Hardware

Ask something
Question Locked

Drive Wipe time.

0 helpful
6 replies

by bob.britt

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm pretty sure I know the answer to this but I'm going to ask anyway.

I have a hard drive that has been wiped, zeroed. Actually they wrote "c" to the hard drive. I don't want to recover the data, I want to know when it happened.

Is there any way to tell when a drive has been wiped out?

6 replies

by nepenthe0

The more times the hard drive is overwritten with random binary code, the less likely any recovery service could retrieve useful data. National intelligence agencies have very sophisticated means of data recovery despite so-called [i]formatting[/i] operations such as yours.

I am skeptical that [i]format [b]C[/b]:[/i] prevents data recovery by professionals who regularly do this.

If you are concerned about the sensitivity of data on the drive, your best solution is to destroy the drive:

http://tinyurl.com/62vrfv

If you intend simply to store the drive but wish to be as certain as possible that nothing is likely to be retrievable, you might try the free utility Darik's Nuke and Boot:

http://dban.sourceforge.net/

Rick/Portland, OR

by bob.britt

Or maybe I didn't word it right.

I know the drive has been wiped. I'm using a bootable CD with Ontrack easyrecovery enabled. Using their disk view utility I can see nothing but the character c written all over the drive, ever sector. I'm not interested in recovering data from this drive, I want to know when this wipe happened.

by cmiller5400

I'm not an expert in HDD recovery etc, but I don't think you will find the time stamp you are looking for anywhere on the drive.

by larryd4

To know when it was wiped would mean that the hardrive itself would need to have a log of occurances within the firmware/hardware itself, which I doubt it has. It may have a cache of commands performed but that probably is small and only keeps a certain number of events before purging.
Its been a while since I realy analyzed the info kept in the header tables of a drive. And it may have changed somewhat with the creation of SATA drives. But I really doubt that the hard drive manufacturers would make room for that type of auditing.

by bob.britt

Using different utilities to view the raw content of the drive I find nothing other than "c". The question was asked if we can tell when it was done, figured I would ask.

to view the cache as you stated would mean the drive would have to be dormant before auditing, I know it hasn't been because i've been banging on it and others have so unless it's huge cache, that info may have been lost wouldn't you think?

This discussion is closed to new replies.