COLLECTED hard drive usage after XP NTFS

SYNOPSIS:

This is a collected discussion concerning XP hard drive re-use, in which I
have personally participated, per [there may be others which I have missed]:

" IBM T22 and Win 98se";
" New post, ms Everest report";
" Hangs on POST screen";
" win 98 installation"
" Updates for Win9X's & reason/logic"
" No hard drive?"
" Unable to install Win98 SE"
" PC100 v PC133 ram"

GENERAL REFERENCE and SEARCH TERMS: XP NTFS hard drives, tools used to test
and/or recover hard drives, NTFS recovery tools, forensic tools for analysis
of hard drives, securely deleting hard drives, removing XP NTFS from hard
drives.

Present participants in this technical discussion:
Ron Badour, MS MVP for W98;
Jeff Richards MS MVP (Windows - Shell/User);
Gary S. Terhune MS MVP Shell/User
PCR;
Franc Zabkar;
and myself - Maurice Edward, Brahier;
others who may wish to participate.

BACKGROUND:
I have presented apparent issues with the re-use of former XP NTFS hard
drives for other use or re-use. Tools and techniques normally used for
fdisking and formatting, wiping and other activities, apparently do not
completely remove XP NTFS from hard drives.

Disks used for testing:
Samsung (no longer an issue as it is toast, completely un-accessible)
Maxtor 87000AB - Hard Disk Family DiamondMax 1750A (per Everest)
originally used for XP NTFS testing purposes (the OS), fully configured,
idled as a firewall only. After Samsung loss, normal "old" removal
techniques used to re-use the drive as 32bit, then additional testing.

Per early test (WinHex) on the Maxtor:
Hard disk 1
Total capacity: 7,003,586,560 bytes = 6.5 GB
Number of cylinders: 851
Number of heads: 255
Sectors per track: 63
Bytes per sector: 512
Sector count: 13,678,880
Surplus sectors at end: 7,565
Partition 1
Sectors 63 - 13,655,249
Partition table: Sector 0
File system: FAT32
Total capacity: 6,991,455,744 bytes = 6.5 GB
Sector count: 13,655,187
Usable sectors: 13,628,528
First data sector: 26,652
Bytes per sector: 512
Bytes per cluster: 4,096
Free clusters: 1,537,767 !FSInfo mismatch! = 90% free
Total clusters: 1,703,566
Unused inter-partition space:
Sectors 1 - 62 (31.0 KB)
Sectors 13,655,250 - 13,678,879 (11.5 MB) = 11.6 MB

A recent test shows:
Hard disk 1

Total capacity: 7,003,586,560 bytes = 6.5 GB

Number of cylinders: 851
Number of heads: 255
Sectors per track: 63
Bytes per sector: 512
Sector count: 13,678,880
Surplus sectors at end: 7,565

Partition 1
Sectors 63 - 13,639,184
Partition table: Sector 0
File system: ?
Total capacity: 6,983,230,464 bytes = 6.5 GB
Sector count: 13,639,122
Bytes per sector: 512

Unused inter-partition space:
Sectors 1 - 62 (31.0 KB)
Sectors 13,639,185 - 13,678,879 (19.4 MB)
= 19.4 MB

Using GetBack Data for NTFS (an excerpt)
|TREE INFO|
Tree statistic: 395 directories, 579 files, 831 KB
can still be attempted at recovery (and yes, many CAN be viewed, except for
the encrypted/compressed files)

[Don't bother pointing out the errors shown above, this discussion wouldn't
be continuing if there were no errors.]

Tools tested so far:

hd-util [Samsung];
SH-diag [Samsung];
Sutil [Samsung];
Meandisk;
DBan;
Wipe;
Zap;
HDAT2;
AEFDISK;
GDISK (Symantec);
Killdisk;
BootitNG;
MBRWork;
PowerMax [Maxtor];
Maxtor MaxBlast;
Super FDisk;
MHDD;
OnTrack Data Advisor;
Seagate SeaTools;
Eraser;
Testdisk;
WinHex.
(may already have used several others)

Microsoft tools used:
CHKDISK (and its autochkdsk - XP versions);
Recovery Console;
Delpart;
fdisk;
format;

ISSUES:

There are hundreds (thousands) of web pages which appear to claim XP NTFS
is capable of being removed via old techniques and tools.
My testing (to date) shows this in not true. Several hundred megabytes of
hard drive space (on these small hard drives, who knows how much on larger
drives) still contain files and folders from an XP NTFS installation after
its removal.
My personal testing shows that initially, and in particular after
continually trying to remove the XP NTFS, the disk will be reduced in size.
The Maxtor (a 7 gig) now has 5.6 gigabytes of usable space available. Each
attempt to remove XP has added some amount to the original total of unusable
space (less some sensitive data manually removed via disk editor (so I don't
inadvertently place it on the eventual web pages)).

MBR has been replaced several times, drive has been "hardware" reset, and
dozens of other like activities have been tried unsuccessfully. This has
been verified NTFS recovery tools for DOS, Windows and Linux; and disk
editors/viewers of varying quality and ability.

These hidden/restricted areas are ignored or marked as bad sectors by most
tools. These areas may cause potential severe errors to occur when disk
scanning software is used on the disk, depending on its abilities and/or
configuration.

PRESENT ACTIVITIES IN THREADS WITH REPLY FROM MEB:

IBM T22 and Win 98se
"Franc Zabkar" wrote in message
...
| On Mon, 25 Sep 2006 16:56:13 -0400, "MEB" meb@not
| put finger to keyboard and composed:
|
| I'm sorry Ron, the only thing I can presently direct you too, are the
tools
| which will expose that they don't.
| If you wish me to re-post them here I will. They're NTFS recovery tools
| (DOS and Linux), and forensic tools.
|
| Are these the kinds of tools you are referring to?
| http://www.hdat2.com/
| http://vidstrom.net/stools/taft/

First yes, second will look at it.

|
| Regretfully, I'm on my second hard drive during my testing (first, a
| Samsung which is no longer accessible after using several techniques and
| tools, the bios no longer recognizes it)
|
| What did you do? AFAIK, even a "low level format" cannot harm a modern
| drive because the drive ignores the command.
|
| See http://www.ariolic.com/activesmart/l...el-format.html

I'll check this info.

|
| Other than that, meddling with the HPA would, AFAICS, only render a
| portion of the drive inaccessible, unless you set a password which you
| subsequently forgot, or unless you deliberately chose to make the
| whole drive invisible. In any case, I would expect that either of the
| above utilities should be able to remove any capacity "clipping".
|
| Otherwise here is Samsung's own Hutil utility:
| http://www.samsung.com/Products/Hard...ties/hutil.htm

Been there done that, didn't get the t-shirt.

|
| "If you want to recover to the original size of drive, perform RECOVER
| NATIVE SIZE by pressing Enter Key. DISPLAY CURRENT STATUS represents
| the current size of drive. If you set 32GB Clip due to capacity
| limitation of system, remove the 32GB clip to adjust the LBA or SIZE."
|
| Of course if your BIOS can no longer see the HD, then your options may
| be limited ...

There are no more options for the Samsung, its toast.

|
| ... a Maxtor, which is presently also
| on the verge of loss unless I can find the proper info soon, which I'm
| having difficulty locating. That would be information on what exactly XP
| changes in its use of HPA and other changes to the hard drive.
|
| I found these links informative:
|
http://polya.computing.dcu.ie/wiki/i..._why_bother%3F
|
http://polya.computing.dcu.ie/wiki/i...s_on_Harddisks
| http://www.win.tue.nl/~aeb/linux/Large-Disk-11.html

Will check these links also.
Maxtor tools will not work (or at least what is publicly available).

|
| I can't see why Windows XP would be interfering with the drive's HPA,
| though. In fact, a search for "Host Protected Area" or "Device
| Configuration Overlay" at the MSKB produces no hits at all for *any*
| MS product.

YEAH SO did you really expect any info there.. like I didn't check,
come on...

|
| I'm beginning to suspect this may be a possible reason for Vista not
having
| a new file system as it was supposed to (or at least that's what I have
| heard or read).
|
| --
| MEB
|
| "Ron Badour" wrote in message
| ...
|
| | Everything I can find says they do work with NTFS--do you have a source
| for
| | your statement?
| |
| | --
| | Regards
| |
| |
| | Ron Badour, MS MVP for W98
|
| | "MEB" meb@not wrote in message
| | ...
|
| | Sorry, Zap and Wipe will not remove XP NTFS completely and may
severely
| | damage the hard drive.
| |
| | --
| | MEB
|
| - Franc Zabkar
| --
| Please remove one 'i' from my address when replying by email.

IBM T22 and Win 98se
"Jeff Richards" wrote in message
...
| ZAP and WIPE do not remove the NTFS file system completely. They remove
| enough of it to allow something like W98 FDISK, which can't understand
NTFS
| and refuses to do anything to a drive it can't understand, to work so that
| the user can create a FAT or FAT32 partition.

Agreed, but at what cost? The drive is NOT actually wiped and ready for
use. It just APPEARS that it is.

|
| Forensic tools will still be able to recover data, and it's possible that
a
| good NTFS recovery tool will be able to rebuild the file system These
| utilities were not promoted on the basis that they removed NTFS, only that
| they enabled FDISK to start over with a disk that was 'clean enough'.
|
| While it is technically possible for something like ZAP or WIPE to damage
a
| drive, I have used these utilities many, many times and I have never had
an
| issue. If your diagnostics are telling you that the drive is faulty then
I
| would be confident that the problems were there before you used ZAP or
WIPE.
|
| I would have no hesitation in recommending these utilities to someone who
| needs to get rid of an unknown file system so that FDISK can be used.
| --
| Jeff Richards
| MS MVP (Windows - Shell/User)

Well, that may be fine for Microsoft and acceptable to you, however, I
doubt that if the people effected knew what had been done to their drives,
and that XP NTFS is unremovable by any standard means, and unless my testing
is faulty (which it might be since its unfinished), then all of these drives
are automatically headed for the dump once XP NTFS is installed.
If there is no way to adequately remove XP NTFS, then any resale of an old
computer or it's hard drive: can not be guaranteed as safe; has protected
the seller; or has protected the buyer.


"Ron Badour" wrote in message
...
| I've used and recommended these tools for several years and I have never
| heard of anyone having damage occur to their hard drives from using them
| although I guess it could be possible. If the NTFS partition is large
| enough, there would be remnants since these tools only clean out enough of
| the partition so fdisk can be used.
|
| I am not clear about what you are trying to test. Are you trying to
recover
| data on a failing drive?
|
| --
| Regards
|
|
| Ron Badour, MS MVP for W98

No, not trying to recover anything except the full hard drive and remove XP
NTFS completely. Consider it like returning the hard drive to it's pristine
state without the contamination and loss of space, and potential failures
which may be caused pursuant the corruption.

--
MEB
http://peoplescounsel.orgfree.com/
BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real
world"

"Most people, sometime in their lives, stumble across truth.
Most jump up, brush themselves off, and hurry on about their business as if
nothing had happen." Winston Churchill
Or to put it another way:
Morpheus can offer you the two pills;
but only you can choose whether you take the red pill or the blue one.
_______________

On Tue, 26 Sep 2006 16:28:12 -0400, "MEB" meb@not
put finger to keyboard and composed:

BACKGROUND:
I have presented apparent issues with the re-use of former XP NTFS hard
drives for other use or re-use. Tools and techniques normally used for
fdisking and formatting, wiping and other activities, apparently do not
completely remove XP NTFS from hard drives.

Disks used for testing:

Maxtor 87000AB - Hard Disk Family DiamondMax 1750A (per Everest)

Per early test (WinHex) on the Maxtor:
Hard disk 1
Total capacity: 7,003,586,560 bytes = 6.5 GB
Number of cylinders: 851
Number of heads: 255
Sectors per track: 63
Bytes per sector: 512
Sector count: 13,678,880

This is the drive's native capacity in LBA mode.

Surplus sectors at end: 7,565

This is the drive's unusable capacity when it is configured in CHS
mode.

13678880 = (851 x 255 x 63) + 7565

LBA mode = CHS mode + surplus

Partition 1
Sectors 63 - 13,655,249

13655250 = 850 x 255 x 63 = total CHS capacity - one cylinder

It appears that Fdisk (?) reserves the last cylinder, probably for
compatibility purposes. Some older systems placed a defect map there.

See http://www.tldp.org/HOWTO/Large-Disk-HOWTO-6.html

Partition table: Sector 0
File system: FAT32
Total capacity: 6,991,455,744 bytes = 6.5 GB
Sector count: 13,655,187
Usable sectors: 13,628,528
First data sector: 26,652
Bytes per sector: 512
Bytes per cluster: 4,096
Free clusters: 1,537,767 !FSInfo mismatch! = 90% free
Total clusters: 1,703,566
Unused inter-partition space:
Sectors 1 - 62 (31.0 KB)

This is the first track. It is unused because FAT partitions must
start and finish on a track boundary.

Sectors 13,655,250 - 13,678,879 (11.5 MB) = 11.6 MB

= capacity of last reserved cylinder + surplus sectors
= (255 x 63) + 7565 sectors

A recent test shows:
Hard disk 1

Total capacity: 7,003,586,560 bytes = 6.5 GB

Number of cylinders: 851
Number of heads: 255
Sectors per track: 63
Bytes per sector: 512
Sector count: 13,678,880
Surplus sectors at end: 7,565

Partition 1
Sectors 63 - 13,639,184

This is reduced from the previous case by 16065 (= 255 x 63) sectors.
This amounts to a loss of one additional cylinder. Has Fdisk become
confused by the existing partition table and erroneously reserved an
extra track?

Partition table: Sector 0
File system: ?
Total capacity: 6,983,230,464 bytes = 6.5 GB
Sector count: 13,639,122

= 13639185 - 63

Bytes per sector: 512

Unused inter-partition space:
Sectors 1 - 62 (31.0 KB)
Sectors 13,639,185 - 13,678,879 (19.4 MB)
= 19.4 MB

= capacity of 2 reserved cylinders + surplus sectors

I don't think you are seeing any NTFS/Win XP issue. Instead it appears
that the drive's capacity is being reduced by some combination of
"soft" events.

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.

"MEB" meb@not wrote in message
...
snip

There are hundreds (thousands) of web pages which appear to claim XP NTFS
is capable of being removed via old techniques and tools.
My testing (to date) shows this in not true. Several hundred megabytes of
hard drive space (on these small hard drives, who knows how much on larger
drives) still contain files and folders from an XP NTFS installation after
its removal.

You are addressing an issue completely different than the original topic. No
part of that discussion referred to removing all trace of NTFS. The point
of recommending ZAP or WIPE was to enable Windows 98 FDISK to work. Nothing
you have mentioned here indicates in any way that ZAP or WIPE will not work
for that purpose, or will damage the disk in any way. Check the description
for these utilities - they both clearly specifiy exactly how much of the
disk gets overwritten. In terms of current disk sizes, it's not much. But it
is enough to enable FDISK to partition the disk as FAT32, which was the
point of the original query.

The fact that recovery utilities can see part of the old NTFS data after
running something like ZAP or WIPE is simply not relevant. They will
probably still be able to see the data after FDISK has partitioned the
drive, and possibly even after it's formatted (depending on the options
used). This old, recoverable data has absolutely no impact on subsequent
use of the disk. It will get overwritten as the disk fills up.

I suspect the problems you are seeing are due to data recovery or disk
inspection tools you are using which are somehow protecting data that
appears to be recoverable. Without knowing the exact sequence of utilities
you used it's impossible to say what has happened. But I have many disks
scattered around many different clients that have had NTFS removed as part
of the process of reconditioning second hand-machines, and I have never had
any problems getting access to the full capacity of the disk. Provided, of
course, I configured them correctly and used a file system that was capable
of accessing that capacity.

And to suggest that no results to your searching proves that there's a
conspiracy to keep the problem quiet is just nonsense.
--
Jeff Richards
MS MVP (Windows - Shell/User)

"MEB" meb@not wrote in message
...
SYNOPSIS:

This is a collected discussion concerning XP hard drive re-use, in which I
have personally participated, per [there may be others which I have
missed]:

" IBM T22 and Win 98se";
" New post, ms Everest report";
" Hangs on POST screen";
" win 98 installation"
" Updates for Win9X's & reason/logic"
" No hard drive?"
" Unable to install Win98 SE"
" PC100 v PC133 ram"

GENERAL REFERENCE and SEARCH TERMS: XP NTFS hard drives, tools used to
test
and/or recover hard drives, NTFS recovery tools, forensic tools for
analysis
of hard drives, securely deleting hard drives, removing XP NTFS from hard
drives.

Present participants in this technical discussion:
Ron Badour, MS MVP for W98;
Jeff Richards MS MVP (Windows - Shell/User);
Gary S. Terhune MS MVP Shell/User
PCR;
Franc Zabkar;
and myself - Maurice Edward, Brahier;
others who may wish to participate.

BACKGROUND:
I have presented apparent issues with the re-use of former XP NTFS hard
drives for other use or re-use. Tools and techniques normally used for
fdisking and formatting, wiping and other activities, apparently do not
completely remove XP NTFS from hard drives.

Disks used for testing:
Samsung (no longer an issue as it is toast, completely un-accessible)
Maxtor 87000AB - Hard Disk Family DiamondMax 1750A (per Everest)
originally used for XP NTFS testing purposes (the OS), fully configured,
idled as a firewall only. After Samsung loss, normal "old" removal
techniques used to re-use the drive as 32bit, then additional testing.

Per early test (WinHex) on the Maxtor:
Hard disk 1
Total capacity: 7,003,586,560 bytes = 6.5 GB
Number of cylinders: 851
Number of heads: 255
Sectors per track: 63
Bytes per sector: 512
Sector count: 13,678,880
Surplus sectors at end: 7,565
Partition 1
Sectors 63 - 13,655,249
Partition table: Sector 0
File system: FAT32
Total capacity: 6,991,455,744 bytes = 6.5 GB
Sector count: 13,655,187
Usable sectors: 13,628,528
First data sector: 26,652
Bytes per sector: 512
Bytes per cluster: 4,096
Free clusters: 1,537,767 !FSInfo mismatch! = 90% free
Total clusters: 1,703,566
Unused inter-partition space:
Sectors 1 - 62 (31.0 KB)
Sectors 13,655,250 - 13,678,879 (11.5 MB) = 11.6 MB

A recent test shows:
Hard disk 1

Total capacity: 7,003,586,560 bytes = 6.5 GB

Number of cylinders: 851
Number of heads: 255
Sectors per track: 63
Bytes per sector: 512
Sector count: 13,678,880
Surplus sectors at end: 7,565

Partition 1
Sectors 63 - 13,639,184
Partition table: Sector 0
File system: ?
Total capacity: 6,983,230,464 bytes = 6.5 GB
Sector count: 13,639,122
Bytes per sector: 512

Unused inter-partition space:
Sectors 1 - 62 (31.0 KB)
Sectors 13,639,185 - 13,678,879 (19.4 MB)
= 19.4 MB

Using GetBack Data for NTFS (an excerpt)
|TREE INFO|
Tree statistic: 395 directories, 579 files, 831 KB
can still be attempted at recovery (and yes, many CAN be viewed, except
for
the encrypted/compressed files)

[Don't bother pointing out the errors shown above, this discussion
wouldn't
be continuing if there were no errors.]

Tools tested so far:

hd-util [Samsung];
SH-diag [Samsung];
Sutil [Samsung];
Meandisk;
DBan;
Wipe;
Zap;
HDAT2;
AEFDISK;
GDISK (Symantec);
Killdisk;
BootitNG;
MBRWork;
PowerMax [Maxtor];
Maxtor MaxBlast;
Super FDisk;
MHDD;
OnTrack Data Advisor;
Seagate SeaTools;
Eraser;
Testdisk;
WinHex.
(may already have used several others)

Microsoft tools used:
CHKDISK (and its autochkdsk - XP versions);
Recovery Console;
Delpart;
fdisk;
format;

ISSUES:

There are hundreds (thousands) of web pages which appear to claim XP NTFS
is capable of being removed via old techniques and tools.
My testing (to date) shows this in not true. Several hundred megabytes of
hard drive space (on these small hard drives, who knows how much on larger
drives) still contain files and folders from an XP NTFS installation after
its removal.
My personal testing shows that initially, and in particular after
continually trying to remove the XP NTFS, the disk will be reduced in
size.
The Maxtor (a 7 gig) now has 5.6 gigabytes of usable space available. Each
attempt to remove XP has added some amount to the original total of
unusable
space (less some sensitive data manually removed via disk editor (so I
don't
inadvertently place it on the eventual web pages)).

MBR has been replaced several times, drive has been "hardware" reset, and
dozens of other like activities have been tried unsuccessfully. This has
been verified NTFS recovery tools for DOS, Windows and Linux; and disk
editors/viewers of varying quality and ability.

These hidden/restricted areas are ignored or marked as bad sectors by most
tools. These areas may cause potential severe errors to occur when disk
scanning software is used on the disk, depending on its abilities and/or
configuration.

PRESENT ACTIVITIES IN THREADS WITH REPLY FROM MEB:

IBM T22 and Win 98se
"Franc Zabkar" wrote in message
...
| On Mon, 25 Sep 2006 16:56:13 -0400, "MEB" meb@not
| put finger to keyboard and composed:
|
| I'm sorry Ron, the only thing I can presently direct you too, are the
tools
| which will expose that they don't.
| If you wish me to re-post them here I will. They're NTFS recovery
tools
| (DOS and Linux), and forensic tools.
|
| Are these the kinds of tools you are referring to?
| http://www.hdat2.com/
| http://vidstrom.net/stools/taft/

First yes, second will look at it.

|
| Regretfully, I'm on my second hard drive during my testing (first, a
| Samsung which is no longer accessible after using several techniques
and
| tools, the bios no longer recognizes it)
|
| What did you do? AFAIK, even a "low level format" cannot harm a modern
| drive because the drive ignores the command.
|
| See http://www.ariolic.com/activesmart/l...el-format.html

I'll check this info.

|
| Other than that, meddling with the HPA would, AFAICS, only render a
| portion of the drive inaccessible, unless you set a password which you
| subsequently forgot, or unless you deliberately chose to make the
| whole drive invisible. In any case, I would expect that either of the
| above utilities should be able to remove any capacity "clipping".
|
| Otherwise here is Samsung's own Hutil utility:
| http://www.samsung.com/Products/Hard...ties/hutil.htm

Been there done that, didn't get the t-shirt.

|
| "If you want to recover to the original size of drive, perform RECOVER
| NATIVE SIZE by pressing Enter Key. DISPLAY CURRENT STATUS represents
| the current size of drive. If you set 32GB Clip due to capacity
| limitation of system, remove the 32GB clip to adjust the LBA or SIZE."
|
| Of course if your BIOS can no longer see the HD, then your options may
| be limited ...

There are no more options for the Samsung, its toast.

|
| ... a Maxtor, which is presently also
| on the verge of loss unless I can find the proper info soon, which I'm
| having difficulty locating. That would be information on what exactly
XP
| changes in its use of HPA and other changes to the hard drive.
|
| I found these links informative:
|
http://polya.computing.dcu.ie/wiki/i..._why_bother%3F
|
http://polya.computing.dcu.ie/wiki/i...s_on_Harddisks
| http://www.win.tue.nl/~aeb/linux/Large-Disk-11.html

Will check these links also.
Maxtor tools will not work (or at least what is publicly available).

|
| I can't see why Windows XP would be interfering with the drive's HPA,
| though. In fact, a search for "Host Protected Area" or "Device
| Configuration Overlay" at the MSKB produces no hits at all for *any*
| MS product.

YEAH SO did you really expect any info there.. like I didn't check,
come on...

|
| I'm beginning to suspect this may be a possible reason for Vista not
having
| a new file system as it was supposed to (or at least that's what I have
| heard or read).
|
| --
| MEB
|
| "Ron Badour" wrote in message
| ...
|
| | Everything I can find says they do work with NTFS--do you have a
source
| for
| | your statement?
| |
| | --
| | Regards
| |
| |
| | Ron Badour, MS MVP for W98
|
| | "MEB" meb@not wrote in message
| | ...
|
| | Sorry, Zap and Wipe will not remove XP NTFS completely and may
severely
| | damage the hard drive.
| |
| | --
| | MEB
|
| - Franc Zabkar
| --
| Please remove one 'i' from my address when replying by email.

IBM T22 and Win 98se
"Jeff Richards" wrote in message
...
| ZAP and WIPE do not remove the NTFS file system completely. They remove
| enough of it to allow something like W98 FDISK, which can't understand
NTFS
| and refuses to do anything to a drive it can't understand, to work so
that
| the user can create a FAT or FAT32 partition.

Agreed, but at what cost? The drive is NOT actually wiped and ready for
use. It just APPEARS that it is.

|
| Forensic tools will still be able to recover data, and it's possible
that
a
| good NTFS recovery tool will be able to rebuild the file system These
| utilities were not promoted on the basis that they removed NTFS, only
that
| they enabled FDISK to start over with a disk that was 'clean enough'.
|
| While it is technically possible for something like ZAP or WIPE to
damage
a
| drive, I have used these utilities many, many times and I have never had
an
| issue. If your diagnostics are telling you that the drive is faulty
then
I
| would be confident that the problems were there before you used ZAP or
WIPE.
|
| I would have no hesitation in recommending these utilities to someone
who
| needs to get rid of an unknown file system so that FDISK can be used.
| --
| Jeff Richards
| MS MVP (Windows - Shell/User)

Well, that may be fine for Microsoft and acceptable to you, however, I
doubt that if the people effected knew what had been done to their drives,
and that XP NTFS is unremovable by any standard means, and unless my
testing
is faulty (which it might be since its unfinished), then all of these
drives
are automatically headed for the dump once XP NTFS is installed.
If there is no way to adequately remove XP NTFS, then any resale of an old
computer or it's hard drive: can not be guaranteed as safe; has protected
the seller; or has protected the buyer.


"Ron Badour" wrote in message
...
| I've used and recommended these tools for several years and I have never
| heard of anyone having damage occur to their hard drives from using them
| although I guess it could be possible. If the NTFS partition is large
| enough, there would be remnants since these tools only clean out enough
of
| the partition so fdisk can be used.
|
| I am not clear about what you are trying to test. Are you trying to
recover
| data on a failing drive?
|
| --
| Regards
|
|
| Ron Badour, MS MVP for W98

No, not trying to recover anything except the full hard drive and remove
XP
NTFS completely. Consider it like returning the hard drive to it's
pristine
state without the contamination and loss of space, and potential failures
which may be caused pursuant the corruption.

--
MEB
http://peoplescounsel.orgfree.com/
BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real
world"

"Most people, sometime in their lives, stumble across truth.
Most jump up, brush themselves off, and hurry on about their business as
if
nothing had happen." Winston Churchill
Or to put it another way:
Morpheus can offer you the two pills;
but only you can choose whether you take the red pill or the blue one.
_______________



Yes there are software tools for finding files after the mbr and partition
(along with the file system table) are wiped. Writing zeroes to the entire
drive has been adequate for me using the utility from the hard drive maker.
There's others that go beyond that and write zeroes and ones multiple times.
--
Jonny

"Jeff Richards" wrote in message
...
| "MEB" meb@not wrote in message
| ...
| snip
|
| There are hundreds (thousands) of web pages which appear to claim XP
NTFS
| is capable of being removed via old techniques and tools.
| My testing (to date) shows this in not true. Several hundred megabytes
of
| hard drive space (on these small hard drives, who knows how much on
larger
| drives) still contain files and folders from an XP NTFS installation
after
| its removal.
|
| You are addressing an issue completely different than the original topic.
No
| part of that discussion referred to removing all trace of NTFS. The point
| of recommending ZAP or WIPE was to enable Windows 98 FDISK to work.
Nothing
| you have mentioned here indicates in any way that ZAP or WIPE will not
work
| for that purpose, or will damage the disk in any way. Check the
description
| for these utilities - they both clearly specifiy exactly how much of the
| disk gets overwritten. In terms of current disk sizes, it's not much. But
it
| is enough to enable FDISK to partition the disk as FAT32, which was the
| point of the original query.
|
| The fact that recovery utilities can see part of the old NTFS data after
| running something like ZAP or WIPE is simply not relevant. They will
| probably still be able to see the data after FDISK has partitioned the
| drive, and possibly even after it's formatted (depending on the options
| used). This old, recoverable data has absolutely no impact on subsequent
| use of the disk. It will get overwritten as the disk fills up.
|
| I suspect the problems you are seeing are due to data recovery or disk
| inspection tools you are using which are somehow protecting data that
| appears to be recoverable. Without knowing the exact sequence of
utilities
| you used it's impossible to say what has happened. But I have many disks
| scattered around many different clients that have had NTFS removed as part
| of the process of reconditioning second hand-machines, and I have never
had
| any problems getting access to the full capacity of the disk. Provided,
of
| course, I configured them correctly and used a file system that was
capable
| of accessing that capacity.
|
| And to suggest that no results to your searching proves that there's a
| conspiracy to keep the problem quiet is just nonsense.
| --
| Jeff Richards
| MS MVP (Windows - Shell/User)
|
|
|
|

I note you state you have disks laying around which have been wiped for
re-use.
Could you use forensic tools to look for compressed and encrypted files on
those disks?
I know that's a lot to ask, your day is probably full, but it would be
instrumental in my research, and this thread.
Make sure the tool or tools have access to the full disk and are NOT
limited by supposed $ BAD SECTOR $ classifications, such as would be created
during fdisking and formatting, and scandisking after a "wipe".

--
MEB
http://peoplescounsel.orgfree.com/
BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real
world"

"Most people, sometime in their lives, stumble across truth.
Most jump up, brush themselves off, and hurry on about their business as if
nothing had happen." Winston Churchill
Or to put it another way:
Morpheus can offer you the two pills;
but only you can choose whether you take the red pill or the blue one.
_______________


|
|

All that was interesting and please continue to provide links [good
information on http://www.win.tue.nl/~aeb/linux/ BTW, though it's too soon
for Linux in this discussion; other was known or already used/viewed; one
page was not yet created];

However you fail to address:
| Free clusters: 1,537,767 !FSInfo mismatch! = 90% free
That's a 10% differential of disk space.
Let's see where it might be:
"Tree statistic: 395 directories, 579 files, 831 KB (the kb is the
directories, not total file kb)
can still be attempted at recovery (and yes, many CAN be viewed,
" except for the encrypted/compressed files)""
INTACT files which show their original untouched names, in their original
directories (now corrupt), and holding their same locations on the hard
drive. Unmovable, unremovable - they are apparently protected from erasure.



--
MEB
http://peoplescounsel.orgfree.com/
BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real
world"

"Most people, sometime in their lives, stumble across truth.
Most jump up, brush themselves off, and hurry on about their business as if
nothing had happen." Winston Churchill
Or to put it another way:
Morpheus can offer you the two pills;
but only you can choose whether you take the red pill or the blue one.
_______________

"Franc Zabkar" wrote in message
...
| On Tue, 26 Sep 2006 16:28:12 -0400, "MEB" meb@not
| put finger to keyboard and composed:
|
| BACKGROUND:
| I have presented apparent issues with the re-use of former XP NTFS hard
| drives for other use or re-use. Tools and techniques normally used for
| fdisking and formatting, wiping and other activities, apparently do not
| completely remove XP NTFS from hard drives.
|
| Disks used for testing:
|
| Maxtor 87000AB - Hard Disk Family DiamondMax 1750A (per Everest)
|
| Per early test (WinHex) on the Maxtor:
| Hard disk 1
| Total capacity: 7,003,586,560 bytes = 6.5 GB
| Number of cylinders: 851
| Number of heads: 255
| Sectors per track: 63
| Bytes per sector: 512
| Sector count: 13,678,880
|
| This is the drive's native capacity in LBA mode.
|
| Surplus sectors at end: 7,565
|
| This is the drive's unusable capacity when it is configured in CHS
| mode.
|
| 13678880 = (851 x 255 x 63) + 7565
|
| LBA mode = CHS mode + surplus
|
| Partition 1
| Sectors 63 - 13,655,249
|
| 13655250 = 850 x 255 x 63 = total CHS capacity - one cylinder
|
| It appears that Fdisk (?) reserves the last cylinder, probably for
| compatibility purposes. Some older systems placed a defect map there.
|
| See http://www.tldp.org/HOWTO/Large-Disk-HOWTO-6.html
|
| Partition table: Sector 0
| File system: FAT32
| Total capacity: 6,991,455,744 bytes = 6.5 GB
| Sector count: 13,655,187
| Usable sectors: 13,628,528
| First data sector: 26,652
| Bytes per sector: 512
| Bytes per cluster: 4,096
| Free clusters: 1,537,767 !FSInfo mismatch! = 90% free
| Total clusters: 1,703,566
| Unused inter-partition space:
| Sectors 1 - 62 (31.0 KB)
|
| This is the first track. It is unused because FAT partitions must
| start and finish on a track boundary.
|
| Sectors 13,655,250 - 13,678,879 (11.5 MB) = 11.6 MB
|
| = capacity of last reserved cylinder + surplus sectors
| = (255 x 63) + 7565 sectors
|
| A recent test shows:
| Hard disk 1
|
| Total capacity: 7,003,586,560 bytes = 6.5 GB
|
| Number of cylinders: 851
| Number of heads: 255
| Sectors per track: 63
| Bytes per sector: 512
| Sector count: 13,678,880
| Surplus sectors at end: 7,565
|
| Partition 1
| Sectors 63 - 13,639,184
|
| This is reduced from the previous case by 16065 (= 255 x 63) sectors.
| This amounts to a loss of one additional cylinder. Has Fdisk become
| confused by the existing partition table and erroneously reserved an
| extra track?
|
| Partition table: Sector 0
| File system: ?
| Total capacity: 6,983,230,464 bytes = 6.5 GB
| Sector count: 13,639,122
|
| = 13639185 - 63
|
| Bytes per sector: 512
|
| Unused inter-partition space:
| Sectors 1 - 62 (31.0 KB)
| Sectors 13,639,185 - 13,678,879 (19.4 MB)
| = 19.4 MB
|
| = capacity of 2 reserved cylinders + surplus sectors
|
| I don't think you are seeing any NTFS/Win XP issue. Instead it appears
| that the drive's capacity is being reduced by some combination of
| "soft" events.
|
| - Franc Zabkar
| --
| Please remove one 'i' from my address when replying by email.

Why? I know that the forensic tools will be able to find data - I've used
them to do just that. I know that some tools will be able to identify the
original partitioning as NTFS, because they can recognise certain
signatures. But I also know, because I've already done it, that when the
disk is partitioned I will get full access.

And I also know that after using ZAP or WIPE and then FDISK and Format I
will sometimes get bad sectors reported. That's what I expected, since in
those cases the reason for rebuilding the disk was that the manufacturer's
diagnostic told me that there were bad sectors developing. And that's why
some of these disks are lying around here (including a near new Maxtor 80Gb
that's going back under warranty). But the bad sectors had nothing to do
with the attempts that I made at recovery. They were there before I started,
although not always reported to the operating system as such.
--
Jeff Richards
MS MVP (Windows - Shell/User)
"MEB" meb@not wrote in message
...


"Jeff Richards" wrote in message
...
| "MEB" meb@not wrote in message
| ...
| snip
|
| There are hundreds (thousands) of web pages which appear to claim XP
NTFS
| is capable of being removed via old techniques and tools.
| My testing (to date) shows this in not true. Several hundred megabytes
of
| hard drive space (on these small hard drives, who knows how much on
larger
| drives) still contain files and folders from an XP NTFS installation
after
| its removal.
|
| You are addressing an issue completely different than the original
topic.
No
| part of that discussion referred to removing all trace of NTFS. The
point
| of recommending ZAP or WIPE was to enable Windows 98 FDISK to work.
Nothing
| you have mentioned here indicates in any way that ZAP or WIPE will not
work
| for that purpose, or will damage the disk in any way. Check the
description
| for these utilities - they both clearly specifiy exactly how much of the
| disk gets overwritten. In terms of current disk sizes, it's not much.
But
it
| is enough to enable FDISK to partition the disk as FAT32, which was the
| point of the original query.
|
| The fact that recovery utilities can see part of the old NTFS data after
| running something like ZAP or WIPE is simply not relevant. They will
| probably still be able to see the data after FDISK has partitioned the
| drive, and possibly even after it's formatted (depending on the options
| used). This old, recoverable data has absolutely no impact on
subsequent
| use of the disk. It will get overwritten as the disk fills up.
|
| I suspect the problems you are seeing are due to data recovery or disk
| inspection tools you are using which are somehow protecting data that
| appears to be recoverable. Without knowing the exact sequence of
utilities
| you used it's impossible to say what has happened. But I have many
disks
| scattered around many different clients that have had NTFS removed as
part
| of the process of reconditioning second hand-machines, and I have never
had
| any problems getting access to the full capacity of the disk. Provided,
of
| course, I configured them correctly and used a file system that was
capable
| of accessing that capacity.
|
| And to suggest that no results to your searching proves that there's a
| conspiracy to keep the problem quiet is just nonsense.
| --
| Jeff Richards
| MS MVP (Windows - Shell/User)
|
|
|
|

I note you state you have disks laying around which have been wiped for
re-use.
Could you use forensic tools to look for compressed and encrypted files on
those disks?
I know that's a lot to ask, your day is probably full, but it would be
instrumental in my research, and this thread.
Make sure the tool or tools have access to the full disk and are NOT
limited by supposed $ BAD SECTOR $ classifications, such as would be
created
during fdisking and formatting, and scandisking after a "wipe".

--
MEB
http://peoplescounsel.orgfree.com/
BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real
world"

"Most people, sometime in their lives, stumble across truth.
Most jump up, brush themselves off, and hurry on about their business as
if
nothing had happen." Winston Churchill
Or to put it another way:
Morpheus can offer you the two pills;
but only you can choose whether you take the red pill or the blue one.
_______________


|
|

Look again below then re-think what you presented.

"Jonny" wrote in message
...
| "MEB" meb@not wrote in message
| ...
| SYNOPSIS:
|
| This is a collected discussion concerning XP hard drive re-use, in which
I
| have personally participated, per [there may be others which I have
| missed]:
|
| " IBM T22 and Win 98se";
| " New post, ms Everest report";
| " Hangs on POST screen";
| " win 98 installation"
| " Updates for Win9X's & reason/logic"
| " No hard drive?"
| " Unable to install Win98 SE"
| " PC100 v PC133 ram"
|

[slashed information]

|
| Tools tested so far:
|
| hd-util [Samsung];
| SH-diag [Samsung];
| Sutil [Samsung];
| Meandisk;
| DBan;
| Wipe;
| Zap;
| HDAT2;
| AEFDISK;
| GDISK (Symantec);
| Killdisk;
| BootitNG;
| MBRWork;
| PowerMax [Maxtor];
| Maxtor MaxBlast;
| Super FDisk;
| MHDD;
| OnTrack Data Advisor;
| Seagate SeaTools;
| Eraser;
| Testdisk;
| WinHex.
| (may already have used several others)
|
| Microsoft tools used:
| CHKDISK (and its autochkdsk - XP versions);
| Recovery Console;
| Delpart;
| fdisk;
| format;
|
| ISSUES:
|
| There are hundreds (thousands) of web pages which appear to claim XP
NTFS
| is capable of being removed via old techniques and tools.

[slashed information]

| No, not trying to recover anything except the full hard drive and remove
| XP
| NTFS completely. Consider it like returning the hard drive to it's
| pristine
| state without the contamination and loss of space, and potential
failures
| which may be caused pursuant the corruption.
|
| --
| MEB
| _______________
|
|
|
| Yes there are software tools for finding files after the mbr and partition
| (along with the file system table) are wiped. Writing zeroes to the
entire
| drive has been adequate for me using the utility from the hard drive
maker.
| There's others that go beyond that and write zeroes and ones multiple
times.
| --
| Jonny
|
|

I think you'll find that those tools I referenced do exactly as you've
stated and far more.

Unless you've done a forensic analysis of the disk(s) (that's actually
check it), you know no more that what you BELIEVE to be true, quite possibly
what you read somewhere as well.

Think of it like "there are weapons of mass destruction in Iraq" and "they
are months away from nuclear weapons". It's about as accurate.

Well fine, then you do have disks available, use a quality forensic tool on
them. Now we're getting somewhere.

Merely finding full hard drive space means relatively little, since there
are reserved sectors for S.M.A.R.T. activity AND other
scandisk/fdisk/format like activities. The disk will use these areas
attempting to replace inaccessible areas of the disk. That does NOT mean
they are bad, just inaccessible.

--
MEB
http://peoplescounsel.orgfree.com/
BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real
world"

"Most people, sometime in their lives, stumble across truth.
Most jump up, brush themselves off, and hurry on about their business as if
nothing had happen." Winston Churchill
Or to put it another way:
Morpheus can offer you the two pills;
but only you can choose whether you take the red pill or the blue one.
_______________

"Jeff Richards" wrote in message
...
| Why? I know that the forensic tools will be able to find data - I've used
| them to do just that. I know that some tools will be able to identify the
| original partitioning as NTFS, because they can recognise certain
| signatures. But I also know, because I've already done it, that when the
| disk is partitioned I will get full access.
|
| And I also know that after using ZAP or WIPE and then FDISK and Format I
| will sometimes get bad sectors reported. That's what I expected, since in
| those cases the reason for rebuilding the disk was that the manufacturer's
| diagnostic told me that there were bad sectors developing. And that's why
| some of these disks are lying around here (including a near new Maxtor
80Gb
| that's going back under warranty). But the bad sectors had nothing to do
| with the attempts that I made at recovery. They were there before I
started,
| although not always reported to the operating system as such.
| --
| Jeff Richards
| MS MVP (Windows - Shell/User)
| "MEB" meb@not wrote in message
| ...
|
|
| "Jeff Richards" wrote in message
| ...
| | "MEB" meb@not wrote in message
| | ...
| | snip
| |
| | There are hundreds (thousands) of web pages which appear to claim XP
| NTFS
| | is capable of being removed via old techniques and tools.
| | My testing (to date) shows this in not true. Several hundred
megabytes
| of
| | hard drive space (on these small hard drives, who knows how much on
| larger
| | drives) still contain files and folders from an XP NTFS installation
| after
| | its removal.
| |
| | You are addressing an issue completely different than the original
| topic.
| No
| | part of that discussion referred to removing all trace of NTFS. The
| point
| | of recommending ZAP or WIPE was to enable Windows 98 FDISK to work.
| Nothing
| | you have mentioned here indicates in any way that ZAP or WIPE will not
| work
| | for that purpose, or will damage the disk in any way. Check the
| description
| | for these utilities - they both clearly specifiy exactly how much of
the
| | disk gets overwritten. In terms of current disk sizes, it's not much.
| But
| it
| | is enough to enable FDISK to partition the disk as FAT32, which was
the
| | point of the original query.
| |
| | The fact that recovery utilities can see part of the old NTFS data
after
| | running something like ZAP or WIPE is simply not relevant. They will
| | probably still be able to see the data after FDISK has partitioned the
| | drive, and possibly even after it's formatted (depending on the
options
| | used). This old, recoverable data has absolutely no impact on
| subsequent
| | use of the disk. It will get overwritten as the disk fills up.
| |
| | I suspect the problems you are seeing are due to data recovery or disk
| | inspection tools you are using which are somehow protecting data that
| | appears to be recoverable. Without knowing the exact sequence of
| utilities
| | you used it's impossible to say what has happened. But I have many
| disks
| | scattered around many different clients that have had NTFS removed as
| part
| | of the process of reconditioning second hand-machines, and I have
never
| had
| | any problems getting access to the full capacity of the disk.
Provided,
| of
| | course, I configured them correctly and used a file system that was
| capable
| | of accessing that capacity.
| |
| | And to suggest that no results to your searching proves that there's a
| | conspiracy to keep the problem quiet is just nonsense.
| | --
| | Jeff Richards
| | MS MVP (Windows - Shell/User)
| |
| |
| |
| |
|
| I note you state you have disks laying around which have been wiped for
| re-use.
| Could you use forensic tools to look for compressed and encrypted files
on
| those disks?
| I know that's a lot to ask, your day is probably full, but it would be
| instrumental in my research, and this thread.
| Make sure the tool or tools have access to the full disk and are NOT
| limited by supposed $ BAD SECTOR $ classifications, such as would be
| created
| during fdisking and formatting, and scandisking after a "wipe".
|
| --
| MEB
| http://peoplescounsel.orgfree.com/
| BLOG http://peoplescounsel.spaces.live.com/ Public Notice or the "real
| world"
|
| "Most people, sometime in their lives, stumble across truth.
| Most jump up, brush themselves off, and hurry on about their business as
| if
| nothing had happen." Winston Churchill
| Or to put it another way:
| Morpheus can offer you the two pills;
| but only you can choose whether you take the red pill or the blue one.
| _______________
|
|
| |
| |
|
|
|
|

On Tue, 26 Sep 2006 16:28:12 -0400, "MEB" meb@not
put finger to keyboard and composed:

Hard disk 1
Total capacity: 7,003,586,560 bytes = 6.5 GB
Number of cylinders: 851
Number of heads: 255
Sectors per track: 63
Bytes per sector: 512
Sector count: 13,678,880
Surplus sectors at end: 7,565

Partition 1
Sectors 63 - 13,655,249
Partition table: Sector 0
File system: FAT32

I've checked two of my PCs. Neither has ever seen NTFS or Win XP, yet
the hard drives in both machines show a usable capacity that is
slightly less than their native capacity. In all cases it is the BIOS
(not Fdisk, sorry) that reserves the last cylinder for its own use,
whatever that may be. In addition, there is the loss of the surplus
sectors that result from the translation to CHS mode. This is because
the BIOS tries to fit the drive's geometry into 1024 cylinders or
less. In so doing, the last cylinder is often only partially filled,
so its surplus sectors are discarded. The next full cylinder is then
reserved.

In short, I see the same behaviour in a DOS/Win9x system, so it is
clearly not an XP/NTFS phenomenon.

BTW, I'm using MBRtool to view the MBR and partition table, both in
raw hex mode and in decoded mode.

http://www.diydatarecovery.nl/downloads/MBRtool.zip

- Franc Zabkar
--
Please remove one 'i' from my address when replying by email.