Re: Destroying filesystems

On Apr 7, 2005, at 2:43 PM, Maurizio Trinco wrote:

> Let me reformulate the whole thing:
>
> a) I'm looking for a utility that:
>         a1 - would run in user mode (Admin/root user
> OK);
>         a2 - would only scramble the MFT/inode table
> etc, but would NOT touch the actual data on disk.

The format command does this....   I can't imagine why other utilities 
would be written to intentionally screw up part of a file system, but 
not wipe file contents.

> b) the purpose of the exercise is to get back the
> logical organization of that filesystem (i.e. to
> "repair" it) not to actually recover data.
>         b1 - by "repair" I mean something much more
> difficult than running chkdsk/fsck on that filesystem
> i.e. the usual tools shouldn't be able to cope with
> the amount of the damage done to the filesystem.

If the purpose of the exercise is to have them rebuild the file system 
then it sounds easier if you use a hex editor to create a disk image 
with specific errors / data and distribute copies to them.  (If you 
make the image publicly available, I'll add a link to it from the 
Digital Forensics Tool Testing site <http://dftt.sourceforge.net>)

brian


-----------------------------------------------------------------
This list is provided by the SecurityFocus ARIS analyzer service.
For more information on this free incident handling, management 
and tracking system please see: http://aris.securityfocus.com