3

I recently nuked my HDD(s) via a Windows program (Disk Wipe to be precise: http://www.diskwipe.org/), now everything is fine when I try to retrieve the information on that disk by any program I can find except for a couple of programs which have noted that the $RmMetadata folder still exists with files such as $TxfLog.blf within them.

An example image is shown below:

enter image description here

I have done a litle bit of searching to try and understand exactly what these files are but no one seems completely sure.

Could this data still existing pose information leakage problems for a nuked disk if I were to, say, sell it on?

4

The name of $TxfLog.blf is self-explanatory: The extension blf indicates a CLFS log file, and TxF stands for Transactional NTFS. You can see that TxF is just a temporary file that backs up transactions to help against sudden crashes, just like similar precautions in modern databases. There can exist some leakage from this file, but it only would consist of the last few transactions.

System Volume Information sounds innocent, but it can contain indexes for fast searching the files on the partition. Leakage is very likely here.

Although the method you've mentioned destroys most of the data, traces like these still can leak information about the original data. Most file systems can't be filled to 100%, so that writing files as long as writing is possible doesn't remove all traces. If you didn't like to use linux directly, you could use DBAN.

  • What if disk wipe has its own NTFS formatter built in? Could it then attack these inbetween sectors that could still possess data? – Sammaye Aug 29 '14 at 14:15
  • I guess so, but a far more easier (and reliable) way would be to overwrite the drive with zeroes and then create a new filesystem. The creator of disk wipe could have done just simply this. This is, for programmers, also possible on windows, not just on linux. – user10008 Aug 29 '14 at 15:40
  • @Sammaye, if you want to assess that yourself, open up the drive forensically and see what the unallocated space contains (hint: it better be zeros!) – Matthew Peters Aug 29 '14 at 16:53
  • 1
    @MatthewPeters ah I hadn't been able to fully look into that tool yet, I had been looking for something that could take a raw image rather than looking for file handles, thanks – Sammaye Aug 29 '14 at 17:03
  • 1
    @Sammaye, yeah FTK is great, there are other tools out there but I learned on FTK and that's my baby. If you want a super light-weight tool that also writes HxD is perfect as well – Matthew Peters Aug 29 '14 at 17:13
3
+50

I was curious (and perhaps board) so I just ran a quick test to see... I took an old flash drive (4gb was my smallest one), did a quick reformat (to NTFS) and tossed a simple text file on there.

Using FTK Imager, I took a before and after image of my drive (just the raw data dump). I used disk wipe to wipe (using the defaults and basic wipe settings) my test drive and then went to work trying to recover and review what was left behind.

After examining the remaining system files, I find that there is no way to reconstruct the original files themselves. The $Extend and $RmMetadata folders are simply system log files necessary for the file system and disk wipe to function properly, there is no useful recovery data stored in them.

I chose to write to zeros so I could quickly assess what is left behind but random values will work as well.

You can read up on NTFS here and data recovery here. Here is a post describing why the transactional files are there.

To answer your question, yes you can feel safe selling your securely wiped HDD.

You may be interesting in this article as it describes the Gutmann method

  • 1
    Awesome, now gotta work out how to distribute the rep between you two :) – Sammaye Aug 29 '14 at 15:46
  • @user10008 yeah that's what I will do, can't assign bounty for another 19 hours though :) – Sammaye Aug 29 '14 at 17:21
  • 1
    There is a discussion on this: meta.security.stackexchange.com/questions/1623/… – Matthew Peters Aug 29 '14 at 17:38
  • Despipte that discussion I was just too split so I did something I wasn't supposed to but meh – Sammaye Aug 30 '14 at 18:12
2

I don't know exactly if Disk Wipe works by overwriting the partition data, or the disk data. If it only overwrites partition data, there can be files left on hidden partitions.

If you are confortable with Linux, it's very easy to nuke out a disk. Assuming your disk is on /dev/sdb, you could do this:

sudo dd if=/dev/zero of=/dev/sdb bs=65536 oflag=direct

This will overwrite the entire disk with zeroes, effectively clearing all the data.

  • Disk wipe fills the entire disk, regardless of partitions with files each spanning 2GB of the algorithm you choose (in this case random byte) and then deletes those files in order to nuke the disk. I do know of Linux ways but my computer use makes windows ways easier for me. I have a feeling that these files left over are actually for the NTFS file system but I cannot be sure – Sammaye Aug 27 '14 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.