User Guide - Boot Disk
Contents
1. F e Techs Pv a EUN O 4393 7 9 Rees Sean e Woe a hoper Vemdata Gearlog Sevelog Abou m Irten Local Deb M Poppy Ow 0X BD lect oes 4 mm News Ond 0 RON SAMSUNG ELAN 390x162 Britt pm lows Duk 898 XCORLDAOAEROT 0 Boren Em PARC oem Mund Duk 2 ORO STOLGONG 745 34 Drie Informatian dd pod ls Actrre No Davs Hume a Fide System NTFS Vobume Label wk Samal ater AAA SON Total Sectors Achy Bytes Pea Chester an Total Ser 31 PODOP bytes Used Space 2323 MB 244203234 bytes Fore Space 31 5 Oh 03463061200 dyson oue E 2007 04 23 19008734 Dat Sete Q 2907 04 23 1970054 Systeme Patseshed System cran All system hard drives and floppy drives will be displayed in the left pane along with their system information in the right pane Position the cursor over the logical disk or on the Unallocated area Press F10 or click Kill button to securely remove data Follow directions to set up erase parameters Wipe Data From a Logical Drive To wipe data from a logical drive open the DOS Interactive Mode screen and follow the steps below The D etected Physical Devices screen appears All system hard drives and floppy drives will be displayed in the left pane along with their system information in the right pane Position the cursor over the logical drive Press F9 or click Wipe button on the toolbar to wipe data from unoccupied areas Follow directi 3 5 Erase or2. Bowen go Bremer en News Dek 2 EN STI OO 2 amp 5 Bwana Drive Information 2 vend Ie Active No Dave Kume a Fdo System NTFS Vodume Labet Duk Send hatar AFA SOD Total Sectors 6E HO Bytes Pw Chester m Total Son 3135 OB 7921944346 yt 2123 MB 244202734 te 31 5 Of 03463091200 he Disk 3 0 Total See 35 29 GB Peace type TRASE ALL DATA ERASE fedes s rin W Fracertes 2007 04 23 19908734 Sant System T 2907 04 23 150056 Syte Releshod be 2007 04 23 19 90 57 Rat Scaring Orve Sheet 2 08 4 2007 04 23 19 90 99 Scan Dee Completed Dk 3 407 7 This is the final step before removing data from the selected drive for ever After the process has started you may stop it by pressing the Esc key Type ERASE ALL DATA and press Enter or click OK button Progress ofthe erasing procedure will be monitored in the Disk Erasing screen similar to the one below Figure 3 6 Disk Erasing in Progress Drive laformatien ls Actrre No Dave K uma a Fide System NTS Vobume Labat Owe Smal ater ACA SON Total Sectors Ace Bytes Pes Chester a Total Ser 31 36 GB OF EO y Used Spare 2303 MD 244202234 bytes Toro Spase 11 d 08 03463061200 bytes D hene Lace method US DoD 5220 22 show high security Target Disk 3 6 31 59 GB Fes oal Winch 00 Tme Left 005930 P vestem Progen 8 To stop the process for any reason press the Esc key Please note that data that has already been e
3. After operation is ons to set up wipe parameters Wipe Operation Complete completed successfully information on how drives have been erased or wiped is displayed An example of an erase session is displayed below Active KillDi Target Hard D Erase method Verification 4 Time taken 00 Total number o Erase Session sk started at Thu Feb 20 11 56 51 2006 isk 1 US DoD 5220 22 M Passes 3 0 completed successfully 2 01 26 f erased device s partition s 1 If the process encountered errors for example from bad clusters a summary of errors is presented in this report Use the keyboard arrow keys or the mouse to scroll through the report To save the log fil e press F2 or execute Save Log command from the File menu Details of this report are saved to a log file 4 Common 4 1 How does Questions the licensing work The software is licensed on a per CD DVD basis Each license allows you to use the program from a separate CD DVD If you want to use the program to wipe 5 computers concurrently you would need 5 CD DVDs or combination of the two not exceeding five and therefore need a 5 user license 4 2 How is the data erased Active KillDisk communicates with the system hardware device directly To erase data it overwrites a Professional ll addressable locations on the drive with zeros FREE version Active KillDisk version suggests several methods for data destruction
4. D SAMSUNG PAN Peeabed Doc DIU Boric per rm Brett Prog om F es 0 mom l Ouh 858 ROMO gom M 036 t teres d ue 67100A piad 167116 System Volume Information bud C1 ndo 1 e 5T314002 745 m zU r gt kandi 121072 2 d E e L 9 97 D B all peered vw n l L1 a z1 90 RRHEAABHAAMNHUSZBS 288888888888888888 REXERRIMERIMERSERZRS S88888888888888888 QSuceseeesusucs anaa 200006 206 eon ES 9000000070 9000009090 o0000C 0C6 ODOC OON 900006 0009 900000 9080 _ 90 909 pooner 900006 0080 9000000000 anwo aoa E OCC XN 9000009400 SSESABENSARSEUHESS 8989899899998999998 g2eveseuseeuurs es 8888988888888888888 gREZRAYZRCOYHEMERER 88888888888828222323 BESEAALBZALHHUUSCSE SSS888888888888888 REX ASMERARIMYMURM BEBSESSSESSSESSSSBESBS 888888888888888888 lt Dp lt D pen e E e g es czxm czxmic 006 on 1 1 94 22 2007 23 06 00 94 73 2002 23 97 46 043299 2107 87 04 23 2002 2337 8 94 22 2002 23 0799 04 73 2002 230400 04 22 2007 2207 05 04 23 2007 23 06 03 04 73 2002 23 06 03 04 22 2007 23 06 03 04 23 2007 23 06 03 94 73 2062 2 06 03 04 23 2002 23 06 03 04 23 2007 23 06 03 04 73 0002 220609 AU 22 06 03 m x j di 2007 04 23 29 08 36 Vat System dj 2007 04 23 19708714 Systeme Raheshod be 2007 04 23 9 99 87 Rat canini One fov 2 8 11 4 2007 04 23 FH 90 59 Scan Dive Comit
5. Disk images of ISO 9660 file systems ISO images are a common way to electronically transfer the contents of CD ROMs They often have the filename extension ISO though not necessarily and are commonly referred to as ISOs lost cluster A cluster that has an assigned number in the file allocation table even though it is not assigned to any file You can free up disk space by reassigning lost clusters In DOS and Windows you can find lost clusters with the ScanDisk utility MFT records Master File Table A file that contains the records of every other file and directory in an NTFS formatted hard disk drive The operating system needs this information to access the files root records File Allocation Table A file that contains the records of every other file and directory in a FAT formatted hard disk drive The operating system needs this information to access the files There are FAT32 FAT16 and FAT versions sector The smallest unit that can be accessed on a disk Tracks are concentric circles around the disk and the sectors are segments within each circle unallocated space Space on a hard disk where no partition exists A partition may have been deleted or damaged or a partition may not have been created unused space in MFT records The performance of the computer system depends a lot on the performance of the MFT When you delete files the MFT entry for that file is not deleted it is marked as deleted This is
6. For example in US DoD 5220 22 M method it overwrites all addressable storage and indexing locations on the drive three times with zeros 0x00 complement 0xFF and random characters and then verifies all writing procedures This complies with the US DoD 5220 22 M security standard 4 3 What is the difference between the Site and Enterprise license Site License means an unlimited usage of the program in one location Enterprise License in any location 4 4 Which operating systems are supported by Active KillDisk Active KillDisk for DOS runs in any DOS environment It can be MS DOS PC DOS FreeDOS DR DOS etc As it can be installed easily onto a bootable floppy disk or a bootable CD ROM it does not matter which operating system is installed on the machine hard drive If you can boot in DOS mode from the boot diskette or boot CD ROM you can detect and erase any drives independent of the installed Operating System Active KillDisk for DOS runs in any Windows environment Windows XP Vista Server 2003 etc 4 5 Is Active KillDisk compatible with Macintosh computers No it is not 4 6 Will be able to use my Hard Disk Drive after Active KillDisk erase operation To be able to use HDD again you need to Repartition the hard drive using a standard utility like FDISK Reformat partitions using a standard utility like FORMAT Reinstall the Operating System using a bootable CD ROM 4 7 Why I cannot boot the ma
7. ND ALTO ITA Window Oo 3 Ashesh Resan o 44 3 a CS w Wee Properties Ve ws Gearlog Selog About System Loci Cabs M Poppy Ov 0h BD ocd oe 4 en News Oui 858 ROMERO N80 wt Boom A ree o News Duk 208 Sup 2 peor 5T316002 7 amp 5 Drive Information ls Actrre No Davs Humo NTFS Dux ATION OE ow 312 GD OTP raat yt 2323 MED 244203724 bytes 3 1 0h 03463001200 4o GP 2007 04 23 29908734 Dyt Stem d 2907 04 23 1900086 Syte Reheshad be 2007 04 23 9 00757 Rat canini One foe 2 06 11 A 2007 04 23 19 10 59 Scan Deve Completed Duk 3 467 SysemiMomaxe X 3 To select a different erase method use arrows or mouse to choose it from a combobox Erase methods are described in Chapter 5 Descriptions of Erase Wipe Parameters in this guide 4 To change another parameter use the arrow keys or mouse to move the cursor to the parameter For information on these parameters see Chapter 5 Descriptions of Erase Wipe Parameters in this guide 5 After parameters have been set 6 After parameters have been set to advance to the final step before erasing data After parameters have been set The Confirm Action screen appears Figure 3 5 Confirm Action O05 0434 70 Bebesh Rec co who 14 Atos troperties Yew Gee Gearlog Sevelog Sten Loci Deb M Poppy Ov 00h M loca oes a mom Mad Ond 0 BOR SAMSUNG eee Boric A vetoed mom wd Duk 808 PROTO
8. The situation with NTFS is similar Removal of confidential personal information or company trade secrets in the past might have used the FORMAT command or the DOS FDISK command Ordinarily using these procedures gives users a sense of confidence that the data has been completely removed When using the FORMAT command Windows displays a message like this Important Formatting a disk removes all information from the disk The FORMAT utility actually creates new FAT and ROOT tables leaving all previous data on the disk untouched Moreover an image of the replaced FAT and ROOT tables are stored so that the UNFORMAT command can be used to restore them FDISK merely cleans the Partition Table located in the drive s first sector and does not touch anything else 1 1 1 Advanced Data Recovery Systems Advances in data recovery have been made such that data can be reclaimed in many cases from hard drives that have been wiped and disassembled Security agencies use advanced applications to find cybercrime related evidence Also there are established industrial spy agencies adopting sophisticated channel coding techniques such as Partial Response Maximum Likelihood PRML a technique used to reconstruct the data on magnetic disks Other methods include the use of magnetic force microscopy and recovery of data based on patterns in erase bands Although there are very sophisticated data recovery systems available at a high price data can eas
9. 2 Wiping Confidential Data from Unoccupied Drive Space You may have confidential data on your hard drive in spaces where data may have been stored temporarily You may also have deleted files by conveniently using the recycle bin and then emptying the recycle bin While you are still using your local hard drive there may be confidential information available in these unoccupied drive spaces Wiping the logical drive s deleted data does not delete existing files and folders It processes all unoccupied drive space so that data recovery of previously deleted files becomes impossible Installed applications and existing data are not touched by this process When you wipe unoccupied drive space the process is run either from DOS or drive is being locked under Windows before wiping starts As a result the process does not depend on Windows system caching and deleted Windows system records can be wiped clean KillDisk wipes unused data residue from file slack space unused sectors and unused space in MTF records or root records Wiping drive space can take a long time so perform this operation at a time when you are prepared to wait For example it is a process that can be run overnight 2 System Requirements This chapter outlines the minimum requirements for PCs using Active KillDisk for Hard Drives 2 1 DOS version 2 1 Personal Computer IBM PC AT compatible CPU Operates with processors as old as Intel 286 640 Kb of RAM Video must
10. Page Up or the up or down arrow keys or use the mouse 10 To open a folder move the cursor to the folder and press Enter KillDisk scans the MFT records for this folder The files in the folder appear in the right panel Existing files and folders marked by yellow icons and deleted files and folders marked by gray icons If you are wiping data from unoccupied areas the gray coloured file names are removed after the wiping process completes You may use Data Viewer to inspect the work done by the wiping process After wiping the data in these areas and the place these files hold in the root records or MFT records are gone 3 2 1 1 Erasing the Data When you select a physical device for example Hard Disk 0 the erase command processes partitions no matter what condition they are in Everything must be destroyed If you want to wipe data residue from unoccupied drive space see 3 2 1 2 Wiping the Data If you want to erase data on selected logical drives follow the steps in 3 3 Erasing or Wiping Logical Drives Partitions To erase the data 1 Be certain that the drive you are pointing to is the one that you want to erase All data will be permanently erased with no chance for recovery 2 When you have selected the device to erase move the cursor to that device To permanently erase all data on the selected partition press F10 or click Kill button on the toolbar The Erase Method screen appears Figure 3 4 Erase Method
11. be EGA or better resolution 2 2 Drive Storage System 1 44 Mb floppy diskette drive or CD ROM drive Hard Disk Drive type IDE ATA SATA or SCSI with controllers 2 3 Other Requirements One blank 3 5 inch or 5 25 inch floppy disk suitable for formatting or a blank CD ROM to burn an ISO image Alternately use a Windows 95 98 ME Startup Disk 2 2 Windows version 2 1 Personal Computer IBM PC AT compatible CPU Intel Pentium or higher 300 Mb of RAM Video must be VGA or better resolution 800x600 2 2 Drive Storage System CD or DVD ROM drive Hard Disk Drive type IDE ATA SATA or SCSI with controllers additional drivers could be loaded for RAIDs or non standard controllers after system booted up 2 3 Other Requirements Blank CD or DVD to burn an ISO image 2 4 Active KillDisk for Hard Drives Version The performance of Active KillDisk for Hard Drives depends on the version of the application as displayed in the table below Table 2 1 Differences between Free and Professional Versions Feature Free Demo Professional Version Version Securely overwrites and destroys all data on Yes Yes physical drive or logical partition Erases partitions logical drives and unused disk Yes Yes space Supports IDE ATA SATA SCSI hard disk Yes Yes drives Supports fixed disks floppies zip drives Yes Yes FlashMedia drives Supports large sized drives more than 128GB Yes Yes Supports Command Line mode can be run with Yes Yes n
12. called unused space in the MFT If unused space is not removed from the MFT the size of the table could grow to a point where it becomes fragmented affecting the performance of the MFT and possibly the performance of the computer This space may also contain residual confidential data file names file attributes resident file data from the files that previously occupied these spaces KillDisk can wipe out the residual data without touching the existing data Windows system caching Windows reserves a specified amount of volatile memory for file system operations This is done in RAM because it is the quickest way to do these repetitive tasks Windows system records The Windows registry keeps track of almost everything that happens in windows This enhances performance of the computer when doing repetitive tasks Over time these records can take up a lot of space Copyright O 2007 LSOFT TECHNOLOGIES INC All rights reserved No part of this documentation may be reproduced in any form or by any means or used to make any derivative work such as translation transformation or adaptation without written permission from LSOFT TECHNOLOGIES INC LSOFT TECHNOLOGIES INC reserves the right to revise this documentation and to make changes in content from time to time without obligation on the part of LSOFT TECHNOLOGIES INC to provide notification of such revision or change LSOFT TECHNOLOGIES INC provides this documentation without warranty o
13. data residue from unoccupied space on the hard drive and does not affect installed applications or existing data This process contains three options Select the parameter and press Enter to choose from the list of options Wipe unused clusters Wipe unused space in MFT Root area Wipe slack space in file clusters You may choose to run only one or two of these options in order to make the process complete more quickly If you want a thorough wiping of unused space then include all of the options 6 Glossary of Terms BIOS settings Basic Input Output Subsystem This programmable chip controls how information is passed to various devices in the computer system A typical method to access the BIOS settings screen is to press F1 F2 F8 or F10 during the boot sequence boot priority BIOS settings allow you to run a boot sequence from a floppy drive a hard drive or a CD ROM drive You may configure the order that your computer searches these physical devices for the boot sequence The first device in the order list has the first boot priority For example to boot from a CD ROM drive instead of a hard drive place the CD ROM drive ahead of the hard drive in priority compressed cluster When you set a file or folder property to compress data the file or folder uses less disk space While the size of the file is smaller it must use a whole cluster in order to exist on the hard drive As a result compressed clusters contain file sla
14. mode based on command line parameters with no user interaction a DE Display this list of parameters Note Parameters test and help must be used alone They cannot be used with other parameters Key the command and parameters into the Command Prompt Here is an example killdisk exe eh 80h bm In this example erase all data on device 80h without confirmations using US DoD 5220 22 M method and show a report at the end of the process Here is an example with the wipe disk command killdisk exe wa bm em 5 nc Wipe all deleted data and unused clusters on all attached drives without confirmation using Gutman s method and return to the Command Prompt when complete Press Enter to complete the command and start the process After operation has completed successfully information on how drives have been erased is displayed on the screen 3 3 Erasing or Wiping Logical Drives Partitions In all previous examples in this chapter the process has erased data or wiped data from a physical drive Using a similar method you can erase or wipe logical disks and partitions and even Unallocated areas where partitions used to exist and the area was damaged or the area is not visible by the current operating system Erase Data From a Logical Drive To erase data from a logical drive run KillDisk and follow the steps below 1 The Detected Physical Devices screen appears as below Figure 3 9 Detected Physical Devices
15. root records of the partition The Data Viewer screen appears Existing file names and folder names appear with yellow icon and deleted file names and folder names appear with gray icon If the wiping process completed correctly the data residue in these deleted file clusters and the place these files hold in the root records or MFT records has been removed and you should not see any gray coloured icons for files or folders in the wiped partition 3 2 2 Command Line Mode To run Active KillDisk in command line mode at Command prompt display Active KillDisk for Hard Drives parameters by typing KILLDISK EXE A list of parameters will be displayed Explanations of the parameters can be found in the table below Table 3 2 Command Line Parameters Parameter Short no parameter erasemethod 0 6 em passes 1 99 p verification 1 100 Vy retryattempts 1 99 ra erasehdd 80h 8Fh eh Default 10 Options With no parameter the DOS Interactive screens will appear 0 One pass zeros quick low security 1 One pass random quick low security 2 US DoD 5220 22 M slow high security 3 German VSITR slow high security 4 Russian GOST p50739 95 slow high security 5 Gutmann very slow highest security 6 User Defined Number of Passes random Number of times the write heads will pass over a disk area to overwrite data Valid only if erasemethod 6 Set the amo
16. G OM 21 9 222 Retry Attempts ua a nes el savas puni d o SANT NUM UR 22 2 2 9 BDOTGSBEFOESe eoe oe Deos nn ct ce eM eu de NN E 22 5 2 4 Clear Log File bef te Start sae re aA EERE RA A RNAS 22 SAS SKP Confirmation Es a aaa tu eode teta E A nn 22 5 2 6 Wipe out Deleted Unused datansdales ST ba inia ath echa hem dm wes 22 6 Gil ssaty Of TGEITIS deos vaa atc e tar ce setae etr caso e as otis d OY quu utu cue ues edad pas AR 23 1 Product Overview This chapter gives an overview of Active KillDisk for Hard Drives application 1 1 Erasing Confidential Data Although modern methods of data encryption are deterring unwanted network attackers from extracting sensitive data from stored database files attackers wishing to retrieve confidential data are becoming more resourceful by looking into places where data might be stored temporarily A hard drive on a local network node for example can be a prime target for such a search One avenue of attack is the recovery of supposedly erased data from a discarded hard disk drive When deleting confidential data from hard drives or removable floppies it is important to extract all traces of the data so that recovery is not possible Most official guidelines around disposing of confidential magnetic data do not take into account the depth of today s recording densities The Windows DELETE command merely changes the file name so that the operating system will not look for the file
17. L Iu Active KillDisk User Guide Table of Contents l Product OVOLVIGWs canem c tne ide d aso td od a oa Qe quan teresa toa adea de ted nn datas 3 ed Bras Co fid ntial Dalase iei bete ebat he eese etu me ds beue edes 3 1 1 1 Advanced Data Recovery Systems is nee dd qi ia oda dH go Sd t LH RE LA ELE opa dd 3 1 1 2 International Standards in Data Removal sse 3 1 2 Wiping Confidential Data from Unoccupied Drive Space 4 2 Ste muRequiLe ie Hbi cet m eret ian bic uae a tesa edd ab to fta nta ate docebat aes 4 2 1 DOS Verso ramener ans Mav bte hi vata A bet vd Ne be ep eae 4 2 1 Personal Computer ihesi ganai aa ded an bond o Eq aded fo tiae al est suus uates 4 2 2 Dive Stor ge S VSLO cose pU tede OD dp Uca udo Hee ee Rens 4 2 3 Other CUISINE IES sc o irs d e te ases ae petuo buc Rt ue um eue IDE ord 4 2 2 M Td OS Versiosta otani A A ERR CIAR QR Sn SU oes tin DR PRU RAM AN ZUR REIR 5 2 1 Personal Computer aoa iaa tasca ed tu ead V aia eae a ea asain eas oa 5 2 2 tive Storage System i Gees ade see EN IL Ss eS E E EN t E 5 X3 0ther Requireftie fis osse rats tec cee Douce en b eode p I CE 5 3 Running Active Killick stuns cre terror sti EEA EEA e acce dades T 3 1 Preparing a Vista based Bootable CD Professional package only 7 3 2 Modes of Operatore oca ster aUa ed mosaic dc e ania apa tes 7 22 Interactive Modes dete ou ts t p M 7 32 2 Command Line Mode ost et nn US et nee BOR NEGRA UA 16 3 3 Erasing o
18. RATE all veto m om Pad Duk 2 CRY STIO 7 AS og mco Drive karenin dirai le Active Dave Nume Fide System Vodume Lab Saa ater Total Sectors Bytes Pra Chester Totu Ser Used Spare Fore Space y 2007 04 23 19908754 Dat Syston Q 2007 09 23 19 08 94 Syren Pafeeched System Dl crmanoun No a NTFS Da AFA SON d am 31 26 OD OTRAS vyter 2123 MB 242102734 bytes Ji b GH 03463061200 tye All system physical devices and logical partitions are displayed in a list 2 Change the position of the cursor in the list using the keyboard Down and Up arrow keys or using the mouse Hard drive devices are numbered by the system BIOS A system with a single hard drive shows as number 0 Subsequent hard drive devices are numbered consecutively For example the second device will be shown as Hard Disk 1 Select a device and read the detailed information about the device in the right pane Below the device select a logical partition The information in the right pane changes 3 Be certain that the drive you are pointing to is the one that you want to erase or the one you want to wipe If you choose to erase all data will be permanently erased with no chance for recovery To preview the sectors in a device press Ctrl V or click View Data button on the toolbar The Data Viewer screen appears Figure 3 2 Data Viewer E COTES M Paper oao 00h CE 0 M lcd oo 8 e 16500027 mom News Ond 0
19. chine from CD DVD ROM Machine has boot priority for Hard Disk Drives or another device set higher than for CD DVD Drives Parameters that are set in low level setup are written to the machine s BIOS To change the boot priority 1 Open the low level setup utility usually by pressing F1 F2 F10 or Escape on the keyboard during PC startup 2 Boot device priority This section will allow you to set the search order for types of boot devices When the screen opens a list of boot devices appears Typical devices on this list will be Hard Drives CD ROM drives Floppy Drives and Network Boot option 3 Save and exit the setup utility 5 Descriptions of Erase Wipe Parameters Whether you choose to erase data from the drive or to wipe data from unoccupied drive space the methods of writing over these spaces is the same 5 1 Erase Wipe Methods 5 1 1 One Pass Zeros or One Pass Random When using One Pass Zeros or One Pass Random the number of passes is fixed and cannot be changed When the write head passes through a sector it writes only zeros or a series of random characters 5 1 2 User Defined You indicate the number of times the write head passes over each sector Each overwriting pass is performed with a buffer containing random characters 5 1 3 US DoD 5220 22 M The write head passes over each sector three times The first time with zeros 0x00 second time with OxFF and the third time with random characters There is one f
20. ck space This space may contain residual confidential data from the file that previously occupied this space KillDisk can wipe out the residual data without touching the existing data cluster A logical group of disk sectors managed by the operating system for storing files Each cluster is assigned a unique number when it is used The operating system keeps track of clusters in the hard disk s root records or MFT records See lost cluster free cluster A cluster that is not occupied by a file This space may contain residual confidential data from the file that previously occupied this space KillDisk can wipe out the residual data file slack space The smallest file and even an empty folder takes up an entire cluster A 10 byte file will take up 2 048 bytes if that is the cluster size File slack space is the unused portion of a cluster This space may contain residual confidential data from the file that previously occupied this space KillDisk can wipe out the residual data without touching the existing data deleted boot records All disks start with a boot sector In a damaged disk if the location of the boot records is known the partition table can be reconstructed The boot record contains a file system identifier ISO An International Organization for Standardization ISO 9660 file system is a standard CD ROM file system that allows you to read the same CD ROM whether you re on a PC Mac or other major computer platform
21. e Duk 347 Sten diem T Syden Progress 4 To scroll up and down use the keyboard arrow keys Page Up Page Down Home and End navigation keys or related buttons on the toolbar 5 To jump to a specific sector type the sector number and press ENTER or GO button on the toolbar 6 When you are satisfied with the identification of the device press Esc to exit this Screen 7 To preview the files in a logical partition select the partition and press Enter KillDisk scans the MFT records for the partition The Data Viewer screen appears Figure 3 3 Files Preview F e Techs bete O5 98 7 O0 Raters Resan e Wee Properties View data Gearlog Savelog About Sten Loci Dub Nave p Moe Cate M Poppy Ov 0008 D fred 24 22 2067 22 06 03 D Loci oe 4 30 opm News Dn O BOR SAMSUNG 9994548 3o ic J rtd 3 pm Mad Duk 898 DCR DADA ERIOT 0 Now mom tend Oe CI Preetet Doc O me O Program fles O System Volume Information 3 Wrs 2 weet m News Duk 2 CIO STI OOD 2 amp 5 T fene 0 AUR 23 04 03 Sur 2 v cu Fotis anc hies 9 Pecetes D 2007 04 23 9 0874 Rat Systems dp 2074 44 Syene Palsehed b 2307 042 7 Rat Scaring Orive Sheek 2 06 1 2007 09 23 19 90 59 Scan Dee Completed Duk 3 407 System Norman r 8 Press Tab to switch between the panels or use the mouse 9 To see items in the list use Page Down
22. f any kind either implied or expressed including but not limited to the implied warranties of merchantability and fitness for a particular purpose LSOFT may make improvements or changes in the product s and or the program s described in this documentation at any time All technical data and computer software is commercial in nature and developed solely at private expense As the User or Installer Administrator of this software you agree not to remove or deface any portion of any legend provided on any licensed program or documentation contained in or delivered to you in conjunction with this User Guide Active KillDisk the Active KillDisk logo KillDisk and Erasers Software are trademarks of LSOFT TECHNOLOGIES INC LSOFT NET logo is a trademark of LSOFT TECHNOLOGIES INC Other brand and product names may be registered trademarks or trademarks of their respective holders
23. her parameter use the arrow keys or mouse to move the cursor to the parameter For information on these parameters see Chapter 5 Descriptions of Erase Wipe Parameters in this guide Figure 3 7 Wipe Options Screen J Actives Pilna for Window 95 0 473 4 7 0 Rates Resan 20 wer a hopie Vendee Gearlog Seela Aat Sritem Locs Deb Bway sek 4 reer ls Actrre No Dave umo 9 NTrS S Wig Duk 44 Disk 3 Gr AE a n OTAMI x U5 Do 5229 22 44 siow high sou y 3136 00 O71 ESA bytes 2321 M 244205734 bytes 31 be Of 03463091200 no 7 Gow Log Fie before Start O Sup Confirmation Wee out DelebedUncsed data Ful wipe Show v wipe urused Asters 7 wipe urused space m MFT Pot aea 7 wipe sack space n le humors Ban JE dE 2007 04 23 29908734 Dat Syston dj 2007 04 23 t9 08 14 Syste Peloeshed be 2007 04 23 9 9087 Rat Scaning Drive fov 2 08 1 4 2007 04 23 19 90 99 Scan Dive Completed Dui 347 Sten tian X 4 After parameters have been set to advance to the final step before erasing data click START button The Confirm Action screen appears Figure 3 8 Confirm Action 7 Betis Wilfim for Windows 9 EX Ashesh Resan M Poppy Ow 00h BD Loci on C te Woe i we ws Cwi Srel 5yten Loci Debs om and Ont RON SAMSUNG 9924548 390412 J ued om News Dek NE ECOL DAQAWEROT 0 P o M on 2 unalocahed oem News Duk 2 ORO STI EON 7465 Sur Drive Informatio
24. ily be restored with the help of an off the shelf data recovery utility like Active File Recovery making your erased confidential data quite accessible Using Active KillDisk for Hard Drives our powerful and compact utility all data on your hard drive or removable floppy drive can be destroyed without the possibility of future recovery After using Active KillDisk for Hard Drives disposal recycling selling or donating your storage device can be done with peace of mind 1 1 2 International Standards in Data Removal Active KillDisk for Hard Drives conforms to four international standards for clearing and sanitizing data Y ou can be sure that once you erase a disk with Active a KillDisk for Hard Drives sensitive information is destroyed forever Active KillDisk for Hard Drives is a quality security application that destroys data permanently from any computer that can be started using a DOS floppy disk DOS version or Windows Vista based bootable CD DVD Windows version Access to the drive s data in DOS is made on the physical level via the Basic Input Output Subsystem BIOS bypassing the operating system s logical drive structure organization Regardless of the operating system file systems or type of machine this utility can destroy all data on all storage devices It does not matter which operating systems or file systems are located on the machine it can be DOS Windows 95 98 ME Windows NT 2000 XP Linux or UNIX for PC 1
25. inal pass to verify random characters by reading 5 1 4 German VSITR The write head passes over each sector seven times 5 1 5 Russian GOST p50739 95 The write head passes over each sector five times 5 1 6 Gutmann The write head passes over each sector 35 times For details about this the most secure data clearing standard you can read the original article at the link below http www cs auckland ac nz pgut001 pubs secure_del html 5 2 Other Parameters Other parameters allow you to turn features on or off or to change default settings when you are erasing data or wiping data from unoccupied space 5 2 1 Verification After erasing is complete you can direct the software to perform verification of the surface on the drive to be sure that the last overwriting pass was performed properly and data residing on the drive matches the data written by the erasing process Because verification is a long process you may specify a percentage of the surface to be verified You may also turn the verification off completely 5 2 2 Retry Attempts If an error is encountered while writing data onto the drive for example due to physical damage on the drive s surface Active KillDisk tries to perform the write operation again Y ou can specify number of retries to be performed Sometimes if the drive surface is not completely damaged a damaged sector can be overwritten after several retries 5 2 3 Ignore Errors Ifthis option i
26. n B tected Is Active No Davs N ume a Vide System NTS Vodame Labat Da Sema hter ATION Total Sectors Ot Bytes Pea Chester And Total Son 3 3 GB OT bytes 2323 MED 244203224 bytes Ji e Gf 034630061200 ye T henes E 2007 04 23 19908734 Vat Stem 3 2x70 OSE Systeme Reheshad b 2007 09 3 59 89 57 Rat Scaring Orve Creek 2 9 17 a 2007 04 23 19 50 99 Scan Dee Comgiweted Duk 3 63 System diomain 5 This is the final step before wiping data residue from unoccupied space on the selected drive After the process has started you may stop it by pressing the Esc key Type WIPE FREE SPACE and press Enter or click OK button Progress of the wiping procedure will be monitored in the Disk Wiping screen 6 To stop the process for any reason press the Esc key Please note that all existing applications and data will not be touched however data that has been wiped from unoccupied sectors will not be recoverable 7 There is nothing more to do until the end of the disk erasing process The application operates on its own without user intervention If there are any errors for example due to bad clusters they will be reported on the Interactive screen If such a message appears you may cancel the operation by pressing Esc or you may continue wiping data 8 After the wiping process is completed to inspect the work that has been done select the wiped partition and press Enter KillDisk scans the MFT records or the
27. named KILLDISK SETUP EXE This file contains everything you need to set up and run the application Double click KILLDISK SETUP EXE to run installation and follow the instructions 3 1 Preparing a Vista based Bootable CD Professional package only This chapter describes how to create a Windows Vista based bootable CD DVD ROM that contains the Active KillDisk application 3 2 Modes of Operation Active KILLDISK for Hard Drives can be used two ways Interactive Mode Command Line Mode It is wise to label the CD DVD ROM to identify the way you plan to use Active a KILLDISK for Hard Drives 3 2 1 Interactive Mode This section describes how to use the Interactive Mode The steps for erasing data and wiping data are similar Follow steps 1 through 13 and then click the link to complete either the erasing process or the wiping process If you are booting from a CD DVD ROM drive check that the CD DVD drive has boot priority in the BIOS settings of your computer Here are the steps for interactive operation 1 Start the Active KILLDISK either from bootable CD DVD or from the Programs menu The Detected Physical Devices screen appears Figure 3 1 Detected Physical Devices F e Taba Mate 98S 4 3 IC 709 Ashesh Sean M Puppy ow 00 DB ioc oe 4 wwe Vew dete Gearlog Sevelog Site Locs Deb en News Ded 0 RO SAMENG 916548 Sonic A vue S mm herd Duk UE CPR OMR MEROT 0 40
28. o user interaction Operates from floppy disk or bootable CD Yes Yes ROM drive Erases with one pass zeros Yes Erases with one pass random characters Erases with user defined number of passes up to 99 US Department of Defense 5220 22 M compliant German VISTR compliant Russian GOST p50739 95 compliant Gutmann method compliant Customizable security levels Supports all detected hard disk drives Yes Erasing report is created and can be saved as a Yes file Displays detected drive and partition Yes information Scans NTFS and FAT volumes and displays Yes existing and deleted files and folders Data verification may be performed after erasing is completed Disk Viewer allows you to preview any sectors Yes or file clusters on a drive Includes DOS real mode utility which operates Yes in the most secure and reliable environment Wipes out NTFS FAT32 FAT16 and FAT12 Yes volumes from areas containing deleted and unused data Wipes out free clusters unused by file data Yes sectors Wipes out file slack space unused bytes in the Yes last cluster occupied by file Wipes out deleted MFT and ROOT system Yes records Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Wipes out unused space in any MFT records Yes Yes and compressed clusters 3 Running Active KillDisk After you purchase Active KillDisk you will receive an installation file
29. r Wiping Logical Drives Partitions 18 3 5 Erase or Wipe Operation COMMISE ostio dee nan esto dE 19 4 Common OUestIons o oa notan o ate dao a OR al qu nro i aatia nt 19 4 1 How does the licensing work isis eee enter etas eto ein emu cna xag cn HN Eds caves ies 19 A HOW is the data erased ann aaa tn ed Lo ade Qa d uut Dd odi uude 19 4 3 What is the difference between the Site and Enterprise license 20 4 4 Which operating systems are supported by Active KillDisk 20 4 5 Is Active KillDisk compatible with Macintosh computers sssssseese 20 4 6 Will I be able to use my Hard Disk Drive after Active KillDisk erase operation 20 4 7 Why I cannot boot the machine from CD DVD ROM 20 5 Descriptions of Erase Wipe Parameters uote eee o i bes vee ne RM DU ps do See 21 5 T Erase Wipe Methods casita aet ette ad e AE qv wang eas aa teas ass eas aaa ae 21 5 1 1 One Pass Zeros or One Pass Random ie eee een tion beo td ean ts nait 21 SI 2 User SC udo ea en ace Daun pasada cede a anto dta aae od 21 Suo US DoD 5220 22 M os usn ird tss eei re 21 S 1 4Geeman ds NM abe Pace areas cera 21 5 15 Russian GOST po0 739295 uisi ss tines Rai es e RN GE ON HO Ee Mq o Gawain asic 2 S 1 9 Crt aU tes s cnet x eat Res Eos d scade de Eoo Ne ne de ne c N 21 52 Other Parameters icc acess cebat ante eddie atat data te saec ated aad inte dantis 2 5 2 LV SLIP CA
30. rased will not be recoverable 9 There is nothing more to do until the end of the disk erasing process Application will operate on its own without user intervention If there are any errors for example due to bad clusters they will be on the Interactive screen If such a message appears you may cancel operation by pressing Esc or you may continue erasing data 3 2 1 2 Wiping the Data When you select a physical device for example Hard Disk 0 the wipe command processes all logical drives consecutively deleting data in unoccupied areas Unallocated space is not touched If KillDisk detects that a partition has been damaged or that it is not safe to proceed KillDisk does not wipe data in that area It does not proceed in case it is a damaged partition with important data If you want to erase data from the hard drive device permanently see 3 2 7 7 Erasing the Data If you want to wipe data in unoccupied areas on selected logical drives follow the steps in 3 3 Erasing or Wiping Logical Drives Partitions To wipe data 1 When you have selected the device to wipe move the cursor to that device To wipe all data in unoccupied sectors on the selected partition and press F9 or click the Wipe button on the toolbar The Wipe Method screen appears 2 To select a different wipe method choose it from the combobox Wipe methods are described in Chapter 5 Descriptions of Erase Wipe Parameters in this guide 3 To change anot
31. s turned on error messages will not be displayed while data erasing or verification is in progress When ignore error messages is turned on all information about these errors is written to the KILLDISK LOG file These messages are displayed after the process is complete in the final Erasing Report 5 2 4 Clear Log File before Start Ifthis option is turned on KILLDISK LOG log file will be truncated before erasing starts After erasing is completed the log file will contain information only about the last session If this option is turned off KILLDISK LOG log file will not be truncated and information about the last erasing session is appended to the end of the file 5 2 5 Skip Confirmation The confirmation screen is the final step before either erasing or wiping data In this red colored screen you type ERASE ALL DATA or WIPE ALL DATA to confirm what is about to happen If Skip Confirmation is turned on this final safety request does not appear This option is typically to be used with caution by advanced users in order to speed up the process It is safer to run KillDisk with this option selected default state You may want to use this as a safety buffer to ensure that data from the correct drive location is going to be erased completely with no possibility of future data recovery 5 2 6 Wipe out Deleted Unused data This parameter appears only when you are wiping data from unused space on the hard drive The wiping process clears
32. unt of area the utility reads to verify that the actions performed by the write head comply with the chosen erasemethod reading 10 of the area by default It is a long process Set the verification to the level that works for you Set the number of times that the utility will try to rewrite in the sector when the drive write head encounters an error Name the hard drive to be erased By default the utility erases the first logical drive encountered eraseallhdds eq Erase all hard disk drives ignoreerrors ie 8 Do not stop erasing each time a disk error is encountered When you use this parameter all errors are ignored FRE e Use this parameter to clear the log file before recording new activity When a drive is erased a log file is kept By default new data is appended to this log for each erasing process The log file is stored in the same folder where the software is located noconfirmation nc Skip confirmation steps before erasing starts By default confirmation steps will appear in command line mode for each hard drive or floppy as follows Are you sure Deep bp Beep after erasing is complete wipeallhdds wa Wipe all hard drives wipehdd 80h 8Fh wh Name the hard drive to be wiped test If you are having difficulty with Active KillDisk for Hard Drives use this parameter to create a hardware information file to be sent to our technical support specialists Dalene E Execute in batch
Download Pdf Manuals
Related Search