If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Rate Thread | Display Modes |
#1
|
|||
|
|||
What is the best way to wipe the free space.
Security software can wipe the free space of a drive, but this takes
time and the wipe is never complete. Is it better to take an image of the drive to and external one, and then wipe all of the original drive completely, and then restore the image? (Assuming the imaging procedure backs up only undeleted material.). Peter |
Ads |
#2
|
|||
|
|||
What is the best way to wipe the free space.
On 12/8/2015 7:41 PM, Peter Jason wrote:
Security software can wipe the free space of a drive, but this takes time and the wipe is never complete. Is it better to take an image of the drive to and external one, and then wipe all of the original drive completely, and then restore the image? (Assuming the imaging procedure backs up only undeleted material.). Peter The devil is in the details. Exactly what are you trying to accomplish??? I've been using DataEraser. http://www.ss-tools.com/data-eraser/ It optionally wipes the free space and/or the stuff left over between the end of the file and the end of the cluster. IIRC, the free version only overwrites once, while the paid version can do multiple writes. My assumption is that you can't recover much without disassembling the drive. Oughta be plenty good for casual users. |
#3
|
|||
|
|||
What is the best way to wipe the free space.
Peter Jason wrote:
Security software can wipe the free space of a drive, but this takes time and the wipe is never complete. Is it better to take an image of the drive to and external one, and then wipe all of the original drive completely, and then restore the image? (Assuming the imaging procedure backs up only undeleted material.). Peter I would think that the free space should be wiped BEFORE making a drive image. |
#4
|
|||
|
|||
What is the best way to wipe the free space.
On Wed, 09 Dec 2015 14:41:34 +1100, Peter Jason wrote:
Security software can wipe the free space of a drive, but this takes time and the wipe is never complete. Is it better to take an image of the drive to and external one, and then wipe all of the original drive completely, and then restore the image? (Assuming the imaging procedure backs up only undeleted material.). Peter I'm a little confused as to what you are doing. If you restore the image what exactly is it you seek to protect. If you are keeping the machine why do you care about erased clusters. If you are disposing of the drive, then physical destruction is quicker and safer. In lieu of that, there are many free utilities that will wipe the whole drive. Despite the plethora of folks in this and other groups that can readily recover overwritten data I will believe it when I see it. If we are talking about folks in the NSA or FBI then you are posting in the wrong group. |
#5
|
|||
|
|||
What is the best way to wipe the free space.
On Wed, 09 Dec 2015 14:41:34 +1100, Peter Jason wrote:
Security software can wipe the free space of a drive, but this takes time and the wipe is never complete. Is it better to take an image of the drive to and external one, and then wipe all of the original drive completely, and then restore the image? Modern drives typically have an erase operation to do its best job of erasing (which might not work perfectly, even though they give an error message it they think things didn't work. This Before cloning/imaging/copying the data back, you might want to set it to use drive based encryption. That way you won't have to worry when ultimately disposing of the drive later, (Assuming the imaging procedure backs up only undeleted material.). For cloning and imaging copying only the undeleted only it the typical goal, but cloning often gets extra stuff in the metadata since it is trying to preserve everything that is needed. Imaging probably doesn't get extra meta data, but probably doesn't work correctly when file by file copying wouldn't work in the first place. The problem is that some cloning programs copy complete clusters, even though they are not fully used in the current file. Therefore I would run www.briggsoft.com Puffer to Wipe "Slack..." or other program after cloning back the data. This will get rid of stuff at the end; I'm not sure that you can get partial clusters in the middle of files, but perhaps you can with sparse files, in which case I don't know of a program to fix things. Also, I don't know what happens to stuff in unused metadata areas ($MFT, $MFTMirr). There might be stuff there, so you might have to use EAST Technologies East-Tec Eraser or similar program to get rid of that stuff, but I don't know if any of those programs actually work completely. If a partition is data only, you may get better results by using a file copy program to get things back to the original disk. I use Syncovery. Peter |
#6
|
|||
|
|||
What is the best way to wipe the free space.
(OOPS - hit send before finishing. Look for "{insert here}"
in 2 places below.) On Wed, 09 Dec 2015 18:20:36 -0500, Mark F wrote: On Wed, 09 Dec 2015 14:41:34 +1100, Peter Jason wrote: Security software can wipe the free space of a drive, but this takes time and the wipe is never complete. Is it better to take an image of the drive to and external one, and then wipe all of the original drive completely, and then restore the image? {insert here} First make the clone/image/copy. Then use the erase everything including spares/overprovisioning command. Modern drives typically have an erase operation to do its best job of erasing (which might not work perfectly, even though they give an error message it they think things didn't work. This {insert here} takes about as long as it takes to write the entire disk. Many modern drives have a cryptographic erase, which trashes the encryption key, so a cryptographically secure erase is very fast. Often, if the drive supports encryption it is always encrypted, even though key entry isn't needed. The problem is that if there is a back door, then things might not really be gone. There is also the issue of data in the cache chips on the board and data on hidden blocks of the disk for firmware and such. Perhaps there is leftover data there from the old contents of the drive that hangs around. {SSDs also typically have a cryptographic erase and an erase everything [including the overprovisioning/spares] operations. Again, firmware and cache is not included in "everything including overprovisioning/spares", so there could possibly be data that lingers for spinning and non-spinning.} Before cloning/imaging/copying the data back, you might want to set it to use drive based encryption. That way you won't have to worry when ultimately disposing of the drive later, (Assuming the imaging procedure backs up only undeleted material.). For cloning and imaging copying only the undeleted only it the typical goal, but cloning often gets extra stuff in the metadata since it is trying to preserve everything that is needed. Imaging probably doesn't get extra meta data, but probably doesn't work correctly when file by file copying wouldn't work in the first place. The problem is that some cloning programs copy complete clusters, even though they are not fully used in the current file. Therefore I would run www.briggsoft.com Puffer to Wipe "Slack..." or other program after cloning back the data. This will get rid of stuff at the end; I'm not sure that you can get partial clusters in the middle of files, but perhaps you can with sparse files, in which case I don't know of a program to fix things. Also, I don't know what happens to stuff in unused metadata areas ($MFT, $MFTMirr). There might be stuff there, so you might have to use EAST Technologies East-Tec Eraser or similar program to get rid of that stuff, but I don't know if any of those programs actually work completely. If a partition is data only, you may get better results by using a file copy program to get things back to the original disk. I use Syncovery. Peter |
Thread Tools | |
Display Modes | Rate This Thread |
|
|