Verifying a hard dr...
 
Notifications
Clear all

Verifying a hard drive is blank

26 Posts
11 Users
0 Likes
5,239 Views
(@spg93)
Posts: 7
Active Member
Topic starter
 

Hi,

I am currently writing an SOP checking a HDD to ensure that it's wiped and contains all x00. I have been researching checksum 64 and it seems to be the preferred method used by many.

I am just wondering what tools are out there to run a checksum across the HDD, I have looked at HxD but it seems to produce a checksum even if it is prematurely cancelled, I suspect this checksum relates to the data it has managed to process so far. It doesn't seem to produce any error messages and as a result we would prefer not to use it.

I am looking at WinHex which seems to be a good product and I am awaiting a quote from them. Are there any other tools out there that will allow me to run a checksum across a physical disk to ensure it is wiped, free ones for would be great however I suspect there aren't many.

I have seen some Linux solutions but we are hoping to use a Windows solution.

Thanks in advance.

 
Posted : 08/01/2018 6:30 pm
(@mcman)
Posts: 189
Estimable Member
 

Are you looking to make this a manual check or something you can automate?

I know it's a linux option but i always used xxd to check my wiped drives. Fast, relatively quick, and easy to automate with the CLI.

I've seen a few python scripts that could be ported over to work in Windows but never used any of them so I can't speak to their quality.

Jamie

 
Posted : 08/01/2018 6:38 pm
(@spg93)
Posts: 7
Active Member
Topic starter
 

Hi Jamie,

Thanks for your response. We are hoping for it to be an automated process, allowing us to basically wipe the HDD using a Tableau Forensic Duplicator and then verifying it fully blanked the drive by running the checksum.

 
Posted : 08/01/2018 6:59 pm
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

Free version of winhex will do it.
Connect drive. Goto tools open disk.
Once open, use find hex value with !00
If it finds any hits it didn't work
Just by any chance is this for ISO accreditation?

 
Posted : 08/01/2018 7:45 pm
(@spg93)
Posts: 7
Active Member
Topic starter
 

Minime2k9, I am currently using the evaluation copy of WinHex and I just use the checksum feature as it's available in the free version, anything other than 0 means the wiping process failed. I believe the license agreement prevents us from using the free version but I emailed WinHex today to clarify it.

It sure is for ISO!

 
Posted : 08/01/2018 7:49 pm
(@athulin)
Posts: 1156
Noble Member
 

I am currently writing an SOP checking a HDD to ensure that it's wiped and contains all x00. I have been researching checksum 64 and it seems to be the preferred method used by many.

Is that relevant? Does it fulfill your requirements?

While Checksum-64 does return 0 for all zeroes, it also returns 0 for some worst cases of non-zeroes.

Is that OK by you?

 
Posted : 08/01/2018 8:03 pm
(@4144414d)
Posts: 33
Eminent Member
 

I used hd (e.g. hexdump) so it uses a * if the data is the same. Very easy to automate, if there is anything none zero it'll be a bigger output.

e.g. hd /dev/sda will show something like this for a wiped drive


00000000 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
*
fffffffffff

 
Posted : 08/01/2018 8:26 pm
minime2k9
(@minime2k9)
Posts: 481
Honorable Member
 

We managed to remove the requirement to 'validate' wiping disks. If you pm me with your process I'll see if it would work for you.

 
Posted : 08/01/2018 9:28 pm
(@randomaccess)
Posts: 385
Reputable Member
 

While Checksum-64 does return 0 for all zeroes, it also returns 0 for some worst cases of non-zeroes.

What kind of worst case of non-zero situations?

You could probably also perform a quick visual inspection after the checksum64. Also if you get the windows version of xxd you can use the -a flag (i think) to display all the bytes, combining any row of 0's into a *. so a cleared drive should basically give you a row of 0's, a star, and then another row of zeroes

 
Posted : 08/01/2018 9:34 pm
(@spg93)
Posts: 7
Active Member
Topic starter
 

It's interesting to hear that the checksum will not always return 0. I'm interested to hear how, could you explain further?

My understanding was that provided the drive contained all 0's it would return 0, unlike other techniques due to the way it calculates the result.

Thank for the responses everyone I appreciate it. I'll look further into them tomorrow when I return to work.

Minime2k9 I have pm'd you.

 
Posted : 08/01/2018 10:01 pm
Page 1 / 3
Share: