How much data is a "head"

I made the mistake of assuming with a software program that said it
would "wipe the head" as meaning wipe the free space. Well I lost data that
testfile (testdisk?) program couldn't even get back for me. How much data is
a "head"?

Bill

Bill Cunningham wrote:
I made the mistake of assuming with a software program that said it
would "wipe the head" as meaning wipe the free space. Well I lost data that
testfile (testdisk?) program couldn't even get back for me. How much data is
a "head"?

Bill



Try the following.

1) Get a copy of "dd".

http://www.chrysocome.net/downloads/dd-0.6beta3.zip

2) Use "dd --list" to get the names of the partitions and disks.

3) Take a sample from the erased disk. Change the harddisk_N number
as appropriate.

dd if=\\?\Device\Harddisk0\Partition0 of=C:\downloads\out.dd bs=65536 count=16384

In Disk Management, that would capture the first disk in the list
(the first disk is Harddisk0), starting at the MBR (Sector 0)
and continuing for 1GB.

4) With a hex editor

hexedit C:\downloads\out.dd

5) Do you see all zeros ? Do you see a random data pattern ?
Did you find an "NTFS" string in there ?

That will tell you what you've lost (and is not coming back).

The size of 1GB, is selected so the hex editor can fit the
entire thing into computer RAM. The hex editor I have (a free
one), is limited to no more than 2GB max, so the software
is limited by the OS limitations too.

If only the MBR had been erased, TestDisk would find the
stuff again. My guess would be, you lost as much stuff,
as you allowed time for the program to erase the drive.

I'm sure the provider of the software program,
is now laughing in their sock. There are mean people everywhere.

Within reason, you could have wiped the free space yourself,
with no fancy tools at all. Simply copy files until the disk
is full, then throw them in the trash. That will overwrite
the white space.

The program fsutil can do this, but an oversight is it
uses sparse techniques on NTFS disks. It writes "real" files
to FAT32. It writes "fake" "useless" files to NTFS. Consequently
fsutil cannot be used for cleaning, on NTFS.

The "dd" program can write an empty file too.

dd if=/dev/zero of=C:\bigfile00.dd bs=65536 count=16384

That would write a blank 1GB file. If you had 20GB of space
to erase, you would do that 20 times total.

dd if=/dev/zero of=C:\bigfile19.dd bs=65536 count=16384

On FAT32, the biggest file would be like this. Slightly
less than 4GB.

dd if=/dev/zero of=C:\bigfile00.dd bs=65536 count=65535

On NTFS, you can wipe the white space in one command.
This runs until it runs out of space (and says that
on the Command Prompt screen).

dd if=/dev/zero of=C:\bigfile.dd bs=65536
del C:\bigfile.dd

Now the white space is minty fresh on your NTFS partition,
and no undelete programs can be used to find recently
deleted files. The command won't touch files currently
on the disk. You "del" the file afterwards, to make
the space available for storing real files.

Paul

In message , Bill Cunningham
writes:
I made the mistake of assuming with a software program that said it
would "wipe the head" as meaning wipe the free space. Well I lost data that
testfile (testdisk?) program couldn't even get back for me. How much data is
a "head"?

Bill


What was this program _supposed_ to do - wipe free space?

Based purely on those three words, I'm guessing that it wiped the header
information, either of the hard disc or some files. If it was only file
headers, there are utilities that can find remaining "tails" and recover
them.

What was the prog.?

Of course, see Paul's reply for a very complete solution! I just thought
that the above questions ought to be asked (if only to warn the rest of
us!).
--
J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf

What a strange illusion it is to suppose that beauty is goodness. -Leo Tolstoy,
novelist and philosopher (1828-1910)

"J. P. Gilliver (John)" wrote in message
...

What was this program _supposed_ to do - wipe free space?

Based purely on those three words, I'm guessing that it wiped the header
information, either of the hard disc or some files. If it was only file
headers, there are utilities that can find remaining "tails" and recover
them.

What was the prog.?

Of course, see Paul's reply for a very complete solution! I just thought
that the above questions ought to be asked (if only to warn the rest of
us!).

The program mbrwiz64 said it would wipe the head. To me a little
ambiguous. but to them maybe straight forward. It did not specifically say
just the "free space" and not touch your data. So I and I am taking
responsibility for not backing data. I keyed before thinking and used it to
"wipe the head". It did so. Of all data. No warning "Are you sure you want
to delete all data?" like you see in some programs. This one just went to
work. dd is a nice program. I am very familiar with it on *nixes and only
recently started using the windows port. It works vrey nicely.

Bill

"Paul" wrote in message
...
Bill Cunningham wrote:
I made the mistake of assuming with a software program that said it
would "wipe the head" as meaning wipe the free space. Well I lost data
that testfile (testdisk?) program couldn't even get back for me. How much
data is a "head"?

Bill



Try the following.

1) Get a copy of "dd".

http://www.chrysocome.net/downloads/dd-0.6beta3.zip

2) Use "dd --list" to get the names of the partitions and disks.

3) Take a sample from the erased disk. Change the harddisk_N number
as appropriate.

dd if=\\?\Device\Harddisk0\Partition0 of=C:\downloads\out.dd bs=65536
count=16384

In Disk Management, that would capture the first disk in the list
(the first disk is Harddisk0), starting at the MBR (Sector 0)
and continuing for 1GB.

4) With a hex editor

hexedit C:\downloads\out.dd

5) Do you see all zeros ? Do you see a random data pattern ?
Did you find an "NTFS" string in there ?

That will tell you what you've lost (and is not coming back).

The size of 1GB, is selected so the hex editor can fit the
entire thing into computer RAM. The hex editor I have (a free
one), is limited to no more than 2GB max, so the software
is limited by the OS limitations too.

If only the MBR had been erased, TestDisk would find the
stuff again. My guess would be, you lost as much stuff,
as you allowed time for the program to erase the drive.

I'm sure the provider of the software program,
is now laughing in their sock. There are mean people everywhere.

Within reason, you could have wiped the free space yourself,
with no fancy tools at all. Simply copy files until the disk
is full, then throw them in the trash. That will overwrite
the white space.

The program fsutil can do this, but an oversight is it
uses sparse techniques on NTFS disks. It writes "real" files
to FAT32. It writes "fake" "useless" files to NTFS. Consequently
fsutil cannot be used for cleaning, on NTFS.

The "dd" program can write an empty file too.

dd if=/dev/zero of=C:\bigfile00.dd bs=65536 count=16384

That would write a blank 1GB file. If you had 20GB of space
to erase, you would do that 20 times total.

dd if=/dev/zero of=C:\bigfile19.dd bs=65536 count=16384

On FAT32, the biggest file would be like this. Slightly
less than 4GB.

dd if=/dev/zero of=C:\bigfile00.dd bs=65536 count=65535

On NTFS, you can wipe the white space in one command.
This runs until it runs out of space (and says that
on the Command Prompt screen).

dd if=/dev/zero of=C:\bigfile.dd bs=65536
del C:\bigfile.dd

Now the white space is minty fresh on your NTFS partition,
and no undelete programs can be used to find recently
deleted files. The command won't touch files currently
on the disk. You "del" the file afterwards, to make
the space available for storing real files.

Paul

Where are you getting numbers like 65536 and 16384 ? Does this have
anything to do with a "head"?

Bill

Bill Cunningham wrote:
"Paul" wrote in message
...
Bill Cunningham wrote:
I made the mistake of assuming with a software program that said it
would "wipe the head" as meaning wipe the free space. Well I lost data
that testfile (testdisk?) program couldn't even get back for me. How much
data is a "head"?

Bill


Try the following.

1) Get a copy of "dd".

http://www.chrysocome.net/downloads/dd-0.6beta3.zip

2) Use "dd --list" to get the names of the partitions and disks.

3) Take a sample from the erased disk. Change the harddisk_N number
as appropriate.

dd if=\\?\Device\Harddisk0\Partition0 of=C:\downloads\out.dd bs=65536
count=16384

In Disk Management, that would capture the first disk in the list
(the first disk is Harddisk0), starting at the MBR (Sector 0)
and continuing for 1GB.

4) With a hex editor

hexedit C:\downloads\out.dd

5) Do you see all zeros ? Do you see a random data pattern ?
Did you find an "NTFS" string in there ?

That will tell you what you've lost (and is not coming back).

The size of 1GB, is selected so the hex editor can fit the
entire thing into computer RAM. The hex editor I have (a free
one), is limited to no more than 2GB max, so the software
is limited by the OS limitations too.

If only the MBR had been erased, TestDisk would find the
stuff again. My guess would be, you lost as much stuff,
as you allowed time for the program to erase the drive.

I'm sure the provider of the software program,
is now laughing in their sock. There are mean people everywhere.

Within reason, you could have wiped the free space yourself,
with no fancy tools at all. Simply copy files until the disk
is full, then throw them in the trash. That will overwrite
the white space.

The program fsutil can do this, but an oversight is it
uses sparse techniques on NTFS disks. It writes "real" files
to FAT32. It writes "fake" "useless" files to NTFS. Consequently
fsutil cannot be used for cleaning, on NTFS.

The "dd" program can write an empty file too.

dd if=/dev/zero of=C:\bigfile00.dd bs=65536 count=16384

That would write a blank 1GB file. If you had 20GB of space
to erase, you would do that 20 times total.

dd if=/dev/zero of=C:\bigfile19.dd bs=65536 count=16384

On FAT32, the biggest file would be like this. Slightly
less than 4GB.

dd if=/dev/zero of=C:\bigfile00.dd bs=65536 count=65535

On NTFS, you can wipe the white space in one command.
This runs until it runs out of space (and says that
on the Command Prompt screen).

dd if=/dev/zero of=C:\bigfile.dd bs=65536
del C:\bigfile.dd

Now the white space is minty fresh on your NTFS partition,
and no undelete programs can be used to find recently
deleted files. The command won't touch files currently
on the disk. You "del" the file afterwards, to make
the space available for storing real files.

Paul

Where are you getting numbers like 65536 and 16384 ? Does this have
anything to do with a "head"?

Bill

One of the numbers is:

1) A power of two.
2) Less than the limit for a single command to a disk drive.
3) Large enough to be efficient (good megabytes/sec rating).

The default value is 512. And a bit slow.

Paul

On Sun, 7 Jun 2015 21:56:13 -0400, "Bill Cunningham"
wrote:

The program mbrwiz64 said it would wipe the head. To me a little
ambiguous. but to them maybe straight forward. It did not specifically say
just the "free space" and not touch your data. So I and I am taking
responsibility for not backing data. I keyed before thinking and used it to
"wipe the head". It did so. Of all data. No warning "Are you sure you want
to delete all data?" like you see in some programs. This one just went to
work. dd is a nice program. I am very familiar with it on *nixes and only
recently started using the windows port. It works vrey nicely.

You seem to have misread the text. What the web site
(http://mbrwizard.com/reference.php) says is "/Wipe=x - Selecting an
option of 'mbr' will wipe the MBR clean, 'head' will wipe the first
head or 63 sectors, and a range of sectors from x to y can be wiped by
specifying /Wipe=x-y. This will effectively remove all information
from the specified sectors of the disk. See example."

You really should try to understand the documentation before using a
tool.

--
Remove del for email

"Barry Schwarz" wrote in message
...

You seem to have misread the text. What the web site
(http://mbrwizard.com/reference.php) says is "/Wipe=x - Selecting an
option of 'mbr' will wipe the MBR clean, 'head' will wipe the first
head or 63 sectors, and a range of sectors from x to y can be wiped by
specifying /Wipe=x-y. This will effectively remove all information
from the specified sectors of the disk. See example."

You really should try to understand the documentation before using a
tool.

So a head is 63 sectors then. So is the size of these sectors 512 bytes
as is the LBA sector? Is the head's sectors in the same place as the LBA
sectors?

Bill

On Mon, 8 Jun 2015 12:02:07 -0400, "Bill Cunningham"
wrote:


"Barry Schwarz" wrote in message
.. .

You seem to have misread the text. What the web site
(http://mbrwizard.com/reference.php) says is "/Wipe=x - Selecting an
option of 'mbr' will wipe the MBR clean, 'head' will wipe the first
head or 63 sectors, and a range of sectors from x to y can be wiped by
specifying /Wipe=x-y. This will effectively remove all information
from the specified sectors of the disk. See example."

You really should try to understand the documentation before using a
tool.

So a head is 63 sectors then. So is the size of these sectors 512 bytes
as is the LBA sector? Is the head's sectors in the same place as the LBA
sectors?

NO! There is no such thing as a "head". "head" is a keyword with a
particular meaning for this program. If the same keyword is used by a
different program it could have a different meaning. Consider the
difference between how head is used by this program and the standard
Unix head command.

--
Remove del for email

"Barry Schwarz" wrote in message
...
On Mon, 8 Jun 2015 12:02:07 -0400, "Bill Cunningham"
wrote:


"Barry Schwarz" wrote in message
. ..

You seem to have misread the text. What the web site
(http://mbrwizard.com/reference.php) says is "/Wipe=x - Selecting an
option of 'mbr' will wipe the MBR clean, 'head' will wipe the first
head or 63 sectors, and a range of sectors from x to y can be wiped by
specifying /Wipe=x-y. This will effectively remove all information
from the specified sectors of the disk. See example."

You really should try to understand the documentation before using a
tool.

So a head is 63 sectors then. So is the size of these sectors 512
bytes
as is the LBA sector? Is the head's sectors in the same place as the LBA
sectors?

NO! There is no such thing as a "head". "head" is a keyword with a
particular meaning for this program. If the same keyword is used by a
different program it could have a different meaning. Consider the
difference between how head is used by this program and the standard
Unix head command.

Well yeah but what about HDD geometry. I know it's old but that's it's
meaning here isn't it? I know they don't go by that in actuality anymore.
But I know there is "63 sectors" or was at one time. Now the HDDs go by LBA.

Bill

On Mon, 8 Jun 2015 15:32:50 -0400, "Bill Cunningham"
wrote:


"Barry Schwarz" wrote in message
.. .
On Mon, 8 Jun 2015 12:02:07 -0400, "Bill Cunningham"
wrote:


"Barry Schwarz" wrote in message
...

You seem to have misread the text. What the web site
(http://mbrwizard.com/reference.php) says is "/Wipe=x - Selecting an
option of 'mbr' will wipe the MBR clean, 'head' will wipe the first
head or 63 sectors, and a range of sectors from x to y can be wiped by
specifying /Wipe=x-y. This will effectively remove all information
from the specified sectors of the disk. See example."

You really should try to understand the documentation before using a
tool.

So a head is 63 sectors then. So is the size of these sectors 512
bytes
as is the LBA sector? Is the head's sectors in the same place as the LBA
sectors?

NO! There is no such thing as a "head". "head" is a keyword with a
particular meaning for this program. If the same keyword is used by a
different program it could have a different meaning. Consider the
difference between how head is used by this program and the standard
Unix head command.

Well yeah but what about HDD geometry. I know it's old but that's it's
meaning here isn't it? I know they don't go by that in actuality anymore.
But I know there is "63 sectors" or was at one time. Now the HDDs go by LBA.

We are not discussing geometry. We are addressing issues arising out
of your misuse of a particular program.

--
Remove del for email

"Barry Schwarz" wrote in message
...

We are not discussing geometry. We are addressing issues arising out
of your misuse of a particular program.

We are are we? I don't think so. There's nothing to discuss concerning
that. I admitted I made a mistake. This post was about HD geometry.

Bill

On Mon, 8 Jun 2015 19:03:18 -0400, "Bill Cunningham"
wrote:


"Barry Schwarz" wrote in message
.. .

We are not discussing geometry. We are addressing issues arising out
of your misuse of a particular program.

We are are we? I don't think so. There's nothing to discuss concerning
that. I admitted I made a mistake. This post was about HD geometry.

The post I was responding to said

On Sun, 7 Jun 2015 21:56:13 -0400, "Bill Cunningham"
wrote:

The program mbrwiz64 said it would wipe the head. To me a little
ambiguous. but to them maybe straight forward.

I must have missed the message where you shifted from the use of a
particular program to a discussion of HD geometry. Maybe next time
you could change the subject of the message when you change the topic
of discussion.

--
Remove del for email

"Barry Schwarz" wrote in message
...
On Mon, 8 Jun 2015 19:03:18 -0400, "Bill Cunningham"
wrote:


"Barry Schwarz" wrote in message
. ..

We are not discussing geometry. We are addressing issues arising out
of your misuse of a particular program.

We are are we? I don't think so. There's nothing to discuss concerning
that. I admitted I made a mistake. This post was about HD geometry.

The post I was responding to said

On Sun, 7 Jun 2015 21:56:13 -0400, "Bill Cunningham"
wrote:

The program mbrwiz64 said it would wipe the head. To me a little
ambiguous. but to them maybe straight forward.

I must have missed the message where you shifted from the use of a
particular program to a discussion of HD geometry. Maybe next time
you could change the subject of the message when you change the topic
of discussion.

There was a, maybe implied only, comparision with the CHS system.

Bill