Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm doing a thesis about forensic analysis and I'd like to format a disk with an ext4 file system without zeroing it, to analyze the possibility to recover deleted files. This is a problem, because mkfs.ext4 doesn't have a parameter to avoid the zeroing and if I use the standard behavior everything inside the disk is set to zero. Anyone knows how it's possible to format the disk without zeroing all sectors? Thanks in advance for your help.

share|improve this question
    
Wouldn't that invalidate your thesis? If a normal ext4 format zeroes the disk, you should report that no file recovery is possible. If you are the only person on the planet who performs some special non-zeroing format then your conclusions do not apply in the real world. Is your thesis about deletion or formatting? they are different! –  RedGrittyBrick Apr 18 '12 at 9:03
2  
I doubt that any of the mkfs tools will wipe a disk to zero, including mkfs.ext4. What would be the point? –  Paul Apr 18 '12 at 9:13
1  
You need to pass the -cc option to mkfs.ext4 for it to do any complete overwriting of the disk. Then it does 4 different overwrites with different patterns (1010, 0101, 1111 and 0000). For a reasonably sized disk, that takes several hours. It might do trim on ssds, though, which is superficially like zeroing. You can avoid that by not using a ssd, or using one that does not implement trim. –  Eroen Apr 18 '12 at 11:05

1 Answer 1

I agree with Paul, I don't think there's a zero wipe during the format process. I occasionally need to zero drives prior to imaging with dd to minimize image size and the process is quite slow.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.