Zerofill before cloning

[KerstinF]

Hi. We reuse our target drives when cloning, trying to match the patient drive regarding size to be sure to overwrite all old sectors at the target. There are times when we can not match the drivesizes. For example if a lower capacity drive (40G) needs cloning and the only target we have at hand is very much larger (500G). For these scenarios we always zerofill the target drive before cloning, it works fine but it is time consuming. Is there any other (better) way to make sure that the target drive does not contain data from previous customers? Sending a previous clients files to the new client would be a disaster. Of course if we are able to successfully clone the entire drives and the fs looks fine with no errors and you can access the old partitions right away at the target drive this is not an issue. But we are not that lucky in most cases because you wouldnt need cloning in the first place for these cases.

For cloning we use Atola insight.

Kerstin

[HDD Spaz]

Wiping is essential. You can make things easier though. http://www.yec-usa.com/products/geisha.html

[BlackST]

You have 2 common solutions : zero fill sector by sector or using INTERNAL security functions.
I think the best solution is to use a drive maybe larger, but not exaggerately large than the source, i.e. a 80/120 GB for a 40.
Internal erase does not take for a common 160 GB more than 20/30 mins. and only requires power supply, filling makes the computer busy and is longer.
I think there are no other possibilities, EXCEPT one : zerofill a known good drive and "clone" it on the patient. This only if the operation, tested, is significantly faster. Otherwise, I don't see any other way :S

[pcimage]

Hi

Why not cut the LBA of the target drive to the size of the patient?

[BlackST]

Hi

Why not cut the LBA of the target drive to the size of the patient?

It's a partial solution : the destination drive should be COMPLETELY FREE from previous data for privacy : if - for any reason - some sectors are skipped from cloning i.e. because of read errors, the destination drive still contain the previous data because the blocks are not overwritten (skipped).
And this is useless, too, because if you have cloned successfully the source disk, the partition boundaries will be copied, too, and this will prevent going beyond them when recovering the files (unless the boundaries are destroyed).
For me, for security reasons and for privacy, data on the destination disk has to be destroyed completely.

[Dmitry Postrigan]

Please see this topic
zero-fill-recomendations-t10132.html

Also, there will be some more options for zero-filling in the upcoming release (this week) - see picture below.

I will look if we can move or copy the security erase functionality into that form as well since it is the most convenient way to zero-fill hard drives.

And, within couple months we will replace the current Insight's imager with the new one that will completely resolve this issue so that you won't have to worry about zero-filling anymore.

[BlackST]

That's why I have included something like that on my custom-made tools , and I use (and suggest) security erase....

[KerstinF]

Thanks!

I guess the best way is as Maysoft suggests. An option to zerofill all sectors at the target drive that has not been involved in the cloning would be a great time saver because you only have to zf parts of the target drive.

[pcimage]

Hi

Why not cut the LBA of the target drive to the size of the patient?

It's a partial solution : the destination drive should be COMPLETELY FREE from previous data for privacy : if - for any reason - some sectors are skipped from cloning i.e. because of read errors, the destination drive still contain the previous data because the blocks are not overwritten (skipped).
And this is useless, too, because if you have cloned successfully the source disk, the partition boundaries will be copied, too, and this will prevent going beyond them when recovering the files (unless the boundaries are destroyed).
For me, for security reasons and for privacy, data on the destination disk has to be destroyed completely.

What I actually meant was cut the LBA, then erase the drive. It would be a hell of a lot quicker to erase a 40Gb (which the drive will think it is) rather than the full 500Gb.

[BlackST]

Yes, maybe. It's worth a try.

[drc]

What I actually meant was cut the LBA, then erase the drive. It would be a hell of a lot quicker to erase a 40Gb (which the drive will think it is) rather than the full 500Gb.

Then you get a moderately tech savvy customer or one whose kid likes to play with MHDD... uncuts the drive, recovers previous customer's data... lawsuit time.

[drc]

Thanks!

I guess the best way is as Maysoft suggests. An option to zerofill all sectors at the target drive that has not been involved in the cloning would be a great time saver because you only have to zf parts of the target drive.

You could always make note of what LBA your image stops at and then use MHDD erase on the rest of the drive.

[pcimage]

What I actually meant was cut the LBA, then erase the drive. It would be a hell of a lot quicker to erase a 40Gb (which the drive will think it is) rather than the full 500Gb.

Then you get a moderately tech savvy customer or one whose kid likes to play with MHDD... uncuts the drive, recovers previous customer's data... lawsuit time.

That's assuming you just give the client the image without checking the data!

Not extract the data,check it and give it to him/her on DVD or another HDD, like any decent pro would.

I think the point being made was not contaminating the data in the (temporary) image with previously existing data.

[drc]

My mistake, I misread the original post and thought the poster was giving the reused target drive straight to the customer.

[Odiferous]

Hi. We reuse our target drives when cloning, trying to match the patient drive regarding size to be sure to overwrite all old sectors at the target. There are times when we can not match the drivesizes. For example if a lower capacity drive (40G) needs cloning and the only target we have at hand is very much larger (500G). For these scenarios we always zerofill the target drive before cloning, it works fine but it is time consuming. Is there any other (better) way to make sure that the target drive does not contain data from previous customers? Sending a previous clients files to the new client would be a disaster. Of course if we are able to successfully clone the entire drives and the fs looks fine with no errors and you can access the old partitions right away at the target drive this is not an issue. But we are not that lucky in most cases because you wouldnt need cloning in the first place for these cases.

For cloning we use Atola insight.

Kerstin

We have dedicated machines that are used almost expressly for the secure deletion of data before using them as target drives.

As far as I'm concerned, you cannot cut corners. Just do it religiously - you cannot afford to even consider the risks involved of returning a clients's data that may incorporate someone else's "adult" material.

This is one area in which we never, ever compromise.

Duncan

[BlackST]

100% agree with Odiferous.... sometimes drives contain porno stuff that you must wear condoms only to handle them... and you can get AIDS by only reading the file names LOL !!!

[HDD Spaz]

100% agree with Odiferous.... sometimes drives contain porno stuff that you must wear condoms only to handle them... and you can get AIDS by only reading the file names LOL !!!

LOL

[pcimage]

Fortunately DeepSpar has a neat feature to erase ALL unused, or non copied sectors. Even the stuff above the LBA cut.

So it's just a matter of running this through the image to be sure. Takes minutes.

[pepe]

I usually fill with a known pattern so I can easily identify any unread areas at any time apart from logs and maps

pepe

[cgallery]

I usually fill with a known pattern so I can easily identify any unread areas at any time apart from logs and maps

pepe

Yep. I use HDAT to wipe drives. By default, it fills drives with the pattern "HDAT" (but you can change it to anything you want).

When I'm done w/ my recovery, I can search files for the contents "HDATHDATHDAT" and find any files that didn't make it.

Fairly quick, and easy.