Low Level Format

From: Joe <rigdonj_at_cfl.rr.com>
Date: Thu Aug 21 09:15:18 2003

At 08:46 PM 8/20/03 -0700, you wrote:
>TRASH3_at_splab.cas.neu.edu wrote:
>>
>> a format /U/V then that will pretty much clean out everything. I have
>> heard from some sources that nothing is ever completely gone and No Such
>> Agency can actually pull data off a drive that was erased and reformatted.
>> I have a hard time believing that one.
>
>I can believe that the data can still be recovered, but I would guess
>that it would take some pretty specialized equipment to measure the
>magnetic field accurately enough to recover data from a formatted disk.
>I would guess that the hysterisis in writing to the disk would leave
>some tell tale signs of the data that was erased.

   That's true, if the data was truely erased. But FORMAT doesn't erase any
of the data. Use Debug, Norton Editor or any of the other disk utilities
and you can still read the data directly from the clusters. IIRC Norton
even had a utility in some of their early packages that would search the
"erased" areas of a hard drive for a given data string and then copy that
cluster to a file so that you had a good chance of recovering erased files
****even without the directory entry****. This was very handy in the days
before DOS 4(?). In the early DOSs the OS used the first available
directory entry on the drive so if you erased a file and then created a new
file, the new file would overwrite the directory entry for the erased one
and prevented you from un-erasing the original file. Later DOSs were
modified to use "empty" directory entries before using erased ones. That
greatly increased your chances of un-erasing a file at a later date since
the dirctory entry survived much longer.

   Joe
Received on Thu Aug 21 2003 - 09:15:18 BST