Feb
12

Security Aspects of the FORMAT Command


The FORMAT command writes marks on the disk to indicate the beginning and end of tracks and sectors. There are two kinds of formatting: ‘low level’ and ‘conventional’. The former is done by the disk manufacturer and does wipe out any previous data on the disk. The latter (conventional formatting) does not wipe the disk clean; any data from before can still be recovered easily forensically. There is an exception in the case of a floppy disk, in which case the FORMAT command does both low-level formatting and conventional formatting. Even so, do not count on that to remove all forensic evidence from a disk; given that it costs only pennies, open it up, cut it up in as little pieces as possible, and burn it or flush it down the toilet.

The reason why the FORMAT command does not do the much desired (for security reasons) low-level formatting on hard disks, is that there are far too many different hard disks, and FORMAT does not know how to handle them all (or any); for example, the number of sectors per track varies on hard disks but not on floppies

  • Digg
  • Sphinn
  • del.icio.us
  • Facebook
  • Mixx
  • Google
  • Bumpzee
  • co.mments
  • description
  • Fleck
  • Furl
  • Global Grind
  • Hemidemi
  • IndiaGram
  • blinkbits
  • BlinkList
  • De.lirio.us