2

Recently my HDD was encrypted by a ransomware attack (I have no idea which encryption method has been used) and as a result I cannot access the contents of my HDD (see how Disk 1 seems in the first screenshot).
Now I need to completely format it to be able to use it again, however, when I try to format this disk via Disk Management tool on Windows, I cannot do it because of this and get an error.

Is there any way to wipe my HDD on Windows?
If not, what are the other options?

The following are the screenshots to give more information about my problem:

enter image description here enter image description here enter image description here enter image description here

  • What error? Also, you'll need to delete the partitions on the disk before you can format it, likely. – music2myear Jan 13 at 6:32
  • @music2myear I'll post it ASAP. Now I have no access to my computer. – yildizabdullah Jan 13 at 6:33
  • Is it the system partition that you're trying to format? You can't do it when Windows is running because it involves wiping Windows too. You'd have to reinstall afterwards. – gronostaj Jan 13 at 7:34
  • @gronostaj No, I've attached the disk from a docking station as an external disk. – yildizabdullah Jan 13 at 7:51
  • Perhaps you can succeed in formatting the disk using a partition software like EaseUs or Aomei – spike_66 Jan 13 at 10:30
1

If you still have access to cmd, you can still use the format command.

C:\>format /?
Formats a disk for use with Windows.

FORMAT volume [/FS:file-system] [/V:label] [/Q] [/L[:state]] [/A:size] [/C] [/I:state] [/X] [/P:passes] [/S:state]
FORMAT volume [/V:label] [/Q] [/F:size] [/P:passes]
FORMAT volume [/V:label] [/Q] [/T:tracks /N:sectors] [/P:passes]
FORMAT volume [/V:label] [/Q] [/P:passes]
FORMAT volume [/Q]

  volume          Specifies the drive letter (followed by a colon),
                  mount point, or volume name.
  /FS:filesystem  Specifies the type of the file system (FAT, FAT32, exFAT,
                  NTFS, UDF, ReFS).
  /V:label        Specifies the volume label.
  /Q              Performs a quick format. Note that this switch overrides /P.
  /C              NTFS only: Files created on the new volume will be compressed
                  by default.
  /X              Forces the volume to dismount first if necessary.  All opened
                  handles to the volume would no longer be valid.
  /R:revision     UDF only: Forces the format to a specific UDF version
                  (1.02, 1.50, 2.00, 2.01, 2.50).  The default
                  revision is 2.01.
  /D              UDF 2.50 only: Metadata will be duplicated.
  /L[:state]      NTFS Only: Overrides the default size of file record.
                  By default, a non-tiered volume will be formatted with small
                  size file records and a tiered volume will be formatted with
                  large size file records.  /L and /L:enable forces format to
                  use large size file records and /L:disable forces format to
                  use small size file records.
  /A:size         Overrides the default allocation unit size. Default settings
                  are strongly recommended for general use.
                  ReFS supports 4096, 64K.
                  NTFS supports 512, 1024, 2048, 4096, 8192, 16K, 32K, 64K,
                  128K, 256K, 512K, 1M, 2M.
                  FAT supports 512, 1024, 2048, 4096, 8192, 16K, 32K, 64K,
                  (128K, 256K for sector size > 512 bytes).
                  FAT32 supports 512, 1024, 2048, 4096, 8192, 16K, 32K, 64K,
                  (128K, 256K for sector size > 512 bytes).
                  exFAT supports 512, 1024, 2048, 4096, 8192, 16K, 32K, 64K,
                  128K, 256K, 512K, 1M, 2M, 4M, 8M, 16M, 32M.

                  Note that the FAT and FAT32 files systems impose the
                  following restrictions on the number of clusters on a volume:

                  FAT: Number of clusters <= 65526
                  FAT32: 65526 < Number of clusters < 4177918

                  Format will immediately stop processing if it decides that
                  the above requirements cannot be met using the specified
                  cluster size.

                  NTFS compression is not supported for allocation unit sizes
                  above 4096.

  /F:size         Specifies the size of the floppy disk to format (1.44)
  /T:tracks       Specifies the number of tracks per disk side.
  /N:sectors      Specifies the number of sectors per track.
  /P:count        Zero every sector on the volume.  After that, the volume
                  will be overwritten "count" times using a different
                  random number each time.  If "count" is zero, no additional
                  overwrites are made after zeroing every sector.  This switch
                  is ignored when /Q is specified.
  /S:state        Specifies support for short filenames (enable, disable)
                  Short names are disabled by default
  /TXF:state      Specifies txf is enabled/disabled (enabled, disabled)
                  TxF is enabled by default
  /I:state        ReFS only: Specifies whether integrity should be enabled on
                  the new volume. "state" is either "enable" or "disable"
                  Integrity is enabled on storage that supports data redundancy
                  by default.
  /DAX[:state]    NTFS Only: Enable direct access storage (DAX) mode for this
                  volume.  In DAX mode, the volume is accessed via the memory
                  bus, boosting IO performance.  A volume can be formatted
                  with DAX mode only if the hardware is DAX capable.
                  State can specify "enable" or "disable".  /DAX is considered
                  as /DAX:enable.
  /LogSize[:size] NTFS Only: Specifies the size for NTFS log file in kilobytes.
                  The minimum supported size is 2MB, so specifying size smaller
                  than 2MB will result in a 2MB log file.  Zero indicates the
                  default value which generally depend on the volume size.
  /NoRepairLogs   NTFS Only: Disables NTFS repair logs.  If the flag is set
                  spotfix (i.e. chkdsk /spotfix) will not work.

Some examples might help :

format C: - Formats the C:\ drive

format A: /FS FAT-32 - Specifies the disk uses FAT-32, and formats it.

Hope this helps :)

UPDATE :

You can use 3rd party software : https://www.online-tech-tips.com/software-reviews/5-hard-drive-formatting-and-partitioning-utilities/

  • The problem is that there is no such drive like C or something else and I cannot create either MBR or GPT on the device. – yildizabdullah Jan 13 at 14:29
  • @Ramhound The disk I want to format is Disk 1 and I cannot access it. – yildizabdullah Jan 14 at 5:16
  • @Ramhound Disk 1 is not in use by Windows. – yildizabdullah Jan 14 at 8:34
  • @Ramhound Why do you have a habit of deleting comments that you made? It makes conversations ridiculously hard to follow and virtually impossible to advise users on what steps to take if you don't know what they've already been advised to do. If you're not willing to stand by the comments you post then simply don't post them. Posting them and deleting them a few hours later is childish. – Hashim Jan 14 at 22:09
  • @yildizabdullah Sorry if this has already been asked or answered above, but what specific error message do you get when using the format command to wipe the disk? – Hashim Jan 14 at 22:13
0

Use diskpart, it is working on a lower level than Disk Management. To do this, open a Command Prompt window with admin rights and issue the following commands in order:

to start diskpart

diskpart

list the disks installed in your computer

list disk

select the disk you want do edit where n = the number of the disk displayed with the previous command

select disk n

to clean the partition table

clean

create a new partition, if you want to create multiple partition, add size=n where n is set in MB

create partition primary size=n

*format the newly created partition with a partition format, in this example i have used NTFS, you could also use the option quick (i do not recommend it in this situation) *

format fs=ntfs quick

  • I've updated my question. Could you please take a look at the last screenshot? Thanks. – yildizabdullah Jan 15 at 5:21
  • After clean, you could try a rescan and select the disk again after that. And create the partition without the size parameter. – Darius Mihut Jan 15 at 8:40
  • It also didn't work. – yildizabdullah Jan 15 at 9:32
  • You could try a 3rd party software like aomei partition assistant (it has also a freeware version) like spike_66 and BrickMan suggested. – Darius Mihut Jan 15 at 10:39
0

EDITED 1/15/2019 5:30AM:
You really want it back not to format, I would imagine, there is TESTDISK

TestDisk is a free and open-source data recovery utility. It is primarily designed to help recover lost data storage partitions and/or make non-booting disks bootable again when these symptoms are caused by faulty software, certain types of viruses or human error. TestDisk can be used to collect detailed information about a corrupted drive, which can then be sent to a technician for further analysis.
Wiki Page with Download Link https://www.cgsecurity.org/wiki/TestDisk


Try to disinfect your computer using Kaspersky Rescue Disk 18 burn it to a fresh USB drive it must have at least 1 Gigabyte of space.

You can write the image of Kaspersky Rescue Disk to a USB drive or CD/DVD.


How to create a bootable USB drive for Kaspersky Rescue Disk
A USB drive must have more than 1 GB of available space.
If your operating system is:
   Windows. Use a tool for creating bootable drives to write an image in the ISO mode or DD mode.
      E.g. Rufus or Win32 Disk Imager.

   We recommend writing the image in the ISO mode.

   Linux or macOS. Use the default dd tool.



Here is the source page to download https://support.kaspersky.com/14226#block1
Please visit the page link above, (Updated page Nov. 28, 2019) it has all the instructions, with photos.

Here is a direct download https://rescuedisk.s.kaspersky-labs.com/updatable/2018/krd.iso

  • Thanks. I'll checkout it. – yildizabdullah Jan 14 at 14:18
  • Can second KRD for viruses, have used it several times, but can't see how it would help to wipe a disk. Based purely on the information that you've given so far, I would recommend the diskpart solution given by Darius. – Hashim Jan 14 at 22:14
  • I tried to use it and also GParted and fdisk but they do not see my HDD anyway. – yildizabdullah Jan 15 at 7:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.