[NTLUG:Discuss] Hard drive conundrum - unknown data

[Rev. wRy]

Might it be a system recovery partition?

You can always fdisk it and see what file system type it is assigned.

Sometimes simply changing the file system type to windows will let you
see what's on it.

R


On Fri, 2009-10-09 at 13:14 -0600, Russ wrote:
> I hope one of you can shed some light on this question as to how I can
> remove data from a hard drive that doesn't seem to be neither movable
> nor removable.  While this involves Windows and Ubuntu, I wanted to
> ask the men and women of this LUG because I think overall you're much
> more on the ball that those on M$ forums.
> 
> I acquired an used hard drive for purposes of using it in as the sole
> HD in a dual-boot XP and Ubuntu machine.  I was told that the HD had
> been erased and that was OK with me.  Still, when I installed the hard
> drive I run Knoppix and used 'shred' to run 7 passes with a final pass
> writing zeroes.  I partitioned the hard drive and loaded XP.  In the
> process of the installation of the OS and anti-virus, firewall, etc. I
> decided to do a compress and noticed that there was a large section of
> the hard drive that was apparently blank, even after compression.  I
> was concerned that XP hadn't been written properly so I ran Spinrite
> to check the drive for back blocks, etc.  Everything was fine.  A
> second compression run which would normally remove blank sections to
> create contiguous files failed to change the location or size of the
> blank area.  Then on reboot a screen popped-up with two choices: 1)
> Windows XP Professional and 2) "Unidentified operating system on Drive
> C:".
> 
> Having lots of time on my hands, I decided to wipe the HD again using
> 'shred' with 3 passes and a final write of zeroes.  Then I ran
> Spinrite and noticed that Spinrite was reading zeroes until suddenly
> it got to a portion of the hard drive that displayed random characters
> and then reverted to reading only zeroes for the remainder of the
> scan.  I again partitioned the drive and loaded XP.  Running the
> compression software showed again an apparently large section of the
> drive which appears to be blank.
> 
> Next I ran 'Darik's Boot n Nuke' thinking that 'shred' wasn't doing
> the job.  Long story short... There is a section of the HD that has
> apparent random data written to the drive that I can not erase and can
> not cause to be moved.  In addition, a logical for Drive D:
> (identified as a diskette drive of which there is none) has been added
> to Drive E which was previously Drive D.
> 
> On the positive side, the dual boot is working fine just as one would
> expect with Ubuntu.
> 
> This situation concerns me because had I decided to load only Ubuntu I
> likely would not have been aware of the situation.  Any thoughts,
> other than trashing the HD?  What form might this data have?  Might it
> be encrypted making it resistant to erasure? Might it be that
> something in the hardware has been corrupted?
> 
> --
> Russ
> 
> _______________________________________________
> http://www.ntlug.org/mailman/listinfo/discuss