FORMAT C:

[Mikorist]

Ko ne zna da zna kad i ako se zarazite pod sedmicom teskom zarazom.Obican FORMAT ubija uvek nulama hard disk pre obicnog formata osim ako se koristi /q opcijaNa win 2K/XP nije bio taj slucajReferenceSTARO:http://support.microsoft.com/kb/302686/en-usNOVO:http://support.microsoft.com/kb/941961/en-us

[stein]

Nije sada meni jasno šta to znači za mene neukog i običnog smrtnika? Ako mi pukne Win7, ja ne znam drugi način nego da strpam instalacioni disk u fioku i da pokrenem novu instalaciju (sa sve brisanjem particije, kreiranjem nove particije i formatiranjem pre instalacije) i da se nadam da sam uradio bekap baš svega što mi je potrebno...

[чика-Брка]

na moju valjda srecu, XP SP3 + Comodo Internet Security Premium do sada bezparazita. dobro se pokazao antivirus, samo je malo dosadan dok ne zapamti neke stvarcice neko vreme od kad se pusti u pogon prvi put.toliko od mene kao laika ( kao i samoinstalera )

[Mikorist]

Nije sada meni jasno šta to znači za mene neukog i običnog smrtnika?

ubijanje nulama znaci upravo to (fill with zeros)podaci na hard disku se sastoje od 0101010100101010101010101 prosto receno posle nulovanja imas samo 000000000000000000000na hard disku odnosno nema ni virusa. nova FORMAT komanda ima ugradjeno to u sebi. (napredovala je)ranije morao sam da koristim najmanje dva programa da bih odradio ovu operacijui bio 100 % siguran da sam ocistio HDD.

[sir Oliver]

A Low level formating?

[Mikorist]

A Low level formating?

Low-level formatting neadekvatno (kao izraz) koristi mnogo ljudi

"While it is generally impossible to perform a complete LLF on most modern hard drives (since the mid-1990s) outside the factory[11], the term "low-level format" is still used for what could be called the reinitialization of a hard drive to its factory configuration (and even these terms may be misunderstood). Reinitialization should include identifying (and sparing out if possible) any sectors which cannot be written to and read back from the drive, correctly. The term has, however, been used by some to refer to only a portion of that process, in which every sector of the drive is written to; usually by writing a zero byte to every addressable location on the disk, sometimes called zero-filling."

http://en.wikipedia.org/wiki/Disk_formatting

Format komanda pod Windows-om 98/2K/XP NIKADA ne radi zero-filling.

Format komand pod Vistom i 7 uvek PRE formatiranja - osim ako se koristitI /Q prekidac

dakle zero-filling je jedini nacin da se hard disk vrati u "fabricko stanje"

potrebno je 30-40 puta odradiditi full zero-filling da niko ziv ne bi mogao vise da procita

magnetne slojeve i podatke sa Hard diska.

i zato je LLF jako teska operacija prakticno i nemoguc u jednom cugu...

evo nekih stvari na tu temu:

--------------------------------------------------------------------------------------------------------------------

There are "de-magnetisers" machines (degausser) that are used for disabling drives that have contained top-secret data, and these cost a bundle. However, only using software, you can only have the drive read or write data. The drive heads cannot just "scatter magnetic charges"... how would a head that is designed to read and write individual bits (in block), ie precisely, be able to do that?. Besides, if it were the case, the drive would either need a low level format after that or be filled with bad clusters, ie: be just plain dead.

Here's an extract of DoD 5220.22-M shredding guidlines:

http://www.killdisk.com/dod.htm

chapter8

a. Degauss with a Type I degausser

b. Degauss with a Type II degausser.

c. Overwrite all addressable locations with a single character.

d. Overwrite all addressable locations with a character, its complement, then a random character and verify. THIS METHOD IS NOT APPROVED FOR SANITIZING MEDIA THAT CONTAINS TOP SECRET INFORMATION.

Also, a comparaison of software "shredders" can be found here:

http://www.sdean12.org/Comparison_Shredders.htm

(Check the "Overwrite algorithm" row for wiping technique)

--------------------------------------------------------------------------------------------------------------------

Well, no, IT IS possible:

Overwriting data on disk isn't like filling a closet, it's like writing over used paper... What happens is that when the disk heads write on the platter, it re-aligns magnetite (or whatever magnetic compound they use) in a diffrent direction. However, a single write doesn't manage to get all magnetite (or whatever) particuls re-alligned. So while the majority of particuls will have change directions, there will be a few residual ones that will still be oriented in the previous direction.

So finding out what data was there before means using a more sensible device that can distinguish or detect variations in the magnetic field or such... (That's why whiping software will make multiple writing passes, sometimes with randomized caracter, in order to try and re-allign all particuls). Of course this is hard to do and pretty expensive, but people with enough money and resources (think FBI, CIA, NSA...) could and do have the means to do it. In fact, I remember reading somewhere that it was rumored the NSA (I think) was able to recover data after 27 passes!

--------------------------------------------------------------------------------------------------------------------

When data is written to magnetic media it is written to a magnetic domain. This domain consists of a number of magnetic bits (not to be confused with a data bit 0 or 1) which receive the magnetic charge. Not all of the bits in the magnetic domain will change when the head passes over during the write operation and will retain the magnetic properties from a previous operation. Does this mean that a magnetic domain can contain magnetic bits that are set to a zero and magnetic bits that are set to a one? It certainly does, but if the write operation was setting the bit to a one then the majority are set to a one, strongest at the center of the domain weaker at the edges.

Remember in grade school when you put metal filings on a piece of paper and ran a magnet underneath. Most of the filings lined up and pointed in the same direction, but the ones at the edges didn't all point with the others. The same thing is happening when you write to the hard disk.

Is it easy to peel back these layers to determine what was overwritten? With modern hard disks this is a difficult, costly, and time consuming process but portions of overwritten data can be recovered if it was overwritten or wiped with a single pass process. The minimum process that should be involved in a wipe would be a three pass write. A three pass will make one pass writing 00 followed by it's complement which is an FF and a final pass of random data. It is still possible to recover some data after a 3 pass wipe, but whoever does will want that data very badly and have the $$ to attempt the recovery. Generally a 7 pass wipe will make it near impossible to recover the data and I have never heard of any data being recovered after a Guttman 35 pass wipe. (Disclaimer.. Doesn't mean that those agencies with 3 letter names can't do it but they would really want you bad to go to the expense involved)

--------------------------------------------------------------------------------------------------------------------

DBAN: Darik's Boot and Nuke: (free tool)

Darik's Boot and Nuke ("DBAN") is a self-contained boot floppy that securely wipes the hard disks of most computers. DBAN will automatically and completely delete the contents of any hard disk that it can detect, which makes it an appropriate utility for bulk or emergency data destruction.

DBAN is a means of ensuring due diligence in computer recycling, a way of preventing identity theft if you want to sell a computer, and a good way to totally clean a Microsoft Windows installation of viruses and spyware. DBAN prevents or thoroughly hinders all known techniques of hard disk forensic analysis.

http://sourceforge.net/projects/dban/

Eraser: (free)

Eraser is an advanced security tool (for Windows), which allows you to completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns. Works with Windows 95, 98, ME, NT, 2000, XP, Windows 2003 Server and DOS.

Eraser is Free software and its source code is released under GNU General Public License.

The patterns used for overwriting are based on Peter Gutmann's paper "Secure Deletion of Data from Magnetic and Solid-State Memory" and they are selected to effectively remove magnetic remnants from the hard drive.

Other methods include the one defined in the National Industrial Security Program Operating Manual of the US Department of Defence and overwriting with pseudorandom data. You can also define your own overwriting method

http://www.heidi.ie/eraser/download.php

u sustini ko zeli da popuno brzo unisti dokaze i podatke sa hard diska mora da

ga cibne u visoku pec:

toliko o efikasnosti obicne komande FORMAT C:

[zika]

Case study: Virus ostane na prostranim livadama HDD-a, u rasutom stanju, nepoznat FAT-u. Da li je virus sposoban da se, iz takvog stanja, vrati u ratničko stanje? Kako?Naravno, govorimo o Windows OS...Podataka na (svakom) mom disk-u što se tiče, može da ih čita ko god želi... Ako nađe nešto zgodno, neka mi javi da znam...

[stein]

ubijanje nulama znaci upravo to (fill with zeros)podaci na hard disku se sastoje od 0101010100101010101010101 prosto receno posle nulovanja imas samo 000000000000000000000na hard disku odnosno nema ni virusa. nova FORMAT komanda ima ugradjeno to u sebi. (napredovala je)ranije morao sam da koristim najmanje dva programa da bih odradio ovu operacijui bio 100 % siguran da sam ocistio HDD.

Znači, za mene se ništa ne menja ja svakako pre instalacije uvek potpuno zbrišem sve particije na hard disku pa ih opet kreiram, pa tek onda formatiram. Srećom, ne radim to preterano često

[Mikorist]

Da li je virus sposoban da se, iz takvog stanja, vrati u ratničko stanje? Kako?

Naravno, govorimo o Windows OS...

preko MBR

ako je u pitanju Boot sektor virus

fdisk /mbr

je obicno resavao taj problem . pre formata.

http://support.microsoft.com/kb/122221

no postoje ogranicenja za ovu komandu.

The fdisk /mbr command works only on hard disk drives that are within the limitations of DOS. If you are accessing devices that are beyond the 1024 cylinder limit, you cannot run fdisk /mbr and you receive error code 1762.

ranije sam obicno koristio

http://www.ranish.com/part/

ima zero-filling opciju u sebi.

[zika]

preko MBR

ako je u pitanju Boot sektor virus

fdisk /mbr

je obicno resavao taj problem . pre formata.

http://support.microsoft.com/kb/122221

no postoje ogranicenja za ovu komandu.

ranije sam obicno koristio

http://www.ranish.com/part/

ima zero-filling opciju u sebi.

Upravo tako. Dakle, nije zero-filling lek sam po sebi, valja znati gde je obavezna primena a gde je ...

Razumeli smo se, još kod lokomotive...

Misliš da ovaj „novi“ format u Win briše MBR...?

Ovo pitam, ozbiljno, jer nemam (ozbiljnijeg, dubinskog) dodira sa novijim Win ostvarenjima... Moj nedostatak, ne Win-ov...

[Mikorist]

Misliš da ovaj „novi“ format u Win briše MBR...?

By default in Windows Vista, the format command writes zeros to the whole disk when a full format is performed.

tako kazu na microsoft.com.... ako lazu onda

[zika]

By default in Windows Vista, the format command writes zeros to the whole disk when a full format is performed.

tako kazu na microsoft.com.... ako lazu onda

Ne bi im bilo prvi put...

[crni.]

auuu bre...belosvetske dangube napravile nauku od dubokog oranjabas kako rece stein, ubacis inst disk, preores c particiju i molis boga da si uradio bejkap onoga sto ti je stajalo na c disku (ako je uopste tu nesto bilo)zal za izgubljenim vremenom bi nadometnut ultrabrzim radom "nove"masine

[stein]

auuu bre...belosvetske dangube napravile nauku od dubokog oranja

bas kako rece stein, ubacis inst disk, preores c particiju i molis boga da si uradio bejkap onoga sto ti je stajalo na c disku (ako je uopste tu nesto bilo)

zal za izgubljenim vremenom bi nadometnut ultrabrzim radom "nove"masine

Uglavnom mi D, E i F zato služe... Da ne gubim sa C: ako već dotera cara do duvara...

[crni.]

da li neko slucajno zna za neki program koji radi kao where is it? a da je besplatanznaci, nesto sto organizuje fajlove, narocito one koji su narezani

[stein]

da li neko slucajno zna za neki program koji radi kao where is it? a da je besplatanznaci, nesto sto organizuje fajlove, narocito one koji su narezani

Nisam probao, ali možda ovde?http://www.techsupportalert.com/content/best-free-file-disk-catalog-organizer.htm#Cathyili http://www.canadiancontent.net/tech/freeware/File+Organizers/

[ZZZ]

osx ima to odavno i cak 3 pass...ali traje duze...

[sir Oliver]

Jeste li culi za aferu o HDDima ugradjenim u fotokopir masine? Neki fotokopir aparati imaju u sebi HDD i sve su kopirano snimali. Serviser dodje povremeno kao na redovno odrzavanje i uzme i promeni HDD koji odnese na analizu. Ti fotokopiri su instalirani u velikim korporacijama ali izgleda i u drzavnim institucijama. Izgleda i kod nas pa se sada o tome cuti.

HDD kopirke

[zika]

Jeste li culi za aferu o HDDima ugradjenim u fotokopir masine? Neki fotokopir aparati imaju u sebi HDD i sve su kopirano snimali. Serviser dodje povremeno kao na redovno odrzavanje i uzme i promeni HDD koji odnese na analizu. Ti fotokopiri su instalirani u velikim korporacijama ali izgleda i u drzavnim institucijama. Izgleda i kod nas pa se sada o tome cuti.HDD kopirke

Nema tu nikakve afere. Za HDD-ove su znali svi (bolji) service majstori. I, naravno, svako ko se udubio u to šta je naručio, kupio, postavio... Znam za nekoliko HDD-ova koji su, uredno, prebrisani, i rastavljeni pošto su se nalazili na „sensitive“ mestima... Nikada majstor nije ostavljen da sam radi na mašini... Možete ostaviti i otključana vrata, čak i otvorena, nije to problem vrata, to je problem korisnika... Ako pogledate document-e koji idu uz te uređaje videćete da to nije nikakva tajna. Naprotiv, pa to je feature... Ovi što su „otkrili“ te HDD-ove, jesu li primetili i da te mašine troše struju...?