If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below. |
|
|
Thread Tools | Display Modes |
#1
|
|||
|
|||
How much data is a "head"
I made the mistake of assuming with a software program that said it
would "wipe the head" as meaning wipe the free space. Well I lost data that testfile (testdisk?) program couldn't even get back for me. How much data is a "head"? Bill |
Ads |
#2
|
|||
|
|||
How much data is a "head"
Bill Cunningham wrote:
I made the mistake of assuming with a software program that said it would "wipe the head" as meaning wipe the free space. Well I lost data that testfile (testdisk?) program couldn't even get back for me. How much data is a "head"? Bill Try the following. 1) Get a copy of "dd". http://www.chrysocome.net/downloads/dd-0.6beta3.zip 2) Use "dd --list" to get the names of the partitions and disks. 3) Take a sample from the erased disk. Change the harddisk_N number as appropriate. dd if=\\?\Device\Harddisk0\Partition0 of=C:\downloads\out.dd bs=65536 count=16384 In Disk Management, that would capture the first disk in the list (the first disk is Harddisk0), starting at the MBR (Sector 0) and continuing for 1GB. 4) With a hex editor hexedit C:\downloads\out.dd 5) Do you see all zeros ? Do you see a random data pattern ? Did you find an "NTFS" string in there ? That will tell you what you've lost (and is not coming back). The size of 1GB, is selected so the hex editor can fit the entire thing into computer RAM. The hex editor I have (a free one), is limited to no more than 2GB max, so the software is limited by the OS limitations too. If only the MBR had been erased, TestDisk would find the stuff again. My guess would be, you lost as much stuff, as you allowed time for the program to erase the drive. I'm sure the provider of the software program, is now laughing in their sock. There are mean people everywhere. Within reason, you could have wiped the free space yourself, with no fancy tools at all. Simply copy files until the disk is full, then throw them in the trash. That will overwrite the white space. The program fsutil can do this, but an oversight is it uses sparse techniques on NTFS disks. It writes "real" files to FAT32. It writes "fake" "useless" files to NTFS. Consequently fsutil cannot be used for cleaning, on NTFS. The "dd" program can write an empty file too. dd if=/dev/zero of=C:\bigfile00.dd bs=65536 count=16384 That would write a blank 1GB file. If you had 20GB of space to erase, you would do that 20 times total. dd if=/dev/zero of=C:\bigfile19.dd bs=65536 count=16384 On FAT32, the biggest file would be like this. Slightly less than 4GB. dd if=/dev/zero of=C:\bigfile00.dd bs=65536 count=65535 On NTFS, you can wipe the white space in one command. This runs until it runs out of space (and says that on the Command Prompt screen). dd if=/dev/zero of=C:\bigfile.dd bs=65536 del C:\bigfile.dd Now the white space is minty fresh on your NTFS partition, and no undelete programs can be used to find recently deleted files. The command won't touch files currently on the disk. You "del" the file afterwards, to make the space available for storing real files. Paul |
#3
|
|||
|
|||
How much data is a "head"
In message , Bill Cunningham
writes: I made the mistake of assuming with a software program that said it would "wipe the head" as meaning wipe the free space. Well I lost data that testfile (testdisk?) program couldn't even get back for me. How much data is a "head"? Bill What was this program _supposed_ to do - wipe free space? Based purely on those three words, I'm guessing that it wiped the header information, either of the hard disc or some files. If it was only file headers, there are utilities that can find remaining "tails" and recover them. What was the prog.? Of course, see Paul's reply for a very complete solution! I just thought that the above questions ought to be asked (if only to warn the rest of us!). -- J. P. Gilliver. UMRA: 1960/1985 MB++G()AL-IS-Ch++(p)Ar@T+H+Sh0!:`)DNAf What a strange illusion it is to suppose that beauty is goodness. -Leo Tolstoy, novelist and philosopher (1828-1910) |
#4
|
|||
|
|||
How much data is a "head"
"J. P. Gilliver (John)" wrote in message ... What was this program _supposed_ to do - wipe free space? Based purely on those three words, I'm guessing that it wiped the header information, either of the hard disc or some files. If it was only file headers, there are utilities that can find remaining "tails" and recover them. What was the prog.? Of course, see Paul's reply for a very complete solution! I just thought that the above questions ought to be asked (if only to warn the rest of us!). The program mbrwiz64 said it would wipe the head. To me a little ambiguous. but to them maybe straight forward. It did not specifically say just the "free space" and not touch your data. So I and I am taking responsibility for not backing data. I keyed before thinking and used it to "wipe the head". It did so. Of all data. No warning "Are you sure you want to delete all data?" like you see in some programs. This one just went to work. dd is a nice program. I am very familiar with it on *nixes and only recently started using the windows port. It works vrey nicely. Bill |
#5
|
|||
|
|||
How much data is a "head"
"Paul" wrote in message ... Bill Cunningham wrote: I made the mistake of assuming with a software program that said it would "wipe the head" as meaning wipe the free space. Well I lost data that testfile (testdisk?) program couldn't even get back for me. How much data is a "head"? Bill Try the following. 1) Get a copy of "dd". http://www.chrysocome.net/downloads/dd-0.6beta3.zip 2) Use "dd --list" to get the names of the partitions and disks. 3) Take a sample from the erased disk. Change the harddisk_N number as appropriate. dd if=\\?\Device\Harddisk0\Partition0 of=C:\downloads\out.dd bs=65536 count=16384 In Disk Management, that would capture the first disk in the list (the first disk is Harddisk0), starting at the MBR (Sector 0) and continuing for 1GB. 4) With a hex editor hexedit C:\downloads\out.dd 5) Do you see all zeros ? Do you see a random data pattern ? Did you find an "NTFS" string in there ? That will tell you what you've lost (and is not coming back). The size of 1GB, is selected so the hex editor can fit the entire thing into computer RAM. The hex editor I have (a free one), is limited to no more than 2GB max, so the software is limited by the OS limitations too. If only the MBR had been erased, TestDisk would find the stuff again. My guess would be, you lost as much stuff, as you allowed time for the program to erase the drive. I'm sure the provider of the software program, is now laughing in their sock. There are mean people everywhere. Within reason, you could have wiped the free space yourself, with no fancy tools at all. Simply copy files until the disk is full, then throw them in the trash. That will overwrite the white space. The program fsutil can do this, but an oversight is it uses sparse techniques on NTFS disks. It writes "real" files to FAT32. It writes "fake" "useless" files to NTFS. Consequently fsutil cannot be used for cleaning, on NTFS. The "dd" program can write an empty file too. dd if=/dev/zero of=C:\bigfile00.dd bs=65536 count=16384 That would write a blank 1GB file. If you had 20GB of space to erase, you would do that 20 times total. dd if=/dev/zero of=C:\bigfile19.dd bs=65536 count=16384 On FAT32, the biggest file would be like this. Slightly less than 4GB. dd if=/dev/zero of=C:\bigfile00.dd bs=65536 count=65535 On NTFS, you can wipe the white space in one command. This runs until it runs out of space (and says that on the Command Prompt screen). dd if=/dev/zero of=C:\bigfile.dd bs=65536 del C:\bigfile.dd Now the white space is minty fresh on your NTFS partition, and no undelete programs can be used to find recently deleted files. The command won't touch files currently on the disk. You "del" the file afterwards, to make the space available for storing real files. Paul Where are you getting numbers like 65536 and 16384 ? Does this have anything to do with a "head"? Bill |
#6
|
|||
|
|||
How much data is a "head"
Bill Cunningham wrote:
"Paul" wrote in message ... Bill Cunningham wrote: I made the mistake of assuming with a software program that said it would "wipe the head" as meaning wipe the free space. Well I lost data that testfile (testdisk?) program couldn't even get back for me. How much data is a "head"? Bill Try the following. 1) Get a copy of "dd". http://www.chrysocome.net/downloads/dd-0.6beta3.zip 2) Use "dd --list" to get the names of the partitions and disks. 3) Take a sample from the erased disk. Change the harddisk_N number as appropriate. dd if=\\?\Device\Harddisk0\Partition0 of=C:\downloads\out.dd bs=65536 count=16384 In Disk Management, that would capture the first disk in the list (the first disk is Harddisk0), starting at the MBR (Sector 0) and continuing for 1GB. 4) With a hex editor hexedit C:\downloads\out.dd 5) Do you see all zeros ? Do you see a random data pattern ? Did you find an "NTFS" string in there ? That will tell you what you've lost (and is not coming back). The size of 1GB, is selected so the hex editor can fit the entire thing into computer RAM. The hex editor I have (a free one), is limited to no more than 2GB max, so the software is limited by the OS limitations too. If only the MBR had been erased, TestDisk would find the stuff again. My guess would be, you lost as much stuff, as you allowed time for the program to erase the drive. I'm sure the provider of the software program, is now laughing in their sock. There are mean people everywhere. Within reason, you could have wiped the free space yourself, with no fancy tools at all. Simply copy files until the disk is full, then throw them in the trash. That will overwrite the white space. The program fsutil can do this, but an oversight is it uses sparse techniques on NTFS disks. It writes "real" files to FAT32. It writes "fake" "useless" files to NTFS. Consequently fsutil cannot be used for cleaning, on NTFS. The "dd" program can write an empty file too. dd if=/dev/zero of=C:\bigfile00.dd bs=65536 count=16384 That would write a blank 1GB file. If you had 20GB of space to erase, you would do that 20 times total. dd if=/dev/zero of=C:\bigfile19.dd bs=65536 count=16384 On FAT32, the biggest file would be like this. Slightly less than 4GB. dd if=/dev/zero of=C:\bigfile00.dd bs=65536 count=65535 On NTFS, you can wipe the white space in one command. This runs until it runs out of space (and says that on the Command Prompt screen). dd if=/dev/zero of=C:\bigfile.dd bs=65536 del C:\bigfile.dd Now the white space is minty fresh on your NTFS partition, and no undelete programs can be used to find recently deleted files. The command won't touch files currently on the disk. You "del" the file afterwards, to make the space available for storing real files. Paul Where are you getting numbers like 65536 and 16384 ? Does this have anything to do with a "head"? Bill One of the numbers is: 1) A power of two. 2) Less than the limit for a single command to a disk drive. 3) Large enough to be efficient (good megabytes/sec rating). The default value is 512. And a bit slow. Paul |
#7
|
|||
|
|||
How much data is a "head"
On Sun, 7 Jun 2015 21:56:13 -0400, "Bill Cunningham"
wrote: The program mbrwiz64 said it would wipe the head. To me a little ambiguous. but to them maybe straight forward. It did not specifically say just the "free space" and not touch your data. So I and I am taking responsibility for not backing data. I keyed before thinking and used it to "wipe the head". It did so. Of all data. No warning "Are you sure you want to delete all data?" like you see in some programs. This one just went to work. dd is a nice program. I am very familiar with it on *nixes and only recently started using the windows port. It works vrey nicely. You seem to have misread the text. What the web site (http://mbrwizard.com/reference.php) says is "/Wipe=x - Selecting an option of 'mbr' will wipe the MBR clean, 'head' will wipe the first head or 63 sectors, and a range of sectors from x to y can be wiped by specifying /Wipe=x-y. This will effectively remove all information from the specified sectors of the disk. See example." You really should try to understand the documentation before using a tool. -- Remove del for email |
#8
|
|||
|
|||
How much data is a "head"
"Barry Schwarz" wrote in message ... You seem to have misread the text. What the web site (http://mbrwizard.com/reference.php) says is "/Wipe=x - Selecting an option of 'mbr' will wipe the MBR clean, 'head' will wipe the first head or 63 sectors, and a range of sectors from x to y can be wiped by specifying /Wipe=x-y. This will effectively remove all information from the specified sectors of the disk. See example." You really should try to understand the documentation before using a tool. So a head is 63 sectors then. So is the size of these sectors 512 bytes as is the LBA sector? Is the head's sectors in the same place as the LBA sectors? Bill |
#9
|
|||
|
|||
How much data is a "head"
On Mon, 8 Jun 2015 12:02:07 -0400, "Bill Cunningham"
wrote: "Barry Schwarz" wrote in message .. . You seem to have misread the text. What the web site (http://mbrwizard.com/reference.php) says is "/Wipe=x - Selecting an option of 'mbr' will wipe the MBR clean, 'head' will wipe the first head or 63 sectors, and a range of sectors from x to y can be wiped by specifying /Wipe=x-y. This will effectively remove all information from the specified sectors of the disk. See example." You really should try to understand the documentation before using a tool. So a head is 63 sectors then. So is the size of these sectors 512 bytes as is the LBA sector? Is the head's sectors in the same place as the LBA sectors? NO! There is no such thing as a "head". "head" is a keyword with a particular meaning for this program. If the same keyword is used by a different program it could have a different meaning. Consider the difference between how head is used by this program and the standard Unix head command. -- Remove del for email |
#10
|
|||
|
|||
How much data is a "head"
"Barry Schwarz" wrote in message ... On Mon, 8 Jun 2015 12:02:07 -0400, "Bill Cunningham" wrote: "Barry Schwarz" wrote in message . .. You seem to have misread the text. What the web site (http://mbrwizard.com/reference.php) says is "/Wipe=x - Selecting an option of 'mbr' will wipe the MBR clean, 'head' will wipe the first head or 63 sectors, and a range of sectors from x to y can be wiped by specifying /Wipe=x-y. This will effectively remove all information from the specified sectors of the disk. See example." You really should try to understand the documentation before using a tool. So a head is 63 sectors then. So is the size of these sectors 512 bytes as is the LBA sector? Is the head's sectors in the same place as the LBA sectors? NO! There is no such thing as a "head". "head" is a keyword with a particular meaning for this program. If the same keyword is used by a different program it could have a different meaning. Consider the difference between how head is used by this program and the standard Unix head command. Well yeah but what about HDD geometry. I know it's old but that's it's meaning here isn't it? I know they don't go by that in actuality anymore. But I know there is "63 sectors" or was at one time. Now the HDDs go by LBA. Bill |
#11
|
|||
|
|||
How much data is a "head"
On Mon, 8 Jun 2015 15:32:50 -0400, "Bill Cunningham"
wrote: "Barry Schwarz" wrote in message .. . On Mon, 8 Jun 2015 12:02:07 -0400, "Bill Cunningham" wrote: "Barry Schwarz" wrote in message ... You seem to have misread the text. What the web site (http://mbrwizard.com/reference.php) says is "/Wipe=x - Selecting an option of 'mbr' will wipe the MBR clean, 'head' will wipe the first head or 63 sectors, and a range of sectors from x to y can be wiped by specifying /Wipe=x-y. This will effectively remove all information from the specified sectors of the disk. See example." You really should try to understand the documentation before using a tool. So a head is 63 sectors then. So is the size of these sectors 512 bytes as is the LBA sector? Is the head's sectors in the same place as the LBA sectors? NO! There is no such thing as a "head". "head" is a keyword with a particular meaning for this program. If the same keyword is used by a different program it could have a different meaning. Consider the difference between how head is used by this program and the standard Unix head command. Well yeah but what about HDD geometry. I know it's old but that's it's meaning here isn't it? I know they don't go by that in actuality anymore. But I know there is "63 sectors" or was at one time. Now the HDDs go by LBA. We are not discussing geometry. We are addressing issues arising out of your misuse of a particular program. -- Remove del for email |
#12
|
|||
|
|||
How much data is a "head"
"Barry Schwarz" wrote in message ... We are not discussing geometry. We are addressing issues arising out of your misuse of a particular program. We are are we? I don't think so. There's nothing to discuss concerning that. I admitted I made a mistake. This post was about HD geometry. Bill |
#13
|
|||
|
|||
How much data is a "head"
On Mon, 8 Jun 2015 19:03:18 -0400, "Bill Cunningham"
wrote: "Barry Schwarz" wrote in message .. . We are not discussing geometry. We are addressing issues arising out of your misuse of a particular program. We are are we? I don't think so. There's nothing to discuss concerning that. I admitted I made a mistake. This post was about HD geometry. The post I was responding to said On Sun, 7 Jun 2015 21:56:13 -0400, "Bill Cunningham" wrote: The program mbrwiz64 said it would wipe the head. To me a little ambiguous. but to them maybe straight forward. I must have missed the message where you shifted from the use of a particular program to a discussion of HD geometry. Maybe next time you could change the subject of the message when you change the topic of discussion. -- Remove del for email |
#14
|
|||
|
|||
How much data is a "head"
"Barry Schwarz" wrote in message ... On Mon, 8 Jun 2015 19:03:18 -0400, "Bill Cunningham" wrote: "Barry Schwarz" wrote in message . .. We are not discussing geometry. We are addressing issues arising out of your misuse of a particular program. We are are we? I don't think so. There's nothing to discuss concerning that. I admitted I made a mistake. This post was about HD geometry. The post I was responding to said On Sun, 7 Jun 2015 21:56:13 -0400, "Bill Cunningham" wrote: The program mbrwiz64 said it would wipe the head. To me a little ambiguous. but to them maybe straight forward. I must have missed the message where you shifted from the use of a particular program to a discussion of HD geometry. Maybe next time you could change the subject of the message when you change the topic of discussion. There was a, maybe implied only, comparision with the CHS system. Bill |
Thread Tools | |
Display Modes | |
|
|