3,852 reputation
812
bio website schollnick.net/wordpress
location Rochester, NY
age 43
visits member for 5 years, 4 months
seen Dec 17 at 1:45
I am a Level 3 Desktop Support Specialist for a major University in the Area... But as I hobby, I try to help people here, and at my Blog... http://www.schollnick.net/wordpress

Oct
17
comment Is it possible to detect the previous byte position on a hard drive after it has been overwritten?
@supercat, We could debate this forever going back over minuta. Instead I recommend Checking out Security Now podcast #419, where Steve Gibson discusses this issue in regards to Wear Leveling (specifically over SSDs). The point made is if the drive is whole disk encrypted before the wear leveling occurs, then the remapped sectors are still encrypted, and thus when the encryption key is "wiped" / erased, etc, the sectors are unrecoverable. Security Now Podcast 284 (grc.com/sn/sn-284.txt) also covers a bit of this too.
Oct
17
comment Is it possible to detect the previous byte position on a hard drive after it has been overwritten?
@JamieHanrahan, you are correct. I should of said, that you wipe it by destroying the key. I did not elaborate as well as I should have.
Oct
16
comment Is it possible to detect the previous byte position on a hard drive after it has been overwritten?
The only real answer to this would be to full drive encrypt the hard drive before it was used (or right after the Base OS install), allowing it to be encrypted completely. And then when you want to wipe the system, repartition / overwrite the drive. If the entire drive is encrypted, then even any mapped out sectors would be encrypted, and when the drive was wiped, and the encryption key unavailable, then the raw drive data is useless due to the fact that it had been encrypted.
Oct
16
comment Is it possible to detect the previous byte position on a hard drive after it has been overwritten?
Whereas if the drive electronics marked the sector bad, and remapped in a replacement sector, Chkdsk /r or /f shouldn't be able to read the mapped out sector. So I would believe that non-trivial to attempt to recover data from a mapped out sector.
Oct
16
comment Is it possible to detect the previous byte position on a hard drive after it has been overwritten?
@supercat We may need to agree to disagree here. I <b>agree with your core argument</b>. Where we seem to disagree is that your stating that a bad sector maybe easily readable. My argument is that sector was flagged as bad, thus it will be hard to read. 1) Since it is flagged as bad, then you will need specialized software or hardware to read it. I am referring to the drive setting the block bad, and not the OS. If the OS flagged it, then it could very well be a slow sector (and not a bad sector).
Oct
16
comment Is it possible to detect the previous byte position on a hard drive after it has been overwritten?
@supercat True. In that case, only a TRUE low level format of the drive could possibly resolve that, and most IDE / SATA drives will ignore a low level format request, unless you use the manufacturers software. On the other hand, that sector was swapped out for a reason. Recovering data from it may take some service along the lines of Drivesavers (or a specialized software like spinrite).
Oct
16
comment OS X - Mount .dmg image into a virtual DVD drive without Toast Titanium
Sorry, I accidentally saved the previous.<br>Actually, I use disk images all the time to replace DVD / CD disks. The issue is that a mounted image can be detected due to the "protocol type". Device Identifier: disk5 Device Node: /dev/disk5 Content (IOContent): Apple_partition_scheme OS Can Be Installed: No Media Type: Generic Protocol: Disk Image So if a program wants to, it can check to see if a disk is a disk image. Sensible for a copy protection scheme, but otherwise, generally unneeded. disk info <vol> shows this.
Oct
16
comment OS X - Mount .dmg image into a virtual DVD drive without Toast Titanium
Actually, I use disk images all the time to replace DVD / CD disks.
Oct
16
comment Is it possible to detect the previous byte position on a hard drive after it has been overwritten?
@supercat, you are technically correct. In fact, that is partially the technical basis for Spinrite (grc.com). But in modern drives, I very much doubt this is very probable. Once again, if your worried, then perform a 7 pass overwrite, with each pass the drive will be at a different temperature (due to the length of time running), and help prevent this thermal scenario you describe.
Oct
4
comment Move an off-screen window back on-screen on Mac OS X
This may or may not work. I found Wireshark (an X Windows app), would be off the display when a 2nd display was connected. This was actually an XQuartz bug (acknowledged). It's unclear if this is an Apple bug, or an XQuartz bug. See xquartz.macosforge.org/trac/ticket/797.
Aug
18
awarded  Yearling
Apr
20
awarded  Nice Answer
Aug
18
awarded  Yearling
Jun
16
awarded  Enlightened
Jun
16
awarded  Nice Answer
Feb
25
comment Is there a way to access OS X location services from the command line?
I really haven't messed with it at this time. While being neat, I was really looking for a Find My iPhone type of code for portables.
Sep
8
answered Pros and cons about installing appllications on a different drive than the OS
Sep
4
comment Can a Windows PC do anything while it is sleeping?
Not really. The requirements are for a SSD drive, which helps reduce the amount of power used. But that's not special hardware, those laptops came with SSDs.
Sep
4
answered How Many times can we low level format a disk drive without damaging it?
Aug
18
awarded  Yearling