PaulDotCom mailing list archives

Odd formatting results


From: irongeek at irongeek.com (Adrian Crenshaw)
Date: Sat, 8 Aug 2009 22:27:06 -0400

The media is a 1gb SD card, I've tried different file formats on both XP and
Vista. XP seems to leave the data in all cases, Vista zeroes it in all
cases.

Adrian

On Sat, Aug 8, 2009 at 10:19 PM, Joel Folkerts <joel.folkerts at gmail.com>wrote:

What is the file system? NTFS, FAT16, FAT32? What size is the partition?

-Joel


"The path to hell is paved with good intentions."


On Sat, Aug 8, 2009 at 8:56 PM, Adrian Crenshaw <irongeek at irongeek.com>wrote:

Ok, a few years ago I tested out formatting an SD card from XP, and showed
how you could file carve the data back off of it because it did not zero the
bytes.

http://www.irongeek.com/i.php?page=videos/data-carving-with-photorec-to-retrieve-deleted-files-from-formatted-drives-for-forensics-and-disaster-recovery

I'm testing right now in Vista, and doing a normal format seems to zero
out the bytes (besides the part that involves the file system format). Did
the change the way things work in Vista? The format seems to go too fast to
be overwriting everything. I'm using WinHex by the way to verify.


Thanks,
Adrian

_______________________________________________
Pauldotcom mailing list
Pauldotcom at mail.pauldotcom.com
http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
Main Web Site: http://pauldotcom.com



_______________________________________________
Pauldotcom mailing list
Pauldotcom at mail.pauldotcom.com
http://mail.pauldotcom.com/cgi-bin/mailman/listinfo/pauldotcom
Main Web Site: http://pauldotcom.com

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://mail.pauldotcom.com/pipermail/pauldotcom/attachments/20090808/420383c5/attachment.htm 


Current thread: