Low level format

Discussion in 'Computer Security' started by Chris Redfield, Mar 4, 2006.

  1. Hello,

    If I want to blow away the contents of two hard drives, would a
    low-level format clean the drives significantly better than a standard
    format that occurs during, say, an OS's installation ? Would I be
    risking a situation where the drives would be unusable if the procedure
    went wrong?

    Before I forget, my current setup is a dual-boot with XP Pro and Fedora
    Core 4 on seperate hard disks.

    I think that a normal format would not totally destroy everything on the
    disk that has been deleted normally before. I want to use the disks
    again so actual physical destruction is not an option.

    Somehow, I've managed to end up with a copy of MicroScope 8 on a floppy,
    which can do low level formats, but it throws up a few errors now on my
    new system that it didn't before on a previous, older system.

    Even if a low level format is not totally secure, so long as it's better
    than a normal format, that will do me. What software can do this now
    that is preferrably free, or at least not extortionately expensive ?

    I don't need secure erasing that would foil all but TLA's, just a good
    clean and thorough formatting process.

    Call it a spring clean.

    Thanks for your time and experience.

    Regards,

    Chris.
    Chris Redfield, Mar 4, 2006
    #1
    1. Advertising

  2. Chris Redfield

    CJ Guest

    Chris Redfield wrote:
    > Hello,
    >
    > If I want to blow away the contents of two hard drives, would a
    > low-level format clean the drives significantly better than a standard
    > format that occurs during, say, an OS's installation ? Would I be
    > risking a situation where the drives would be unusable if the
    > procedure went wrong?
    >
    > Before I forget, my current setup is a dual-boot with XP Pro and
    > Fedora Core 4 on seperate hard disks.
    >
    > I think that a normal format would not totally destroy everything on
    > the disk that has been deleted normally before. I want to use the
    > disks again so actual physical destruction is not an option.
    >
    > Somehow, I've managed to end up with a copy of MicroScope 8 on a
    > floppy, which can do low level formats, but it throws up a few errors
    > now on my new system that it didn't before on a previous, older
    > system.
    >
    > Even if a low level format is not totally secure, so long as it's
    > better than a normal format, that will do me. What software can do
    > this now that is preferrably free, or at least not extortionately
    > expensive ?
    >
    > I don't need secure erasing that would foil all but TLA's, just a good
    > clean and thorough formatting process.
    >
    > Call it a spring clean.
    >
    > Thanks for your time and experience.
    >
    > Regards,
    >
    > Chris.


    If you just want to clean install an operating system on an otherwise
    healthy drive just let the new OS delete existing partitions, create new
    partitions and format.

    My understanding is that a true low level format, assuming you had a tool to
    do it, would render a modern drive unusable.

    If you want something more, use a utility from a disk manufacturer, e.g.

    http://www.seagate.com/support/kb/disc/faq/ata_llfmt_what.html

    Try a Google for zero fill and name of your disk manufacturer(s)

    If you are worried about someone getting data off your drive, take it apart,
    physically destroy it and scatter the remains far and wide.

    CJ
    CJ, Mar 4, 2006
    #2
    1. Advertising

  3. On Sat, 04 Mar 2006 11:45:52 GMT, "CJ" <> typed:

    >Chris Redfield wrote:
    >> Hello,
    >>
    >> If I want to blow away the contents of two hard drives, would a
    >> low-level format clean the drives significantly better than a standard
    >> format that occurs during, say, an OS's installation ?
    >>
    >> [...]

    >
    >If you just want to clean install an operating system on an otherwise
    >healthy drive just let the new OS delete existing partitions, create new
    >partitions and format.
    >
    >My understanding is that a true low level format, assuming you had a tool to
    >do it, would render a modern drive unusable.
    >
    >If you want something more, use a utility from a disk manufacturer, e.g.
    >
    >http://www.seagate.com/support/kb/disc/faq/ata_llfmt_what.html
    >
    > [...]



    Thanks for the reply. Yes I did wonder about the possible outcome of a
    low-level format actually b0rking my disks.

    I'll search for disk utilities for my drives. And stick to normal
    formats, with perhaps bad-block checking.

    Cheers.

    Chris.
    Chris Redfield, Mar 4, 2006
    #3
  4. Chris Redfield

    Jim Watt Guest

    On Sat, 04 Mar 2006 12:23:06 +0000, Chris Redfield
    <> wrote:

    >Thanks for the reply. Yes I did wonder about the possible outcome of a
    >low-level format actually b0rking my disks.
    >
    >I'll search for disk utilities for my drives. And stick to normal
    >formats, with perhaps bad-block checking.


    For what you want to achieve you are better off looking for a
    disk wiping program rather than a formatting one;

    The normal format program is worthless for security purposes.

    --
    Jim Watt
    http://www.gibnet.com
    Jim Watt, Mar 4, 2006
    #4
  5. Chris Redfield

    ~David~ Guest

    If an OS (windows, even linux) there is a security risk because information is
    still on the drives; just the file pointers have been removed. True "low-level"
    formatting will damage many modern drives because this physically alters the
    Cylinder, Head, Sector (CHS) layout that used to be set up in the BIOS on older
    systems.

    Rather than go for fancy programs to cleanly format a drive, boot into knoppix,
    and use the command dd if=/dev/urandom of=/dev/<harddisk> <options> and maybe
    put it in a while-loop in a shell script so it runs through a few times, as this
    method can clean a drive beyond what MOST (though probably not all) hard drive
    analysis can recover, plus its cheap and easy.

    ~David~

    Chris Redfield wrote:
    > Hello,
    >
    > If I want to blow away the contents of two hard drives, would a
    > low-level format clean the drives significantly better than a standard
    > format that occurs during, say, an OS's installation ? Would I be
    > risking a situation where the drives would be unusable if the procedure
    > went wrong?
    >
    > Before I forget, my current setup is a dual-boot with XP Pro and Fedora
    > Core 4 on seperate hard disks.
    >
    > I think that a normal format would not totally destroy everything on the
    > disk that has been deleted normally before. I want to use the disks
    > again so actual physical destruction is not an option.
    >
    > Somehow, I've managed to end up with a copy of MicroScope 8 on a floppy,
    > which can do low level formats, but it throws up a few errors now on my
    > new system that it didn't before on a previous, older system.
    >
    > Even if a low level format is not totally secure, so long as it's better
    > than a normal format, that will do me. What software can do this now
    > that is preferrably free, or at least not extortionately expensive ?
    >
    > I don't need secure erasing that would foil all but TLA's, just a good
    > clean and thorough formatting process.
    >
    > Call it a spring clean.
    >
    > Thanks for your time and experience.
    >
    > Regards,
    >
    > Chris.
    >
    >
    ~David~, Mar 4, 2006
    #5
  6. Chris Redfield wrote:

    > Hello,
    >
    > If I want to blow away the contents of two hard drives, would a low-level
    > format clean the drives significantly better than a standard format that


    <snip>

    There's no such thing as "low level formatting" a modern drive. Low level
    formatting hasn't been useful since the advent of IDE controllers with
    hardwired drive geometry. Back about the era of the 40 MEG drive, and even
    most of those were unable to be low level formatted. It's a a leftover of
    the RLE drive when you could actually change the cylinder and track
    configuration.

    I don't know what it is you really have that calls itself a low level
    formatting utility, but I'd throw it away quick. It's either snake oil,
    or it will destroy your drive (if it does anything at all).

    If you want a nice "clean" drive to start with, pick up BCWipe or some
    other well known multiple pass overwriting software and clean the drive
    that way. There's really no reason to even repartition if you're happy
    with the current layout. Just wipe everything and start over. You said you
    didn't need "TLA secure" wiping, so set the number of passes to two or
    something to make it quick and easy, and relatively secure from your
    average snoopy relative/friend.

    By the way, I've seen partitions deleted and then recreated (identical
    size/position) and have all data left in tact. A perfectly usable drive/OS
    when the process was complete. And we all know that delete and format are
    completely useless when dealing with real security issues. There's off the
    shelf, mostly idiot proof software that can rebuild a formatted drive now,
    and tools like Penguin Sleuth Kit that can pretty much recover anything a
    TLA can except for what specialized hardware will provide them.
    George Orwell, Mar 4, 2006
    #6
  7. Chris Redfield

    nemo_outis Guest

    George Orwell <> wrote in
    news::

    > Penguin Sleuth Kit



    There are a number of manufacturers' utilities available to end-users which
    will zero out the drive - commonly, but erroneously, referred to as low-
    level format - and even some third-party tools such as HDAT2HW which can
    manage/reset the g-list (but almost never the p-list) and manage some other
    aspects. Yet fancier software can sometimes even manage the P-list and do
    a L-level sector reassignment

    All this is far beyod what ordinary software forensics porgrams like Encase
    and (the far more rudimentary) Penguin can do.

    The heaviest-duty stuff available for end users to manage/recover hard
    drives at a low level is the hardware based PC3000 (much better than the
    other HW brand) for over $5000 (because it's usually bundled with
    training). It's Russian-made but the best source (I think) is the Canadian
    affiliate/distributor. However, it's anything but self-explanatory - it
    would be about as useful to you as an MRI scanning machine if you don't
    have the necessary knowledge and skills to use it.

    Regards,
    nemo_outis, Mar 4, 2006
    #7
  8. Chris Redfield

    nemo_outis Guest

    "nemo_outis" <> wrote in
    news:Xns977CA7619ED61abcxyzcom@204.153.244.170:

    > George Orwell <> wrote in
    > news::
    >
    >> Penguin Sleuth Kit

    >
    >
    > There are a number of manufacturers' utilities available to end-users
    > which will zero out the drive - commonly, but erroneously, referred to
    > as low- level format - and even some third-party tools such as HDAT2HW
    > which can manage/reset the g-list (but almost never the p-list) and
    > manage some other aspects. Yet fancier software can sometimes even
    > manage the P-list and do a L-level sector reassignment
    >
    > All this is far beyod what ordinary software forensics porgrams like
    > Encase and (the far more rudimentary) Penguin can do.
    >
    > The heaviest-duty stuff available for end users to manage/recover hard
    > drives at a low level is the hardware based PC3000 (much better than
    > the other HW brand) for over $5000 (because it's usually bundled with
    > training). It's Russian-made but the best source (I think) is the
    > Canadian affiliate/distributor. However, it's anything but
    > self-explanatory - it would be about as useful to you as an MRI
    > scanning machine if you don't have the necessary knowledge and skills
    > to use it.
    >
    > Regards,
    >
    >



    With some trepidation I'm going to disclose the location of one of the gems
    of the internet. It's best if you read Russian but even its English forums
    are great. It also has a treasure-trove of HD-related software old & new.
    DON'T ABUSE THE SITE by hoovering all the software and screwing up his
    bandwidth and gigs limit. Use the site, take what you need, a little at a
    time, and leave the rest.

    http://files.hddguru.com/index.php

    http://forum.hddguru.com/

    Remember: DON'T PISS IN THE SOUP and ruin things for everybody by being
    greedy.

    Regards,
    nemo_outis, Mar 4, 2006
    #8
  9. On Sat, 04 Mar 2006 21:48:57 GMT, ~David~ <> typed:

    >If an OS (windows, even linux) there is a security risk because information is
    >still on the drives; just the file pointers have been removed. True "low-level"
    >formatting will damage many modern drives because this physically alters the
    >Cylinder, Head, Sector (CHS) layout that used to be set up in the BIOS on older
    >systems.


    Thanks for the response. I'm very much put off by this 'low-level' stuff
    now. It's just something I saw in that Microscope 8 disk utility which
    I've seen an OEM use while I was there once. But, I am talking about
    several years ago now. As I'm not an OEM, I probably shouldn't be even
    looking at it. Advice heeded. Wallet feels better. :)

    Regards,

    Chris.
    Chris Redfield, Mar 5, 2006
    #9
  10. On Sat, 4 Mar 2006 23:45:07 +0100 (CET), George Orwell
    <> typed:

    >There's no such thing as "low level formatting" a modern drive. Low level
    >formatting hasn't been useful since the advent of IDE controllers with
    >hardwired drive geometry. Back about the era of the 40 MEG drive, and even
    >most of those were unable to be low level formatted. It's a a leftover of
    >the RLE drive when you could actually change the cylinder and track
    >configuration.
    >
    >I don't know what it is you really have that calls itself a low level
    >formatting utility, but I'd throw it away quick. It's either snake oil,
    >or it will destroy your drive (if it does anything at all).


    Thanks for the reply and the history. The utility is Microscope 8, which
    is probably hopelessly outdated now, and besides which, I probably
    shouldn't be messing with it as I've seen an OEM working on an old PC of
    mine with it, and it's best left in the hands of that kind of person,
    not me I think. I am utterly convinced now, thanks to replies here, that
    low-level formatting is NOT something I want to be doing. Phew, that was
    a close one. :/

    >
    >If you want a nice "clean" drive to start with, pick up BCWipe or some
    >other well known multiple pass overwriting software and clean the drive
    >that way. There's really no reason to even repartition if you're happy
    >with the current layout. Just wipe everything and start over. You said you
    >didn't need "TLA secure" wiping, so set the number of passes to two or
    >something to make it quick and easy, and relatively secure from your
    >average snoopy relative/friend.


    I'll check out BCWipe. I have PGP 8.0 here too. But I'm curious about
    BCWipe as I'm sure I used that back in my Win 98 days. Yes, I think I'll
    stick to two or three passes if I use it.

    As I'm typing this I remembered Eraser too. I'll add that to the list.

    >
    >By the way, I've seen partitions deleted and then recreated (identical
    >size/position) and have all data left in tact. A perfectly usable drive/OS
    >when the process was complete. And we all know that delete and format are
    >completely useless when dealing with real security issues. There's off the
    >shelf, mostly idiot proof software that can rebuild a formatted drive now,
    >and tools like Penguin Sleuth Kit that can pretty much recover anything a
    >TLA can except for what specialized hardware will provide them.


    Scary. :/

    Thanks again.

    Regards,

    Chris.
    Chris Redfield, Mar 5, 2006
    #10
  11. Chris Redfield

    Moe Trin Guest

    On Sun, 05 Mar 2006, in the Usenet newsgroup alt.computer.security, in article
    <>, Chris Redfield wrote:

    >George Orwell <> typed:


    >>There's no such thing as "low level formatting" a modern drive. Low level
    >>formatting hasn't been useful since the advent of IDE controllers with
    >>hardwired drive geometry. Back about the era of the 40 MEG drive, and even
    >>most of those were unable to be low level formatted.


    Hey, I had a couple of those - Seagate ST-251s

    >The utility is Microscope 8, which is probably hopelessly outdated now,
    >and besides which, I probably shouldn't be messing with it as I've seen
    >an OEM working on an old PC of mine with it, and it's best left in the
    >hands of that kind of person, not me I think.


    Not sure about the version number, but Scott Mueller ("Upgrading and
    Repairing PCs") mentions it. Do a google search

    Web Results 1 - 10 of about 722,000 for disk+format Microscope 8.
    (0.21 seconds)

    Upgrading & Repairing PCs Eighth Edition -- Ch 16 -- Hard Disk ...
    For other drives, I recommend Disk Manager by Ontrack, as well as the
    MicroScope program by Micro 2000. These programs can format most IDE
    drives because ...
    cma.zdnet.com/book/upgraderepair/ch16/ch16.htm - 101k - Cached -
    Similar pages

    <quote>
    Intelligent IDE drives must be in nontranslating, or native, mode to LLF
    them. Zoned Recording drives can perform only a partial LLF, in which
    the defect map is updated and new defective sectors can be marked or
    spared, but the sector headers usually are rewritten only partially, and
    only for the purpose of defect mapping. In any case, you are writing to
    some of the sector headers in one form, and physical (sector-level)
    defect mapping and sector sparing can be performed. This procedure is,
    by any standard definition, an LLF.
    </quote>

    That section goes back to the second or third edition of that book (not
    in the first edition from 1988, is in the third edition from 1993) which
    was somewhat after "Zoned Recording" became common.

    >I am utterly convinced now, thanks to replies here, that low-level
    >formatting is NOT something I want to be doing. Phew, that was a
    >close one. :/


    Depending on the age of your drive, it may not even accept the commands
    to low level format - merely returning a "OK" while ignoring it. Then
    again...

    ~David~ <> mentions upthread using knoppix (one of a
    number of "live CD" Linux distributions) to run 'dd if=/dev/urandom
    of=/dev/<harddisk> <options>' to overwrite the disk. There are also floppy
    solutions such as Toms RootNBoot (www.toms.net/rb). The version for creating
    the floppy in "DOS" is

    2242580 May 4 2002 tomsrtbt-2.0.103.dos.zip

    which creates a (severely) over-stuffed floppy with a tiny command line
    version of Linux that can be used to wipe disks..

    Old guy
    Moe Trin, Mar 5, 2006
    #11
  12. -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA1

    Hi!

    I would prefer Darik's Boot and Nuke ("DBAN"): http://dban.sourceforge.net/

    If you boot with this disc or cd, you can clean your discs very good...

    Enter "dod" on boot screen, I think, that is compatible to the DoD
    5220.22-M standard. Is that enough for you?

    Bye,
    Michael Decker

    Chris Redfield schrieb:

    > Hello,
    >
    > If I want to blow away the contents of two hard drives, would a
    > low-level format clean the drives significantly better than a standard
    > format that occurs during, say, an OS's installation ? Would I be
    > risking a situation where the drives would be unusable if the procedure
    > went wrong?
    >
    > Before I forget, my current setup is a dual-boot with XP Pro and Fedora
    > Core 4 on seperate hard disks.
    >
    > I think that a normal format would not totally destroy everything on the
    > disk that has been deleted normally before. I want to use the disks
    > again so actual physical destruction is not an option.
    >
    > Somehow, I've managed to end up with a copy of MicroScope 8 on a floppy,
    > which can do low level formats, but it throws up a few errors now on my
    > new system that it didn't before on a previous, older system.
    >
    > Even if a low level format is not totally secure, so long as it's better
    > than a normal format, that will do me. What software can do this now
    > that is preferrably free, or at least not extortionately expensive ?
    >
    > I don't need secure erasing that would foil all but TLA's, just a good
    > clean and thorough formatting process.
    >
    > Call it a spring clean.
    >
    > Thanks for your time and experience.
    >
    > Regards,
    >
    > Chris.
    >
    >


    - --
    Michael Decker
    TESIS SYSware GmbH http://www.tesis.de
    Baierbrunnerstr. 15 * 81379 Muenchen * Tel. +49 89 747377-0
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1.4.2 (MingW32)
    Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

    iD8DBQFEC+mV/y41xHvf+EgRAu+JAJ0bKbNrYByf6Af4OR1W3RwMX2gVfQCfQAKn
    +BR+i/l+0qAAo7za4YaBvuI=
    =XQrE
    -----END PGP SIGNATURE-----
    Michael Decker, Mar 6, 2006
    #12
  13. On Mon, 06 Mar 2006 08:49:41 +0100, Michael Decker
    <> typed:


    >I would prefer Darik's Boot and Nuke ("DBAN"): http://dban.sourceforge.net/
    >
    >If you boot with this disc or cd, you can clean your discs very good...
    >
    >Enter "dod" on boot screen, I think, that is compatible to the DoD
    >5220.22-M standard. Is that enough for you?
    >


    Thanks Michael. I have bookmarked that URL. Looks like it's well worth a
    try.

    Regards,

    Chris.
    Chris Redfield, Mar 6, 2006
    #13
  14. On Sun, 05 Mar 2006 14:33:02 -0600, Moe Trin wrote:

    >>I am utterly convinced now, thanks to replies here, that low-level
    >>formatting is NOT something I want to be doing. Phew, that was a
    >>close one. :/

    >
    > Depending on the age of your drive, it may not even accept the commands
    > to low level format - merely returning a "OK" while ignoring it. Then
    > again...


    Thanks for the detailed info Moe Trin. It's saved.

    Still doing some investigation of the replies here, so nothing committed
    yet.

    Regards,

    Chris.
    Chris Redfield, Mar 7, 2006
    #14
    1. Advertising

Want to reply to this thread or ask your own question?

It takes just 2 minutes to sign up (and it's free!). Just click the sign up button to choose a username and then you can ask your own questions on the forum.
Similar Threads
  1. Chu-Chu

    Low level format on laptop HD

    Chu-Chu, Jul 3, 2004, in forum: Computer Support
    Replies:
    5
    Views:
    7,046
    Mekius_
    Jul 22, 2004
  2. Replies:
    8
    Views:
    10,781
    ASAAR
    Nov 21, 2005
  3. Dead Eyes

    Low Level Format

    Dead Eyes, Jan 23, 2006, in forum: Computer Support
    Replies:
    11
    Views:
    1,084
    =?UTF-8?B?UGFsaW5kcuKYu21l?=
    Feb 1, 2006
  4. cizzo

    Low level format or wipe?

    cizzo, Jul 10, 2007, in forum: Computer Support
    Replies:
    14
    Views:
    1,574
    =?ISO-8859-1?Q?R=F4g=EAr?=
    Jul 12, 2007
  5. Pikoro

    Re: low-level format?

    Pikoro, Jul 5, 2003, in forum: A+ Certification
    Replies:
    0
    Views:
    515
    Pikoro
    Jul 5, 2003
Loading...

Share This Page