Freespace wiping timing

Discussion in 'Computer Security' started by Arthur T., Dec 3, 2006.

  1. Arthur T.

    Arthur T. Guest

    On a Win2k system, I recently did a freespace wipe on one of
    my disks. I used a wipe scheme of 2-passes of random data and
    Bestcrypt's software (V7.10.2).

    The first pass wiped at about 5MB/second. The second pass
    wiped at about 15MB/second - three times the speed. The second
    pass was not only reported as being faster, it actually ran in 1/3
    the time.

    Since I also wiped the directory, it's difficult for me to
    see what's actually on the disk. DriveRescue cannot find any
    non-zero-length files to restore.

    I would appreciate any theories which would explain the
    differing speeds. My own guess is that it has something to do
    with caching, but (while I can't find it in the docs) I think it's
    supposed to take care of that. I've tried the STFW step, but I
    haven't found anything.

    (I was also going to ask for a pointer to software to let me
    see the unallocated space on my disk. However, after running a
    wipe fileslack on a file, it seems that after all of the other
    passes, it the sets the area to zeros. I can't find that in the
    documentation, either.)

    --
    Arthur T. - ar23hur "at" intergate "dot" com
    Looking for a z/OS (IBM mainframe) systems programmer position
    Arthur T., Dec 3, 2006
    #1
    1. Advertising

  2. Arthur T. wrote:

    > On a Win2k system, I recently did a freespace wipe on one of
    > my disks. I used a wipe scheme of 2-passes of random data and
    > Bestcrypt's software (V7.10.2).
    >
    > The first pass wiped at about 5MB/second. The second pass
    > wiped at about 15MB/second - three times the speed. The second
    > pass was not only reported as being faster, it actually ran in 1/3
    > the time.
    >
    > Since I also wiped the directory, it's difficult for me to
    > see what's actually on the disk. DriveRescue cannot find any
    > non-zero-length files to restore.


    OK, and what evidence do your have that the wipe was done properly?

    > I would appreciate any theories which would explain the
    > differing speeds.


    You used two superfluos, incompetent and probably faulty implemented
    methods. Both were trendemiously slower than any serious method.

    > My own guess is that it has something to do with caching,


    You should hope that no caching was done at all!

    > I've tried the STFW step, but I haven't found anything.


    So? I found the description of SDelete from Sysinternals, which describes
    how file wiping is done properly and what most crappy programs like
    BestCrypt do wrong.

    > (I was also going to ask for a pointer to software to let me
    > see the unallocated space on my disk.


    dd.exe?

    > However, after running a
    > wipe fileslack on a file, it seems that after all of the other
    > passes, it the sets the area to zeros. I can't find that in the
    > documentation, either.)


    OK, and why didn't you check the MFT/FAT, the filesystem journal and the
    swap file? That's exactly where presumably overwritten data would end up,
    because zoering out files is so trivial that you really can't get it wrong.
    Sebastian Gottschalk, Dec 3, 2006
    #2
    1. Advertising

  3. Arthur T.

    macarro Guest


    > I would appreciate any theories which would explain the
    > differing speeds. My own guess is that it has something to do
    > with caching, but (while I can't find it in the docs) I think it's
    > supposed to take care of that. I've tried the STFW step, but I
    > haven't found anything.



    My theory is that the second deletion pass was quicker because the
    random data used to overwrite it is less complex than the first, you can
    check if that is the case by wiping some small file and checking if the
    second pass is quicker again, that would indicate that the second pass
    always has this behaviour.

    To try recover your delete data you can try:

    http://www.pcinspector.de

    Free


    --
    mapping the internet 24/7 http://www.netdimes.org
    macarro, Dec 16, 2006
    #3
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. John

    Freespace

    John, Oct 10, 2003, in forum: Computer Support
    Replies:
    2
    Views:
    573
    ┬░Mike┬░
    Oct 10, 2003
  2. gary

    Windows Update & Freespace(help)

    gary, Oct 18, 2004, in forum: Computer Support
    Replies:
    7
    Views:
    458
    G. Morgan
    Oct 20, 2004
  3. TJ Sackville-West

    Partition Magic 5 hangs up redistributing freespace under WIN 98

    TJ Sackville-West, Jan 6, 2005, in forum: Computer Support
    Replies:
    1
    Views:
    479
    Sue Mommie
    Jan 7, 2005
  4. Kane's son

    XP Defrag requires 15 percent freespace

    Kane's son, Jan 30, 2005, in forum: Computer Support
    Replies:
    6
    Views:
    797
    Martik
    Jan 31, 2005
  5. Trevor
    Replies:
    0
    Views:
    449
    Trevor
    Dec 30, 2007
Loading...

Share This Page