I'm doing a thesis about forensic analysis and I'd like to format a disk with an ext4 file system without zeroing it, to analyze the possibility to recover deleted files. This is a problem, because mkfs.ext4 doesn't have a parameter to avoid the zeroing and if I use the standard behavior everything inside the disk is set to zero. Anyone knows how it's possible to format the disk without zeroing all sectors? Thanks in advance for your help.
1 Answer
I agree with Paul, I don't think there's a zero wipe during the format process. I occasionally need to zero drives prior to imaging with dd to minimize image size and the process is quite slow.
-cc
option to mkfs.ext4 for it to do any complete overwriting of the disk. Then it does 4 different overwrites with different patterns (1010, 0101, 1111 and 0000). For a reasonably sized disk, that takes several hours. It might do trim on ssds, though, which is superficially like zeroing. You can avoid that by not using a ssd, or using one that does not implement trim.