20 Aug
2003
20 Aug
'03
6:46 p.m.
Norton had a program called wipedisk, which wrote to the whole drive, and
there are some shareware programs also. However, if you use Fdisk and
remove all the partitions, and then create a single partition, then do
a format /U/V then that will pretty much clean out everything. I have
heard from some sources that nothing is ever completely gone and No Such
Agency can actually pull data off a drive that was erased and reformatted.
I have a hard time believing that one. Are you concerned about security,
or just erasing and initializing the Drive?
Joe Heck
20 Aug
20 Aug
6:55 p.m.
TRASH3(a)splab.cas.neu.edu wrote:
a format /U/V then that will pretty much clean out everything. I have
heard from some sources that nothing is ever completely gone and No Such
Agency can actually pull data off a drive that was erased and reformatted.
I have a hard time believing that one.
I can believe that the data can still be recovered, but I would guess
that it would take some pretty specialized equipment to measure the
magnetic field accurately enough to recover data from a formatted disk.
I would guess that the hysterisis in writing to the disk would leave
some tell tale signs of the data that was erased.
21 Aug
21 Aug
5:15 a.m.
At 08:46 PM 8/20/03 -0700, you wrote:
TRASH3(a)splab.cas.neu.edu wrote:
That's true, if the data was truely erased. But FORMAT doesn't erase any
of the data. Use Debug, Norton Editor or any of the other disk utilities
and you can still read the data directly from the clusters. IIRC Norton
even had a utility in some of their early packages that would search the
"erased" areas of a hard drive for a given data string and then copy that
cluster to a file so that you had a good chance of recovering erased files
****even without the directory entry****. This was very handy in the days
before DOS 4(?). In the early DOSs the OS used the first available
directory entry on the drive so if you erased a file and then created a new
file, the new file would overwrite the directory entry for the erased one
and prevented you from un-erasing the original file. Later DOSs were
modified to use "empty" directory entries before using erased ones. That
greatly increased your chances of un-erasing a file at a later date since
the dirctory entry survived much longer.
Joe
a format /U/V then that will pretty much clean out everything. I have
heard from some sources that nothing is ever completely gone and No Such
Agency can actually pull data off a drive that was erased and reformatted.
I have a hard time believing that one.
I can believe that the data can still be recovered, but I would guess
that it would take some pretty specialized equipment to measure the
magnetic field accurately enough to recover data from a formatted disk.
I would guess that the hysterisis in writing to the disk would leave
some tell tale signs of the data that was erased. 
7:19 a.m.
If the LLF is not performed on IDE drives,
then I wonder wonder what Format does spend its time on?
I mean, on floppies a HLF takes about a second.
John A.
12:02 p.m.
At 12:09 PM 8/21/03 -0400, you wrote:
If the LLF is not performed on IDE drives,
then I wonder wonder what Format does spend its time on?
That's a good question. However there's a LOT of clusters on a modern HD
and it has to create FAT entries for all of them (actually TWO FATs) plus
create a directory. Perhaps it writes and verifies those areas of the drive
but not the data area.
But as Gene or Fred pointed out, a LLF format on the OLD MFM drives with
only 100 or 200 Mb or so took 12 plus hours to run. Imagine what it take
for a modern 80Gb drive! Yes, seek time has decreased but only about a
factor of two (18ms to about 9ms). FYI I just installed an 80Gb drive
night before last. It took well under an hour to partition AND HL format it.
I mean, on floppies a HLF takes about a second.
Then your system is a LOT faster than any I've seen. It takes at least a
minute (ball park,I haven't timed it) on all that I've seen.
Joe
John A.
1:25 p.m.
>If the LLF is not performed on IDE drives,
>then I wonder wonder what Format does spend its time on?
On Wed, 20 Aug 2003, Joe wrote:
That's a good question. However there's a
LOT of clusters on a modern HD
and it has to create FAT entries for all of them (actually TWO FATs) plus
create a directory. Perhaps it writes and verifies those areas of the drive
but not the data area.
It definitely does write all of the directory area (boot record,
FAT(s), DIR).
If the /Q option is active (now default?) then that is ALL that it does.
If /U is active, then it at least "VERIFIES" every cluster.
Please note: no matter what is misstated in a lot of manuals,
"VERIFY" does NOT compare the contents with what it should be!
"VERIFY" consists of nothing more than confirming that the CRC
of the data in the sector matches the CRC recorded in the header
of the sector.
I once had a malfunctioning floppy drive that would read,
but not write. ALL DOS operations claimed to be successful,
since it would NOT write, and then would successfully VERIFY
the contents of the sector that it did not write.
That's why in XenoCopy, I had both a VERIFY, and a COMPARE.
But as Gene or Fred pointed out, a LLF format on
the OLD MFM drives with
only 100 or 200 Mb or so took 12 plus hours to run. Imagine what it take
That was another Fred. But he was talking about how long SPINRITE took.
LLF is a lot faster, but still a long time.
For LLF, I think that Speedstor is a LOT better.
SPINRITE is good for trying to recover stuff that has a lot
of read errors.
One of the issues about SPINRITE was Gibson's attitude about
relative validity of manufacturer v field testing. He actually
believed that if the manufacturer said a sector was bad, but
that it read and wrote successfully, that it should be
"returned to service"! He later backed down on that, and
stopped making that the default. I figure that if the
manufacturer said, "don't trust this sector", that they would be right.
I mean, on
floppies a HLF takes about a second.
Then your system is a LOT faster than any
I've seen. It takes at least a
minute (ball park,I haven't timed it) on all that I've seen. 
2:04 p.m.
It definitely does write all of the directory area
(boot record,
FAT(s), DIR).
If the /Q option is active (now default?) then that is ALL that it does.
Later versions of DOS also do one additional interesting thing... they copy
the reserved sectors out to the end of the media (or partition for HDs),
where they can used by the UNFORMAT command to magically resuscitate an
accidentally formatted volume. I forget when that started...
Patrick
22 Aug
22 Aug
2:21 p.m.
Joe wrote:
Linux has two common tools for doing a high-level DOS format on
floppies - mformat and mkfs.msdos. Neither take more than 5 seconds to
operate. Usually more like 2.
A full format on a floppy from Windows 98 on my laptop (the only
dual-boot machine I have) takes nearly 90 seconds, and renders the
computer basically useless while it's going on. From Linux, "fdformat",
which does an LLF and block-level verify on a floppy, *and* mformat or
mkfs.msdos, takes about 45 seconds total, and doesn't slow down system
response much at all.
In short, I couldn't tell you why making a filesystem in DOS or
Windows occupies near-100% CPU for days. Any number of other operating
systems have proved it's not necessary.
Doc
At 12:09 PM 8/21/03 -0400, you wrote:
Building a MS-DOS FAT16 or FAT32 filesystem from Linux or
<name-your>BSD takes seconds on a hard disk partition, and Windows or
DOS have no problem with such a filesystem. I think DOS FORMAT just
needs to look busy. ;)
If the LLF is not performed on IDE drives,
then I wonder wonder what Format does spend its time on?
That's a good question. However there's a LOT of clusters on a modern HD
and it has to create FAT entries for all of them (actually TWO FATs) plus
create a directory. Perhaps it writes and verifies those areas of the drive
but not the data area.
But as Gene or Fred pointed out, a LLF format on the OLD MFM drives with
only 100 or 200 Mb or so took 12 plus hours to run. Imagine what it take
for a modern 80Gb drive! Yes, seek time has decreased but only about a
factor of two (18ms to about 9ms). FYI I just installed an 80Gb drive
night before last. It took well under an hour to partition AND HL format it. I mean, on
floppies a HLF takes about a second.
Then your system is a LOT faster than any I've seen. It takes at least a
minute (ball park,I haven't timed it) on all that I've seen.
21 Aug
21 Aug
5:15 a.m.
At 11:31 PM 8/20/03 -0400, you wrote:
Norton had a program called wipedisk, which wrote to
the whole drive, and
there are some shareware programs also. However, if you use Fdisk and
remove all the partitions, and then create a single partition, then do
a format /U/V then that will pretty much clean out everything. I have
heard from some sources that nothing is ever completely gone and No Such
Agency can actually pull data off a drive that was erased and reformatted.
I have a hard time believing that one.
It's true. Formatting a hard disk only creates a new FAT and Directory.
All the data areas are intact.* It would be hard to reconstruct a file
without the linkages and knowing it's starting cluster but it can be done.
It's not too difficult on an ASCII file since the data is recognizable but
it would be a lot more difficult for binary files. But it COULD be done.
But unless you're a drug dealer or porn king it's probably not worth
worrying about. Wipefile should take care of any concerns that you have. If
you want to be REAL sure then take the drive and destroy it, particurly the
platter(s). I had a customer that wanted to be SURE that none of her data
could be recovered. I told her to take an AXE to the drive. She called me
later and thanked me. She said that she really enjoyed taking out all of
her computer frustrations on that drive!
*MACE utilities used to have a utility to "un-format" a hard drive. It
relied on previously running a program that copied the FAT and DIR to a
known safe area of the drive. Unformatting became nothing more that reading
that area of the drive and copying it back to the FAT and DIR.
Joe
Are you concerned about security,
or just erasing and initializing the Drive?
Joe Heck
7618
days inactive
7620
days old
8 comments
7 participants
participants (7)
-
allain＠panix.com -
cisin＠xenosoft.com -
doc＠mdrconsult.com -
marvin＠rain.org -
patrick＠evocative.com -
rigdonj＠cfl.rr.com -
TRASH3＠splab.cas.neu.edu