0

I installed Ubuntu on a USB disk, my installation is: 

sudo fdisk -l /dev/sdb 

Disk /dev/sdb: 7773 MB, 7773585408 bytes
240 heads, 62 sectors/track, 1020 cylinders, total 15182784 sectors
Units = sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disk identifier: 0x0006f051

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1   *          62    12289124     6144531+  83  Linux
/dev/sdb2        12290048    15182783     1446368   82  Linux swap / Solaris

I then zeroed blocks reserved 

sudo tune2fs -m 0 /dev/sdb1

I have overwritten empty space in /dev/sdb1

dd if=/dev/urandom of=random.file bs=1024

Then I tried with photorec to recover deleted files "from whole partition" sdb1. Photorec retrives a lot of files, I do not understand where they are saved.

I have noticed that there is unallocated space between partitions, can it be the problem?

Photorec

PhotoRec 6.14, Data Recovery Utility, July 2013
Christophe GRENIER <grenier@cgsecurity.org>
http://www.cgsecurity.org

Disk /dev/sdb - 7773 MB / 7413 MiB (RO) - Sony Storage Media

     Partition                  Start        End    Size in sectors
      No partition             0   0  1  1020  83 38   15182784 [Whole disk]
> 1 * Linux                    0   1  1   825 211 43   12289063
  2 P Linux Swap             825 226 37  1020  83 38    2892736
Improve this question
3
  • So you want to be 100% sure that all those files are unrecoverably gone, or do you need to recover some of these files? From what we can see you wiped unused drive space but your files were still located in a space appearing to be used in the filesystem. – Takkat Oct 29 '14 at 15:30
  • I think we have a winner.... photorec doesn't find only deleted files... it finds anything on the disk that looks like a file without regard to whether it has been deleted or not. – psusi Oct 29 '14 at 17:37
  • I need those files are unrecoverably gone. I think they are files created from OS as temp files and then deleted, so it is possible they are in some space where I can't write to wipe them. How can I solve the problem? – horta Oct 30 '14 at 8:33
0

Yes, that looks strange; I see two things that could have went wrong:

You did not give your actual dd command. Did you get error messages from it? I'm not sure the dd command finished overwriting the whole partition with random data.

Assuming it did finish, I would think you made a typo and were running photorec on the whold disk, /dev/sdb , instead of the partition, /dev/sdb1. Or you worked on the swap partition, /dev/sdb2.

In both cases, photorec would have scanned the swap partition (as part of the whole disk, or separately). That partition contains data that was in main memory RAM at some time. The RAM could contain some or all blocks of files for a lot of reasonst - so it would be not surprising when these end up in the swap partition.

Improve this answer
1
  • dd doesn't get any error and I run photorec only on sdb1. As said in previous comment I notice that recovered files are file created from OS as temp files and then deleted, so it is possible they are in same protected disk area, but I need to make them impossible to recover. – horta Oct 30 '14 at 8:36
0

The only measure to securely remove all traces, remnants, and fragments of files in our hard drive is to backup those files we want to keep to another drive (not partition).

We can then completely overwrite the whole drive with Zeros (much faster) or random numbers, repartition it, and reformat that drive. After that any recovery will be impossible.

Finally we may restore our backup files.

Note that by doing so the UUID of the drive may change and the Master Boot Record will also be lost. Therefore we may have to edit references to that drive accordingly and we will also have to restore the MBR.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.