Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How would I go about wiping a specific sector of my hard drive from Windows? I mean the hard drive in use...

Either wipe with zeros or replace with random data. Is there any script or program that can do this reliably on Windows startup? I'm running Windows 7 64-bit and the sector I want to wipe is sector 62. Is Winhex able to?

share|improve this question
    
I've noticed windows is stopping all hex editors i download from modifying the HDD. It's only 512 bytes but so difficult! –  sherpaa Jun 25 '11 at 9:54

1 Answer 1

I wrote one for you:

#include <stdio.h>
#include <limits.h>
#include <wchar.h>
#include <io.h>
#include <tchar.h>
#include <Windows.h>

#define _O_U16TEXT 0x20000

static PVOID DisableWow64FsRedirection()
{
    HMODULE hKernel32 = LoadLibrary(_T("kernel32.dll"));
    __try
    {
        BOOL (WINAPI * pIsWow64Process)(HANDLE, PBOOL) = (BOOL (WINAPI *)(HANDLE, PBOOL))GetProcAddress(hKernel32, "IsWow64Process");
        if (pIsWow64Process != NULL)
        {
            BOOL isWow64;
            if ((*pIsWow64Process)(GetCurrentProcess(), &isWow64) && isWow64)
            {
                PVOID old;
                return ((BOOL (WINAPI*)(PVOID*))GetProcAddress(hKernel32, "Wow64DisableWow64FsRedirection"))(&old) ? old : NULL;
            }
        }
    }
    __finally { FreeLibrary(hKernel32); }
    return NULL;
}

int _tmain(int argc, TCHAR *argv[])
{
    _setmode(_fileno(stdout), _O_U16TEXT);
    DisableWow64FsRedirection();
    if (argc == 1 + 3)
    {
        long long offset, length;
        int a = _stscanf(argv[2], _T("%lld"), &offset);
        int b = _stscanf(argv[3], _T("%lld"), &length);
        if (a == 1 && b == 1)
        {
            HANDLE hFile = CreateFile(argv[1], FILE_READ_ATTRIBUTES | FILE_WRITE_DATA, FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE, NULL, OPEN_EXISTING, FILE_FLAG_RANDOM_ACCESS, NULL);
            if (hFile != NULL && hFile != INVALID_HANDLE_VALUE)
            {
                __try
                {
                    PBYTE pMem = (PBYTE)calloc((size_t)length, sizeof(BYTE));
                    //Assume we had enough memory...
                    __try
                    {
                        DWORD nw;
                        OVERLAPPED ov = {0};
                        ov.Offset = (DWORD)(offset & ULONG_MAX);
                        ov.OffsetHigh = (DWORD)((offset >> (CHAR_BIT * sizeof(ov.Offset))) & ULONG_MAX);
                        if (WriteFile(hFile, pMem, (DWORD)length, &nw, &ov))
                        {
                            SetLastError(ERROR_SUCCESS);
                        }
                        else { _ftprintf(stderr, _T("Error writing data: %d"), GetLastError()); }
                    }
                    __finally
                    {
                        CloseHandle(pMem);
                    }
                }
                __finally { CloseHandle(hFile); }
            }
            else { _ftprintf(stderr, _T("Error opening file: %d"), GetLastError()); }
        }
        else
        {
            SetLastError(ERROR_INVALID_COMMAND_LINE);
            _ftprintf(stderr, _T("Invalid start or length value: %s, %s."), argv[2], argv[3]);
        }
    }
    else
    {
        SetLastError(ERROR_INVALID_COMMAND_LINE);
        _tprintf(_T("Usage:\n  wipe <file> <start> <length>"));
    }
    return GetLastError();
}

and here's the compiled version (base64 encoding; decode here):

TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA4AAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABaiq8kHuvBdx7rwXce68F33eTOdx/rwXfd5J53E+vBdx7rwHc468F33eScdxvrwXfd5KJ3H+vBd93km3cf68F3UmljaB7rwXcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQRQAATAECADafBU4AAAAAAAAAAOAADwELAQcKAAoAAAACAAAAAAAAqRQAAAAQAAAAIAAAAABAAAAQAAAAAgAABAAAAAAAAAAEAAAAAAAAAAAwAAAABAAAAAAAAAMAAAAAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAKwWAAA8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACgSAABAAAAAAAAAAAAAAAAAEAAAhAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAC50ZXh0AAAANgkAAAAQAAAACgAAAAQAAAAAAAAAAAAAAAAAACAAAGAuZGF0YQAAACQAAAAAIAAAAAIAAAAOAAAAAAAAAAAAAAAAAABAAADAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgZAAD2GAAA5hgAANYYAADIGAAAuBgAAKwYAACYGAAAihgAAAAAAAAoGAAAOBgAAEgYAABWGAAAFBgAAHwYAAAIGAAA9hcAAOgXAADgFwAA1hcAAMgXAADAFwAAthcAAJ4XAACWFwAAJBkAAIwXAACCFwAAdhcAAGgYAABsFwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA//////EVQAAFFkAAAAAAAFUAcwBhAGcAZQA6AAoAIAAgAHcAaQBwAGUAIAA8AGYAaQBsAGUAPgAgADwAcwB0AGEAcgB0AD4AIAA8AGwAZQBuAGcAdABoAD4AAAAAAAAASQBuAHYAYQBsAGkAZAAgAHMAdABhAHIAdAAgAG8AcgAgAGwAZQBuAGcAdABoACAAdgBhAGwAdQBlADoAIAAlAHMALAAgACUAcwAuAAAAAABFAHIAcgBvAHIAIABvAHAAZQBuAGkAbgBnACAAZgBpAGwAZQA6ACAAJQBkAAAAAABFAHIAcgBvAHIAIAB3AHIAaQB0AGkAbgBnACAAZABhAHQAYQA6ACAAJQBkAAAAAAAlAGwAbABkAAAAAABXb3c2NERpc2FibGVXb3c2NEZzUmVkaXJlY3Rpb24AAElzV293NjRQcm9jZXNzAABrAGUAcgBuAGUAbAAzADIALgBkAGwAbAAAAAAA/////wAAAAD6EkAAAAAAAP////8AAAAAMBRAAAAAAAAAAAAAJhRAAEgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQgQABwEkAAAQAAAJgWAABqGGgAEkAA6MwDAABo5BFAAP8VFBBAAIlF5INl/ABo1BFAAFCLNQQQQAD/1olF4IXAdEKNRdxQ/xUcEEAAUP9V4IXAdDCDfdwAdCqNRdhQaLQRQAD/deT/1v/Qi/D33hv2I3XYav+NRfBQ6MEDAABZWYvG6wuDTfz/6AgAAAAzwOiOAwAAw/915P8VIBBAAMNqPGgQEkAA6DwDAABoAAACAKFkEEAA/3Aw/xVgEEAAWVnoSv///4N9CAQPhVIBAACLdQyNRdBQu6gRQABT/3YIiz18EEAA/9eJReCNRchQU/92DP/Xg8QYM/9HOX3gD4X0AAAAO8cPhewAAAAz21NoAAAAEGoDU2oHaIIAAAD/dgT/FRAQQACL8Il13DvzD4SkAAAAg/7/D4SbAAAAiV38V/91yP8VcBBAAFlZiUXkiX38iV20M8CNfbirq6uri0XQiUW8i0XUi8jB+R+JRcCNRbRQjUXYUP91yP915Fb/FRgQQACFwHQJU/8VCBBAAOse/xUMEEAAUGh4EUAAoWQQQACDwEBQ/xV0EEAAg8QMiV386AsAAACDTfz/6AwAAADrd/915P8VABBAAMP/ddz/FQAQQADD62H/FQwQQABQaEgRQAChZBBAAIPAQFD/FXQQQACDxAzrQWhnBgAA/xUIEEAA/3YM/3YIaPgQQAChZBBAAIPAQFD/FXQQQACDxBDrF2hnBgAA/xUIEEAAaKgQQAD/FWwQQABZ/xUMEEAA6N8BAADDaihomBBAAOiXAQAAZoE9AABAAE1adSehPABAAI2AAABAAIE4UEUAAHUUD7dIGIH5CwEAAHQhgfkLAgAAdAaDZeQA6yeDuIQAAAAOdvEzyTmI+AAAAOsOg3h0DnbhM8k5iOgAAAAPlcGJTeSDZfwAagH/FTQQQABZgw0YIEAA/4MNHCBAAP//FTAQQACLDRQgQACJCP8VLBBAAIsNECBAAIkIoSgQQACLAKMgIEAA6OwAAACDPQAgQAAAdQxoSBZAAP8VOBBAAFnowAAAAGiQEEAAaIwQQADoqwAAAKEMIEAAiUXcjUXcUP81CCBAAI1F4FCNRdhQjUXUUP8VRBBAAIlFzGiIEEAAaIQQQADodQAAAItF4IsNSBBAAIkB/3Xg/3XY/3XU6DD9//+DxDCL8Il1yIN95AB1B1b/FUwQQAD/FVAQQADrLYtF7IsIiwmJTdBQUegoAAAAWVnDi2Xoi3XQg33kAHUHVv8VWBBAAP8VXBBAAINN/P+LxuheAAAAw/8lVBBAAP8lQBBAAGgAAAMAaAAAAQDoWQAAAFlZwzPAw8xomBZAAGShAAAAAFCLRCQQiWwkEI1sJBAr4FNWV4tF+Ill6FCLRfzHRfz/////iUX4jUXwZKMAAAAAw4tN8GSJDQAAAABZX15byVHD/yV4EEAA/yU8EEAA/yVoEEAAzMwQFwAAAAAAAAAAAACqFwAAKBAAAOgWAAAAAAAAAAAAABYZAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIGQAA9hgAAOYYAADWGAAAyBgAALgYAACsGAAAmBgAAIoYAAAAAAAAKBgAADgYAABIGAAAVhgAABQYAAB8GAAACBgAAPYXAADoFwAA4BcAANYXAADIFwAAwBcAALYXAACeFwAAlhcAACQZAACMFwAAghcAAHYXAABoGAAAbBcAAAAAAAAfA3N3c2NhbmYAuAJmd3ByaW50ZgAAkwJjYWxsb2MAAEgDd3ByaW50ZgBGAV9pb2IAAOoBX3NldG1vZGUAAG1zdmNydC5kbGwAAMwAX2NfZXhpdAD9AF9leGl0AE8AX1hjcHRGaWx0ZXIAzwBfY2V4aXQAAJwCZXhpdAAAqwBfX3dpbml0ZW52AACqAF9fd2dldG1haW5hcmdzAABCAV9pbml0dGVybQCgAF9fc2V0dXNlcm1hdGhlcnIAAL0AX2FkanVzdF9mZGl2AACFAF9fcF9fY29tbW9kZQAAigBfX3BfX2Ztb2RlAACeAF9fc2V0X2FwcF90eXBlAAD0AF9leGNlcHRfaGFuZGxlcjMAAN0AX2NvbnRyb2xmcAAA8ABGcmVlTGlicmFyeQA7AUdldEN1cnJlbnRQcm9jZXNzAIsDV3JpdGVGaWxlAEQCTG9hZExpYnJhcnlXAABSAENyZWF0ZUZpbGVXAGgBR2V0TGFzdEVycm9yAAATA1NldExhc3RFcnJvcgAAlwFHZXRQcm9jQWRkcmVzcwAAMQBDbG9zZUhhbmRsZQBLRVJORUwzMi5kbGwAAG8BX2xvY2FsX3Vud2luZDIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABAAAAQLsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==

You can just run it like:

wipe \\.\PhysicalDrive0 0 512

where the first argument is the file name, the second is the offset, and the third is the number of bytes. The number of bytes probably can't be over ~63 MiB.

Of course, don't blame me if you erase your disk accidentally...

share|improve this answer
    
I tried to manually delete sector 62 in a licensed version of WinHex but it says it cannot modify the drive as it is write protected. Then it asks me to delete the partitions to modify it, but actually there are no partitions on the HDD... –  sherpaa Jun 25 '11 at 9:08
    
Thanks for that Mehrdad! I'm amazed someone can write that so fast. I don't know how to use that code without a bit of spoon feeding :( I assume i have to copy and paste the code into a text document and then run it from the cmd box? I checked and sector 62 begins at offset 31744 and the sectors on my hdd are the standard 512 bytes long. However i'm not sure what name to use for the drive, winhex calls it 'Hard disk 0'. –  sherpaa Jun 25 '11 at 9:16
    
What data does this write to disk? Lack of CryptGenRandom() or equivalent makes me curious. –  grawity Jun 25 '11 at 13:24
    
@sherpaa: The code is just there for reference -- you need a C compiler for it. If you just want to run it, copy/paste the base64 version of the data into a decoder (like the link I provided) and have it convert it to an executable for you. As for the name, use \\.\PhysicalDrive0 like I mentioned. @grawity: It writes zeroes. –  Mehrdad Jun 25 '11 at 17:03

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.