LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Security
User Name
Password
Linux - Security This forum is for all security related questions.
Questions, tips, system compromises, firewalls, etc. are all included here.

Notices


Reply
  Search this Thread
Old 01-11-2007, 05:32 PM   #1
here2serve
Member
 
Registered: Sep 2005
Location: Hinesville
Distribution: Debian, Mandriva, Ubuntu, Fedora
Posts: 104

Rep: Reputation: 15
wiping vrs reformatting


I know that data can still be accessed on a reformatted drive. Can malware/root kits survive a reformat? When I fix a Win box I
1. retrieve the user dada.. using linux
2. run anti-virus scan on the data
3. Wipe the drive with random data
4 reformat
5. Reinstall the OS

I have been told that it's over kill and malware won't run after reformatting. I would think if data can be accessed so could code?

Am I paranoid? Yes my drives are encrypted!
 
Old 01-11-2007, 05:39 PM   #2
stress_junkie
Senior Member
 
Registered: Dec 2005
Location: Massachusetts, USA
Distribution: Ubuntu 10.04 and CentOS 5.5
Posts: 3,873

Rep: Reputation: 335Reputation: 335Reputation: 335Reputation: 335
I do the same things that you do. I have also been told that this is overkill. Let me say that IMO there is no such thing as overkill when it comes to security. There is only a limit to what people are willing to do. I use the shred utility on disk partitions. This accomplishes a level of data wiping that is comparable to the data wiping requirements of computers that store military secrets.

Don't listen to people when they say that you are doing more than you have to do when it comes to security. There is no real limit. Do as much as you can stand to do. At some point we all reach an emotional point where we are satisfied. Don't lower that point for yourself based on other people's opinions.

Keep up the good work.
 
Old 01-11-2007, 06:36 PM   #3
here2serve
Member
 
Registered: Sep 2005
Location: Hinesville
Distribution: Debian, Mandriva, Ubuntu, Fedora
Posts: 104

Original Poster
Rep: Reputation: 15
No I'm not stressed about it. I figure security and forensics are a good field for me since I really do not change based what may be popular but on what I think is right. I just couldn't quickly find a definitive answer on wether malware would continue on after a reformat.
 
Old 01-11-2007, 06:45 PM   #4
stress_junkie
Senior Member
 
Registered: Dec 2005
Location: Massachusetts, USA
Distribution: Ubuntu 10.04 and CentOS 5.5
Posts: 3,873

Rep: Reputation: 335Reputation: 335Reputation: 335Reputation: 335
Yes there are utilities to recover files from partitions that have been reformatted. Here is one:

http://www.cgsecurity.org/wiki/TestDisk_Download

 
Old 01-11-2007, 07:38 PM   #5
here2serve
Member
 
Registered: Sep 2005
Location: Hinesville
Distribution: Debian, Mandriva, Ubuntu, Fedora
Posts: 104

Original Poster
Rep: Reputation: 15
Thanks thats good to know but the question remains.... can malware affect/run after reformatting
 
Old 01-11-2007, 07:41 PM   #6
syg00
LQ Veteran
 
Registered: Aug 2003
Location: Australia
Distribution: Lots ...
Posts: 21,187

Rep: Reputation: 4129Reputation: 4129Reputation: 4129Reputation: 4129Reputation: 4129Reputation: 4129Reputation: 4129Reputation: 4129Reputation: 4129Reputation: 4129Reputation: 4129
Quote:
Originally Posted by here2serve
I just couldn't quickly find a definitive answer on wether malware would continue on after a reformat.
Nope.
Once formatted, there is no way to locate any residual data (including executables) potentially left on the disk using normal means. Means any residual "malware" can't be launched.

Recovery is a different matter.
And of course, malware could use similar techniques to locate the "residual" data - but that would have to be a new malware attack.
 
Old 01-11-2007, 07:57 PM   #7
Crito
Senior Member
 
Registered: Nov 2003
Location: Knoxville, TN
Distribution: Kubuntu 9.04
Posts: 1,168

Rep: Reputation: 53
If you're reinstalling then you'll likely overwrite the data. Recovering data in this manner isn't like using an undelete program anyway. The disk's sectors are read many many times, over and over again to recover those faint traces. It's very unlikely you wouldn't notice the activity.

If you're sending it to the recycler I'd definitely take extra precautions though. There was a recent article in news about some of those drives showing up on ebay.
http://www.pcworld.com/article/id,12...1/article.html
 
Old 01-11-2007, 08:09 PM   #8
here2serve
Member
 
Registered: Sep 2005
Location: Hinesville
Distribution: Debian, Mandriva, Ubuntu, Fedora
Posts: 104

Original Poster
Rep: Reputation: 15
Thanks for the replies. I really am not worried about the data recovery aspect. Just if it's possible for any code to run after the format. Most of the time the systems I'm working on are returned to the original owner. When a computer gets donated. I just wipe the drive and through a Linux distro on it and give them to needy families. So I always protect the privacy of the original owners.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
.htaccess vrs <Directory> vous Linux - Software 4 01-06-2007 01:04 PM
source code vrs binary titanium_geek Linux - General 4 12-26-2004 11:01 AM
Intel vrs AMD mobassir Linux - Hardware 65 03-09-2004 01:32 PM
grub vrs lilo titanium_geek General 31 02-17-2004 04:59 PM
mplayer1.0 vrs mplayer .91 shanenin Linux - Software 4 09-24-2003 06:24 AM

LinuxQuestions.org > Forums > Linux Forums > Linux - Security

All times are GMT -5. The time now is 10:00 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Open Source Consulting | Domain Registration