I had a case settle recently and needed to wipe some scratch disks with oem partitions. In the process of trying to use DISKPART to remove partitions I came across CLEAN. It states it will zero every sector on the disk..
From technet:
DiskPart Command-Line Options
"Removes any and all partition or volume formatting from the disk with focus. On master boot record (MBR) disks, only the MBR partitioning information and hidden sector information are overwritten. On GUID partition table (GPT) disks, the GPT partitioning information, including the Protective MBR, is overwritten; there is no hidden sector information. - all - Specifies that each and every sector on the disk is zeroed, which completely deletes all data contained on the disk."
Has anyone else used this feature for disk wiping? If so does DISKPART leave anything behind on the system being used for wiping such as prefetch or user assist that could be forensically useful?
Wednesday, May 16, 2012
Subscribe to:
Posts (Atom)