0

I have recently erased and overwritten a 3 TB hard drive using

dd if=/dev/urandom of=/dev/sdb bs=4096

multiple times. The data should be unrecoverable by now.

Unfortunately, tools like Recuva (for Windows) are still able to retrieve file names of files that used to be there. They cannot seem to restore most of them, although some very small text files can be restored.

From what I've read, they probably live in the MFT space. Small files can be in the MFT space completely.

Is there any way for me to access this MFT space and wipe it clean / overwrite it entirely?

I know of tools like Eraser, Bleachbit and CCleaner's "wipe free space" option, but I'm not sure if they do what I need?

Thank you!

Markall
  • 1
  • 1
  • 1
    that command wipes the whole /dev/sdb, so how can anything left on that disk? Even MFT is just a file in the NTFS partition so if the partition is wiped, so is the MFT – phuclv Sep 26 '21 at 08:19
  • @phuclv That's what I don't understand either. The dd command has finished by saying "device has run out of space". I didn't wipe the partition (sdb1) though, but the entire device instead. Maybe there is a hidden part that can not be accessed by /dev/sdb? – Markall Sep 26 '21 at 08:20
  • no. probably recuva loads some cached information. But why use Linux to wipe NTFS? [Use `sdelete` instead](https://superuser.com/a/1185466/241386) – phuclv Sep 26 '21 at 08:23
  • 1
    Could the message "device has run out of space" be misleading? Check the SMART data of the disk to see if it was rather stopped by a disk error. – harrymc Sep 26 '21 at 10:57

0 Answers0