for government file destruction. There is a time limit on
trial version so higher wipe setting or wiping really big hard drive
may not work.
 
Ok. Thanks for your answers. I thout wiping doesn't write where the
MFT and MFT Mirror log files and MBR are located.
 
Previously J. Clarke said:
nh2 wrote:
Click to expand...
Or very simple software. IBM used to have a utility called "zerodisk" on
their site that ran from a DOS command prompt, took no parameters, and
wrote zeroes over the entire disk. About as simple as it gets.
Click to expand...


Should be enough, unless
a) an attacker suspects what on that specific disk
b) an attacker can spend a lot of money on the small chance of
reading something.

Today the only real risk are reallocated defect
sectors, since they are not wiped. But the chance of some useful
information residing is small and getting to tem is complicated.

Arno
 
Back
Top