There are some cases which you may want to format your hard drive, like maybe doing an OS upgrade or quitting your current job (heh..), but being a neurotic person that I am, I have thought about low level formatting, a hard drive erasure technique that leaves unrecoverable traces of data. This technique is very useful if you are a keeper of highly confidential files and worried of other people who can get hold of your supposedly clean drive and restores your data and eventually, stealing the citical information.
The term low level format is actually a misused term for only the drive manufacturer can perform the low level format and this is performed before the drive is sold in the market. The succeeding format methods that can be used are considered as high level, for when low-level format is used, the drive might be rendered useless. So from here on, I will use the term zero-fill in cleaning a hard drive.
Zero-fill means creating a series of 0-bit data that are saved on a file or device. We all know that data are not really numbers and characters, but series of 0’s and 1’s that are machine-readable. Linux has a built-in command known as ‘dd’ that can perform zero-fill on a device or file, in this case, a hard drive. A simple one-liner of dd command that can perform a hard drive formatting is:
dd if=/dev/zero of=/dev/hda
The command says that dd will write 0 (/dev/zero) to the device /dev/hda, the first IDE drive in the machine. This will command will overwrite any existing data in the drive with null data, hence performing a format procedure. However, some forensic data recovery can scan the formatted drive and still recover data. So how do you get past these pesky data recovery tools? One way is to perform dd on the drive and fill the drive with random bits. This will mask the data creating utter chaos in the drive making it difficult for recovery tools to find and organize data.
dd if=/dev/urandom of=/dev/hda
or
dd if=/dev/random of=/dev/hda
This command is the same as the forementioned, but instead of 0’s, it fills the drive with random bits generated by the kernel. urandom and random are different from another so you may want to check out the man page of these to figure out what suits mo better.
If you feel that doing random fill on the drive is still not enough, most people like doing the same procedure for seven times. You can do a simple loop of the command like so:
for n in `seq 7`; do dd if=/dev/urandom of=/dev/hda; done
The command “dd if=/dev/urandom of=/dev/hda” will be done 7 times as per with the “seq 7″ condition. This may take quite a while especially on large capacity disks but I think this will do the trick of preventing forensic data recovery on your drive. Another command that can be used is shred, which is like so:
shred -z /dev/hda (The switch -z means zero-fill to hide the shredding)
I have personally not tested this command so I may not be able to give you feedback about this.The man page for shred reads:
Overwrite the specified FILE(s) repeatedly, in order to make it harder for even very expensive hardware probing to recover the data.
Sounds interesting. From the looks of it, it is similar to urandom and random.
If you have experience in using shred or any other command to format your drive, I’d like to hear it.
Popularity: 12% [?]
