Formatting a HDD

[Stealthbomber]

Firstly, so we're all on the same page....

 

When you first get a PC it's all whizzy-fast when it starts up. You install stuff on it and it slows down a bit. Fair enough.

The problems seem to start as you copy files onto the PC (music, movies, whatever) and then delete them.

It always seems that, even if you defrag your HDD regularly, the general speed of start-up and data access continues to slow down once you've been using a PC for a few months.

 

I guess part of this is due to registry entries and I'm aware of partition cleaning programs to help with this. I know these programs can fix problems with the registry but I've yet to see one that can speed up a PC that's got bogged-down with junk.

 

Anyway, moving along to my actual question...

 

let's say we've got our 6 month old PC with a fair amount of junk installed on it, fragmented files and all the usual dross.

I want to do a fresh install of Windows on it. At the start of the installation I delete the primary HDD partition then make a new one, do a quick format and continue installing the OS.

 

My question (finally) is, does all the old data have any impact on the way the HDD will perform if you only wipe the HDD as described above?

Is there any benefit in doing a proper format and waiting 6 hours while a 500gb drive is formatted?

 

I was under the impression that, basically, a quick format is good enough cos it simply "doesn't matter" about the data written on the drive once the MBR is erased.

I thought the only benefit of a pukka format is for discovering and marking bad sectors.

 

Comments?

[MDK_Marshal]

Well, the old data shouldn't have any effect on anything once the drive's been formatted.

 

As I'm sure you're aware, formatting a disk never actually destroys the data - all it does is re-write the partition table and MBR. The MBR is, IIRC, the drive info and stuff to make it bootable. The partition table is the bit that actually stores data about the drive's filesystem, and what files are where.

 

Not sure on the difference between a quick format and a "normal" one, but I'd assume that the normal one does a more thorough check of the disk to build a more accurate partion table. Or something.

 

In any case, once you've formatted the disk, it may as well be blank for the purposes of speed. The whole disk will be marked as writeable, and the only thing involved in writing data to the drive is flipping bits back and forth - this'll take the same time if you have a drive full of zeroes, or a drive filled with what used to be oodles and oodles of gun pr0n.

 

Fragmentation is only really a problem because the OS has to either scoot accross a big chunk of the drive looking for large enough space to write a file, or fragment it into lots of bits and write them individualy. Then, when it wants to get the data again, it has to go to multiple locaitons on the disk, get all the data, then piece it back together again. If the buffer on the HDD gets filled, then you end up having to send the data to RAM, empty the buffer, then find the rest of the file, which slows things down even more.

 

 

 

Aaaaaannnyway, I'm rambning now. Short answer: No, to the best of my knowledge, you'll be perfectly fine with a quick format.

[Chimpy]

You're correct Stealth.

 

De-fragging is essential though and it can take several passes to achieve a good result.

[Delfi]

I thought the only benefit of a pukka format is for discovering and marking bad sectors.

 

And also permanently erasing any data. Useful if you're getting rid of a PC that had any sensitive material on it.

[Skarclaw]

A full format won't properly erase data. I've heard that forensic teams have recovered data from pcs that had been formatted etc then set on fire. You need a sledge hammer or some thermite to properly erase stuff

[Delfi]

A full format won't properly erase data. I've heard that forensic teams have recovered data from pcs that had been formatted etc then set on fire. You need a sledge hammer or some thermite to properly erase stuff

 

Actually I've just checked and you're right ... my bad. The full and quick format delete the same things ...

 

There are tools available that quick format and then write garbage to the whole disk for this purpose.

[Chimpy]

You also need to write ###### several times over as you can still recover data even if it has been overwritten several times with the right techniques.

[Stealthbomber]

Right ho.

 

Got a bit of a format-frenzy going on here.

Believe it or not, I have sold FOUR old PCs in the last 24 hours. 2 of them were decent spec machines but were plodding a bit due to fragmentation. I'd hate to think that they'll still under-perform after a quick format.

[DarkLite]

Best way to make data unrecoverable is a blowtorch.

[MDK_Marshal]

Or just go into linux and dd /dev/random onto the drive...

[Stealthbomber]

Best way to make data unrecoverable is a blowtorch.

Although that often affects the price you can ask for a 2nd-hand PC.

[Delfi]

You also need to write ###### several times over as you can still recover data even if it has been overwritten several times with the right techniques.

 

By which I assume you mean data recovery through physical means rather than just through software. Very specialist and very very expensive ... doable though.

 

There was an incident in the late 80's when old MOD PC's were sold on and files had just been DOS deleted. After that no PC left in anything other than a shredded condition. I seem to recall that the directive even specified a minimum size for any piece.

 

 

[Misfit]

A full format won't properly erase data. I've heard that forensic teams have recovered data from pcs that had been formatted etc then set on fire. You need a sledge hammer or some thermite to properly erase stuff

 

Unless of course, you do a low level format.

[Night_raven]

Although that often affects the price you can ask for a 2nd-hand PC.

 

Hi mate, if you must absolutley destroy all data on the HDD.

 

then you cannot go wrong with this;

 

Boot'n'Nuke

 

I've used it on several of my old HDD's before selling them, it's a sure win way of destroying all data on it.

 

 

[MDK_Marshal]

Or just go into linux and dd /dev/random onto the drive...

 

I'm rather surprised I've got to quote myself here.

 

If you dd a drive, then no data recovery companies will touch it, no matter how much you want to pay them.

 

Because they can't get the data off of it.

 

EDIT: See also, http://16systems.com/zero/

 

EDIT again: Actualy, misfit seems to be on the right track... though actually doing a low-level format in windows is enough of a pain that you may as well torch the disk

[Azulsky]

If u are selling a computer do a pass with Acronis or Killdisk, if you are selling it to some random person do a few passes.

 

If you are trying to permanently get rid of data that is very sensitive destroy the disk. Hard drives cost $1 a GB now so no reason to takes risks in that case. Its true they can do a MRI type look at the drives that even have been deleted with 0000 passes and recover data.

 

Boot times shouldnt be affected too much by HD being filled , but the speed at which Windows actually gets its *albartroth* moving will be. You might investigate what your startup processes are and cutdown on those and you will see a drastic reduction in time. There are various programs for detecting registry errors( I use C Cleaner cuz its free) that you can use, just do a bit a of research on which processes are which and that sorts that out.

 

 

You only need to do a Full Format if you are playing with a new disk or you recently dropped yours because it does take forever due to bad sectors. Newer HD's shouldnt have bad sectors out of the box but after it comes through the post, etc, etc u never know

http://support.microsoft.com/kb/302686

 

[MDK_Marshal]

If u are selling a computer do a pass with Acronis or Killdisk, if you are selling it to some random person do a few passes.

 

That's basicaly doing a wimpy version of a low-level format, or dd'ing the drive.

 

If you are trying to permanently get rid of data that is very sensitive destroy the disk. Hard drives cost $1 a GB now so no reason to takes risks in that case. Its true they can do a MRI type look at the drives that even have been deleted with 0000 passes and recover data.

 

You're thinking of an electron microscope, and while it IS possible to recover data from a drive in this wat, it requires stupid resources - you're talking government-level resources here, or uber-big corporations.

 

Oh, and nobody's ever actualy recovered data from a dd'd drive (or zeroe'd, if you want to use simple terms). It's just a theory, one which nobody has actually tested. And various very smart people have very strong doubts that it's possible. Or, well, anybody who knows how hard drives work...

 

You only need to do a Full Format if you are playing with a new disk or you recently dropped yours because it does take forever due to bad sectors. Newer HD's shouldnt have bad sectors out of the box but after it comes through the post, etc, etc u never know

 

Um. Bad sectors are caused by the drive being physically borked - IE, parts of the platter have had something go bad.

[Donut]

My computer gives me a "NATO Standard" for deleting data... Rewriting each sector 7 times over randomly seems pretty secure to me.

[Azulsky]

That's basicaly doing a wimpy version of a low-level format, or dd'ing the drive.

I fail to see how random bits are any more unwimpy than just 0's or 1's, its gg after either option really

 

You're thinking of an electron microscope, and while it IS possible to recover data from a drive in this wat, it requires stupid resources - you're talking government-level resources here, or uber-big corporations.

 

Oh, and nobody's ever actualy recovered data from a dd'd drive (or zeroe'd, if you want to use simple terms). It's just a theory, one which nobody has actually tested. And various very smart people have very strong doubts that it's possible. Or, well, anybody who knows how hard drives work...

 

I Apologize, i meant to say it isnt true(hence why i said above you can do a few more passes of disk destroy to make you sleep safer if you are putting it out on the real market). But the truth is if one is paranoid enough about it, the alternative way is to physically kill the hard drive. There is a bit of interesting theory about the imprinting left on the grains out there , im sure it will pop up in some movie sooner or later and ill join you in a jolly.

 

Um. Bad sectors are caused by the drive being physically borked - IE, parts of the platter have had something go bad.

Right which occur from physical trauma to the HD, meaning it got bonked in the mail on the way to your house, or you dropped it. The only time you need to run the full format is then when you first get the hard drive, otherwise you are most likely wasting time. The Full Format looks for the bad sectors and builds the MFT(for NTFS folk). If you were to get bad sectors during basic usage it means the whole drive is about to go bonkers(usually, modern drives tend to kick the bucket all at once) otherwise its will usually present itself in the manner of a nice BSOD and you can run Check Disk Utility or whatever 3rd party app u prefer.

 

 

I actually have played with BootnNuke on some old disks but for my new disks should i have to do it before the RIAA comes knocking i think a nice axe will settle the matter even faster, plus the axe doubles as my Vista multitool.

[MDK_Marshal]

I actually have played with BootnNuke on some old disks but for my new disks should i have to do it before the RIAA comes knocking i think a nice axe will settle the matter even faster, plus the axe doubles as my Vista multitool.

 

Well, an axe won't do much good unless you can grind the platter into a fine powder with it.

 

See, split the platter into a relatively small number of parts (lets say, ten, for arguments sake), and they can simply stick it back together and whip the data off it. Worst case scenario for them is they lose a couple of meg of raw data, which will be spread across lots of files. However, there's lots of nifty algorithms and things that they can use to either reconstruct that data, or skip over it entirely.

 

Either way, they're GOING to find your collection of horrifying porn.

[Donut]

Well, I guess the only surefire way is to melt the damn thing then.

Or would a simple microwave do the trick?

[MDK_Marshal]

Or just boot into linux (installed or on a live CD, doesn't matter) and dd the damned drive!

 

Have I just been talking to myself here, or what?

 

If you dd a drive in linux, even with only one pass, no data recovery firm will touch it, because they know that they can't recover the data from it!

 

Just as effective as melting the drive, and you can use it again.

[snorkelman]

If you dd a drive in linux, even with only one pass, no data recovery firm will touch it, because they know that they can't recover the data from it!

 

Just as effective as melting the drive, and you can use it again.

 

commercial data recovery firms will give up bothering even on drives where a single pass has been done because its not economically viable for them to start whipping out electron microscopes and playing umpteen reptitions of eeny meeni minie mo to see if they can come up with anything interesting.

 

asuming you've kidnapped the presidents daughter or have a drive full of industrial secrets suficient for a 'cost being no object' approach, then 3 passes will prevent moden drives from being reread by anything and 7 passes will ensure that even old MFM drives get into that same state

 

Id suspect that melting a drive is still seen as desireable by some organisations simply because it gives a definitve visual confirmation that the drive is indeed absolutely positively tits up, and rules out any possiblity of human error (where an intact drive might slip thru the net and have required cleaning overlooked).

 

 

[snowman]

Either way, they're GOING to find your collection of horrifying porn.

 

Yeah, amusing that so many people on here have 'sensitive material' on their PCs - Maybe if you're daft enough to have a file marked "Accounts and Passwords" on your disk you might have something of commercial value to someone, but I suspect the majority are just worried about their porn and pirate video collection being made known to someone!

 

Cheers.

[Chimpy]

Besides if anyone was really concerned about security their drive would already be encrypted and then they wouldn't need to worry about overwriting deleted data anyway.

 

Anyway to be sure; nuke it from orbit.