±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35636
New Yesterday: 3 Visitors: 151

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Webinars

Verifying a hard drive is blank

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
Page 1, 2, 3, 4  Next 
  

spg93
Newbie
 

Verifying a hard drive is blank

Post Posted: Jan 08, 18 19:30

Hi,

I am currently writing an SOP checking a HDD to ensure that it's wiped and contains all x00. I have been researching checksum 64 and it seems to be the preferred method used by many.

I am just wondering what tools are out there to run a checksum across the HDD, I have looked at HxD but it seems to produce a checksum even if it is prematurely cancelled, I suspect this checksum relates to the data it has managed to process so far. It doesn't seem to produce any error messages and as a result we would prefer not to use it.

I am looking at WinHex which seems to be a good product and I am awaiting a quote from them. Are there any other tools out there that will allow me to run a checksum across a physical disk to ensure it is wiped, free ones for would be great however I suspect there aren't many.

I have seen some Linux solutions but we are hoping to use a Windows solution.

Thanks in advance.  
 
  

mcman
Senior Member
 

Re: Verifying a hard drive is blank

Post Posted: Jan 08, 18 19:38

Are you looking to make this a manual check or something you can automate?

I know it's a linux option but i always used xxd to check my wiped drives. Fast, relatively quick, and easy to automate with the CLI.

I've seen a few python scripts that could be ported over to work in Windows but never used any of them so I can't speak to their quality.

Jamie  
 
  

spg93
Newbie
 

Re: Verifying a hard drive is blank

Post Posted: Jan 08, 18 19:59

Hi Jamie,

Thanks for your response. We are hoping for it to be an automated process, allowing us to basically wipe the HDD using a Tableau Forensic Duplicator and then verifying it fully blanked the drive by running the checksum.  
 
  

minime2k9
Senior Member
 

Re: Verifying a hard drive is blank

Post Posted: Jan 08, 18 20:45

Free version of winhex will do it.
Connect drive. Goto tools open disk.
Once open, use find hex value with !00
If it finds any hits it didn't work
Just by any chance is this for ISO accreditation?  
 
  

spg93
Newbie
 

Re: Verifying a hard drive is blank

Post Posted: Jan 08, 18 20:49

Minime2k9, I am currently using the evaluation copy of WinHex and I just use the checksum feature as it's available in the free version, anything other than 0 means the wiping process failed. I believe the license agreement prevents us from using the free version but I emailed WinHex today to clarify it.

It sure is for ISO!  
 
  

athulin
Senior Member
 

Re: Verifying a hard drive is blank

Post Posted: Jan 08, 18 21:03

- spg93
I am currently writing an SOP checking a HDD to ensure that it's wiped and contains all x00. I have been researching checksum 64 and it seems to be the preferred method used by many.


Is that relevant? Does it fulfill your requirements?

While Checksum-64 does return 0 for all zeroes, it also returns 0 for some worst cases of non-zeroes.

Is that OK by you?  
 
  

4144414D
Member
 

Re: Verifying a hard drive is blank

Post Posted: Jan 08, 18 21:26

I used hd (e.g. hexdump) so it uses a * if the data is the same. Very easy to automate, if there is anything none zero it'll be a bigger output.

e.g. hd /dev/sda will show something like this for a wiped drive

Code:
00000000  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  |................|
*
fffffffffff
 
 

Page 1 of 4
Page 1, 2, 3, 4  Next