LinuxQuestions.org
Page 1 of 2 1 2
Show 50 post(s) from this thread on one page

LinuxQuestions.org (/questions/)
-   General (https://www.linuxquestions.org/questions/general-10/)
-   -   zero-fill HD (https://www.linuxquestions.org/questions/general-10/zero-fill-hd-648408/)

lethys999 06-10-2008 08:10 PM
zero-fill HD
 
i have a laptop runing windows XP and has a TON of viruses and CAN NOT get rid of them! and the HD-is locked (by ahacker most likely)
we did EVERYTHING we could, the only option left is to zero-fill the HD. can some one please tell me how?:confused:

osor 06-10-2008 08:35 PM
In a live-cd environment,
Code:
dd if=/dev/zero of=/dev/sda
(replace sda with your drive).

P.S., most likely, just reformatting your hard drive will be sufficient. Zeroing it is usually done to inhibit forensic analysis (which is done after filling it with random bytes a few times).

gilead 06-10-2008 08:36 PM
Why is zero filling the hard disk the only option left? Although this is not a windows forum you haven't told us what errors you you were getting, what steps you took or why you are convinced a hacker locked your hard drive. It may be that there are many things you can do before trying to wipe the whole drive.

Be VERY CAREFUL that you select the correct drive for the following or you may wipe out data that you did not mean to. If you're convinced this is the only way, you could use DBAN or any bootable tools disk (for example SystemRescueCd) and run dd if=/dev/zero of=/dev/hda bs=1M (change /dev/dha to your hard disk).

stress_junkie 06-10-2008 08:37 PM
Download the ISO for any live Linux CD. I like to use the System Rescue CD for things like this because it boots quickly and it has a lot of tools.

http://www.sysresccd.org/Main_Page

If you have trouble booting it you can give it boot parameters to ignore ACPI and APIC.
Code:
boot: rescuecd noacpi apic=off
Then you can overwrite the hard disk. This could take a long time, like 12 hours or more. Any of the following commands, by itself, will do the trick. The first example command, shred, will take the longest because it will overwrite the disk 25 times. The second example and the third will only overwrite the disk once. The second example takes longer than the third because you are using the true random number generator while the third example uses the pseudo random number generator.

Code:
shred /dev/hda

dd if=/dev/urandom of=/dev/hda bs=4096 count=1024G conv=notrunc,noerror

dd if=/dev/random of=/dev/hda bs=4096 count=1024G conv=notrunc,noerror
Note that you will be overwriting the badblocks file on the disk. It would be a good idea when you format the disk to use the long method that checks for bad blocks. This is available in Windows Disk Manager and in the Linux mkfs command.

lethys999 06-10-2008 09:09 PM
ok i unlocked the HD (a freind told me how), but when i type

Format C:

it says "Format cannot run bcause the volume is in use by another process. Format may run if this volume is dismounted first.
ALL OPENED HANDLES TO THIS VOLUME WOULD THEN BE INVALID.
Would you like to force a dismount on this volume? <y/n>"

(when i tried "Y" it gave me a message and didn't work. it gave me the SAME message for "N") it says

"Cannot lock the drive. The volume is still in use."

what does it mean? and how do i fix it?:scratch:

stress_junkie 06-10-2008 09:15 PM
No operating system will format the volume it is using to run.

lethys999 06-10-2008 09:26 PM
darn. i only have 1 volume though...

jschiwal 06-10-2008 09:54 PM
Quote:
Originally Posted by stress_junkie (Post 3180963)
Code:
dd if=/dev/random of=/dev/hda bs=4096 count=1024G conv=notrunc,noerror
Not only will this take longer, but you will empty out the entropy pool very quickly unless your system has a hardware RNG device.

win32sux 06-11-2008 06:06 AM
Considering that this is a Windows security issue, and not a GNU/Linux one, I'm moving this to General. BTW, I really do think that the easiest way for you to zero-fill your drive is probably to boot a DBAN CD and select the Quick Erase option. Make sure you backup any important documents/data on any of the drives connected to the box before doing so, of course.

unSpawn 06-11-2008 06:41 AM
Quote:
Originally Posted by jschiwal (Post 3181006)
Not only will this take longer, but you will empty out the entropy pool very quickly unless your system has a hardware RNG device.
Not unless you use the fast urandom alternative frandom, which I posted about earlier. See for instance linkage in: http://www.linuxquestions.org/questi...42#post3123542.

AceofSpades19 06-14-2008 03:45 PM
Quote:
Originally Posted by lethys999 (Post 3180991)
darn. i only have 1 volume though...
you are supposed to boot off a cd to format your harddrive

ErV 06-14-2008 04:37 PM
A "silly" question: what's the point in wiping out entire harddrive with zeros (or random data)? Erasing partition table and MBR (i.e. first sectors) should be pretty enough to "kill" all data on harddrive. After that harddrive will look like unformatted, so it'll be possible to install new OS from scratch.

unSpawn 06-14-2008 06:56 PM
Quote:
Originally Posted by ErV (Post 3184857)
A "silly" question: what's the point in wiping out entire harddrive with zeros (or random data)?
Here it is about sanitation, as in making certain versus "I thought".


Quote:
Originally Posted by ErV (Post 3184857)
Erasing partition table and MBR (i.e. first sectors) should be pretty enough to "kill" all data on harddrive.
Have disk, erase MBR and PT, run file carver?


Quote:
Originally Posted by ErV (Post 3184857)
After that harddrive will look like unformatted, so it'll be possible to install new OS from scratch.
Exactly. Saying "will look like" does not equal to making certain.

pixellany 06-14-2008 07:21 PM
Quote:
Originally Posted by gilead (Post 3180962)
Although this is not a windows forum.....
You're right--try here:
http://windowsquestions.org

;)

gilead 06-14-2008 07:58 PM
Quote:
Originally Posted by pixellany (Post 3184938)
You're right--try here:
http://windowsquestions.org

;)
Hmm, I got there and had a feeling of deja vu followed by happiness...


All times are GMT -5. The time now is 01:54 PM.
Page 1 of 2 1 2
Show 50 post(s) from this thread on one page