hard drive questions

[Bob123]

Hey so a few questions for everyone.  How come whenever I look at purchasing a used hard drive, the seller states that the hard drive has been reformatted several times, or has been formatted via the DoD standard.  What is the point in doing that?  Let's say I have a hard drive I wish to sell, couldn't I just put it in my machine as a secondary hard drive, and fill it up with something?  Say a really large useless virtual machine or some super large file over and over until the hard drive is filled up?  Am I wrong in thinking that?  I know it's a long shot but if I mostly know where a personal file is at, as long as I put something over top of it the file is technically blown away right?  Guess I don't know of any software that can un-delete a deleted file that's been written over at least once.  I've used software to un-delete files that have not been overwritten.  Any info would be great.

Next question.  Again maybe purely random but I did get a hard drive once that I wanted to backup a few files from it to a thumb drive.  And the thumb drive died.  It never worked again after that.  Granted it was a cheap thumb drive but does anyone know of software on a hard drive that would kill a thumb drive?  The motherboard is mine, the hard drive has since been formatted and works fine with all sorts of thumb drives.  Just wondering if there is software that can be installed on a hard drive that would kill flash drives?

Last question, what's the best software to clone a hard drive?  Looking to clone a Win10 box to replace the hard drive.  Thanks.

[aethernaut]

Quote

Hey so a few questions for everyone.  How come whenever I look at purchasing a used hard drive, the seller states that the hard drive has been reformatted several times, or has been formatted via the DoD standard.  

That is not formatting, that is disk wiping (hopefully). Crudely, formatting just resets file system pointers and leaves the data intact but in unallocated space and easy to recover. Disk wiping overwrites the whole disk with cycles of zeros and random data. With DoD I think that is seven cycles. The Guttman method uses 35 overwrites!! See how long that takes on a 6TB HDD!! I have found that one pass of zeros is normally enough if you verify afterwards that the drive is all zeros. Disk wiping programs often provide this as an option.

Quote

What is the point in doing that?  Let's say I have a hard drive I wish to sell, couldn't I just put it in my machine as a secondary hard drive, and fill it up with something?  Say a really large useless virtual machine or some super large file over and over until the hard drive is filled up?  Am I wrong in thinking that?

You could. The main difference is that your method will only fill the file system not the entire disk. Disk wiping starts a sector 0 and carries on until the whole disk is overwritten. There have been arguments made that even this will not erase the data in clusters that have been marked bad during the life of the disk. Getting at this data however is NOT trivial. Another scenario is that initially, say, you had two partitions on the disk that used all the available disk space. You later change that to one partition. However one partition, due to the maths, cannot occupy all the disk and you have disk slack that contains data from one of your two previous partitions. Likely only to be very small, if any. The paranoid and those with very sensitive data take such things seriously and will crush the hard disk rather than wipe it and let someone else have it.

Quote

I know it's a long shot but if I mostly know where a personal file is at, as long as I put something over top of it the file is technically blown away right?  Guess I don't know of any software that can un-delete a deleted file that's been written over at least once.  I've used software to un-delete files that have not been overwritten.  Any info would be great.

That's right but you will only get the last place your data resided. Remember disks defrag and clusters containing part of that file may no longer be associated with the file because the data from it has been moved to somewhere better for read speed. The defrag copies the data to the new location but does not wipe the old location. Sure you are only talking about a cluster sized chunk but it could be an important cluster or even a consecutive chain of clusters! Also many programs create many, many temporary copies and working files as you draft a doc / sheet (Word, Excel I'm looking at you). These get splashed all around the disk and all can be recovered unless they happen to have been overwritten by later files.

Quote

Next question.  Again maybe purely random but I did get a hard drive once that I wanted to backup a few files from it to a thumb drive.  And the thumb drive died.  It never worked again after that.  Granted it was a cheap thumb drive but does anyone know of software on a hard drive that would kill a thumb drive?

I have had drive wiping / formatting / partitioning software kill cheap flash drives or somehow make them read only. That's normally because I was being nasty to the drive rather than anything malicious. I have also had cheap thumb drives die on me precisely because they were cheap thumb drives.

Quote

Last question, what's the best software to clone a hard drive?  Looking to clone a Win10 box to replace the hard drive.  Thanks.

Not going to make that recommendation in case things go wrong!!!

[aethernaut]

Quote

...or some super large file over and over until the hard drive is filled up?

Forgot to mention, to overwrite the whole partition this super large file will have to be an exact multiple of the space available. When space runs out and the whole file cannot be copied the copy process will error. It will not carry on writing whatever of the super large file it can. Therefore if your super large file is, say, 40GB and your partition is not an exact multiple of 40GB you will have an area that is not overwritten. For example if after a copy of the file is written there is only 35GB free space left the copy will fail and leave 35GB of disk space untouched. The bigger your super large file is the more you will possibly leave behind.

[Bob123]

Thanks aethernaut that was a ton of information.  I lot more then what I knew so thank you!  Do you know of some good software to sift through a hard drive that has a lot of deleted stuff on it?  Guess I'd be curious if I could find a VM I deleted and then once I find that VM I'd like to see if I could find the files on that VM that I also deleted.

[aethernaut]

That's quite a task you have set yourself.

The main things that may affect the recovery of your data is how long since the file was deleted and have you used the disk much since then?

As disks are so large these days many files, especially smaller ones, are recoverable a long time after they are deleted, even if the disk is in use. However if the disk hasn't much free space left there is a much higher chance that the file system has had to re-use clusters from previously deleted files. Also a VM will be a very large file and there is therefore a good chance that many of its clusters would have been re-used. Of course if it was on a separate disk you have hardly used since, you may get lucky.

As for software to do this I can't really suggest anything that is easy to use. Also "professional" data recovery software is horrendously expensive and assumes you know how to use it (they will likely have training courses you can buy - for the price of a reasonable holiday!)

However a util that I have heard good things about is PhotoRec. Despite what its name suggests it does have the ability to recover LOTS of file types including vmdk and vdi files (See the full file format list). Also remember you shouldn't really install and run recovery software on the disk you want to recover files from, because installing / using the software and saving recovered files may actually overwrite data you will want to recover.

Of course if you want go go down the "full-on" forensic recovery route you can try Autopsy but be warned; the learning curve can be astronomical for those who are not already familiar with this aspect of computing.

Finally, recovery software may appear to recover lots of files but that does not mean that they will always be valid / readable. This type of software often has to make assumptions and those assumptions can be wrong. Always expect to get nothing and then you will always be happily surprised when something does come out intact.

Best of luck!!