Experiment 4: partition deletion

A more extreme form of data wiping involves deleting a partition. The default method in most OSs simply creates the new partition header without cleaning out data in the original partition, even if changing the partition type. This can usually be overridden for a destructive format.

Method

Create a new Ext4 partition by using the Linux mkfs command:

nate@huygens:~$ mkfs.ext4 /dev/sdb1 mke2fs 1.41.11 (14-Mar-2010) Filesystem label= OS type: Linux [Output trimmed for brevity] Writing inode tables: done Creating journal (8192 blocks): done Writing superblocks and filesystem accounting information: done

This command does wipe the partition. Confirm this by viewing the new partition with a hex editor. Then create a file as in earlier examples, save, and close it. Search for the file's text with the hex editor, then non-destructively-format the partition (by using the -Q option) to NTFS using mkntfs:

nate@huygens:~$mkntfs -Q /dev/sdb1 Cluster size has been automatically set to 4096 bytes. Creating NTFS volume structures. mkntfs completed successfully. Have a nice day.

Confirm via the hex editor that the file contents still exist. Now recreate an NTFS partition, this time wiping the data:

nate@huygens:~$mkntfs /dev/sdb1 Cluster size has been automatically set to 4096 bytes. Initializing device with zeroes: 100% - Done. Creating NTFS volume structures. mkntfs completed successfully. Have a nice day.

As can be seen in the output, mkntfs has overwritten the partition with zeros. Double-check this with the hex editor again.

Results

 

Fig. 4.1: Seeking the file after a "quick" format (left), and after a destructive format.

Although the file is inaccessible through the usual way after a quick format, the data within the file remains. A destructive format, however, does obliterate the data, as seen in Fig. 4.1.