[NTLUG:Discuss] Hard drive conundrum - unknown data
Russ
russ.barrows at gmail.com
Fri Oct 9 14:14:15 CDT 2009
I hope one of you can shed some light on this question as to how I can
remove data from a hard drive that doesn't seem to be neither movable
nor removable. While this involves Windows and Ubuntu, I wanted to
ask the men and women of this LUG because I think overall you're much
more on the ball that those on M$ forums.
I acquired an used hard drive for purposes of using it in as the sole
HD in a dual-boot XP and Ubuntu machine. I was told that the HD had
been erased and that was OK with me. Still, when I installed the hard
drive I run Knoppix and used 'shred' to run 7 passes with a final pass
writing zeroes. I partitioned the hard drive and loaded XP. In the
process of the installation of the OS and anti-virus, firewall, etc. I
decided to do a compress and noticed that there was a large section of
the hard drive that was apparently blank, even after compression. I
was concerned that XP hadn't been written properly so I ran Spinrite
to check the drive for back blocks, etc. Everything was fine. A
second compression run which would normally remove blank sections to
create contiguous files failed to change the location or size of the
blank area. Then on reboot a screen popped-up with two choices: 1)
Windows XP Professional and 2) "Unidentified operating system on Drive
C:".
Having lots of time on my hands, I decided to wipe the HD again using
'shred' with 3 passes and a final write of zeroes. Then I ran
Spinrite and noticed that Spinrite was reading zeroes until suddenly
it got to a portion of the hard drive that displayed random characters
and then reverted to reading only zeroes for the remainder of the
scan. I again partitioned the drive and loaded XP. Running the
compression software showed again an apparently large section of the
drive which appears to be blank.
Next I ran 'Darik's Boot n Nuke' thinking that 'shred' wasn't doing
the job. Long story short... There is a section of the HD that has
apparent random data written to the drive that I can not erase and can
not cause to be moved. In addition, a logical for Drive D:
(identified as a diskette drive of which there is none) has been added
to Drive E which was previously Drive D.
On the positive side, the dual boot is working fine just as one would
expect with Ubuntu.
This situation concerns me because had I decided to load only Ubuntu I
likely would not have been aware of the situation. Any thoughts,
other than trashing the HD? What form might this data have? Might it
be encrypted making it resistant to erasure? Might it be that
something in the hardware has been corrupted?
--
Russ
More information about the Discuss
mailing list