0

I'm doing a thesis about forensic analysis and I'd like to format a disk with an ext4 file system without zeroing it, to analyze the possibility to recover deleted files. This is a problem, because mkfs.ext4 doesn't have a parameter to avoid the zeroing and if I use the standard behavior everything inside the disk is set to zero. Anyone knows how it's possible to format the disk without zeroing all sectors? Thanks in advance for your help.

3
  • Wouldn't that invalidate your thesis? If a normal ext4 format zeroes the disk, you should report that no file recovery is possible. If you are the only person on the planet who performs some special non-zeroing format then your conclusions do not apply in the real world. Is your thesis about deletion or formatting? they are different! Apr 18, 2012 at 9:03
  • 2
    I doubt that any of the mkfs tools will wipe a disk to zero, including mkfs.ext4. What would be the point?
    – Paul
    Apr 18, 2012 at 9:13
  • 1
    You need to pass the -cc option to mkfs.ext4 for it to do any complete overwriting of the disk. Then it does 4 different overwrites with different patterns (1010, 0101, 1111 and 0000). For a reasonably sized disk, that takes several hours. It might do trim on ssds, though, which is superficially like zeroing. You can avoid that by not using a ssd, or using one that does not implement trim.
    – Eroen
    Apr 18, 2012 at 11:05

1 Answer 1

2

I agree with Paul, I don't think there's a zero wipe during the format process. I occasionally need to zero drives prior to imaging with dd to minimize image size and the process is quite slow.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .