Hard Drive Formatting - Low Level Format

There is a fair amount of outdated information in this thread.

First of all, low level formatting of modern high density hard drives can only be done during manufacture using special laser-guided equipment. Users cannot perform a low level format in the field on these drives. This has nothing to do with the interface (SCSI, SATA, or whatever) or with the software that you use. It is strictly a consequence of the embedded servo technology used for track location in essentially all modern drives. This high precision location technology makes it possible to use many extremely narrow, closely spaced tracks on a single drive platter, which in turn makes possible the extremely high data capacities characteristic of modern drives.

It also makes obsolete most of the multi-pass secure erase procedures, which write several other data patterns besides zeros to the drive. In fact, the 35 pass erase was never intended for use with most drives, as explained in this seminal paper written by its originator. Likewise, the 7 pass secure erase option available in Disk Utility meets the now obsolete U.S. Department of Defense (DoD) 5220-22-M standard for securely erasing magnetic media. These procedures are intended for older drives in which vestiges of the track's data might not be fully overwritten during a single erase pass because the drive head wonders off track centers due to their less precise mechanical track location methods.

For most users, the single pass "zero data" procedure is enough to completely erase all vestiges of track data recoverable by normal means. If you still feel the need to use a more sophisticated erase algorithm, you can save yourself some time by using the command line version of Disk Utility called "diskutil" & its "secureErase" verb to do a 3 pass secure erase that meets current DoE security requirements. For modern drives this is just as secure an erase as the more time consuming 7 & 35 pass versions. More demanding current security standards generally involve physically destroying the drive in carefully specified ways, such as grinding the platter into dust or incinerating the entire unit. If you need to meet these standards, you probably won't be allowed to destroy the drive yourself.

In any event, if you send your Mac back to Apple for service, there is no guarantee that the drive will be securely erased by any method, or even that you will get the original back if it needs to be replaced. If your data is so sensitive that this is a concern, do the erase yourself before sending it in, using the method most appropriate for your needs.

You have several choices...

If you erase the drive and install the files could be recovered (not without some difficulty). If you choose "Options" you will see that you can choose zero out (which should be good enough for anyone not working with highly confidential documents) all the way up to 35X.

If you're handling secret government documents you should be running a sophisticated that would do that for you each time you deleted.



-mj

Hi there are different ways of preparing the disk for a fresh installation through Disk Utility. One is simply "Erasing" the disk but this, as you suggest in your post, means deleted files may be recovered in future. If, however, before erasing you click "Security Options" in Disk Utility, you have a choice to "Zero Out Data", "7-Pass Erase" and "35-Pass Erase" - the more passes the more secure (and more time consuming) the erase is.

First, you cannot low-level format a SATA drive. What you can do is repartition them, replace an existing directory with a new, empty directory (known as a quick format,) or use a Zero Data format option that writes zeroes into every byte of the drive (known as a long format.)

In the case of a quick format only the directory is erased. All the data actually written to the drive remains until it is overwritten. This means that although the drive appears to be empty the old data is still recoverable with the right type of software.

In the case of the long format zeroes are written into every byte on the drive overwriting all the data that had been written to the drive. When this format is completed none of the old data remains on the drive and is no longer recoverable.

All partitioning and formatting can be done using Disk Utility, a tool supplied with OS X.

Low Level Format (LLF) was used back with SCSI drives, so not sure why you think that feature would apply.

Writing zeroes is rather easy to recover data afterwards.

Quick format only tests the first and last 1M blocks to insure that the partition table can be written and check other variables.

New drives can ship with bad, weak sectors and the time it would take to test every sector - and the heat and stress - make it difficult and more trouble.

An LLF was needed for various reasons but that has been awhile, and did put a lot of stress on a drive.

There is govt level secure erase but that goes beyond what Disk Utility offers. If you are really concerned, don't lose possession, and either keep the drives and store, or use a huge magnet or sledge hammer.

If you do not have physical possession and want to do a 'secure erase' then I would opt for 7-way write, longer and a step above zeroing a drive.

Install Windows and use the vendor's utility or a Windows utility to use encrypted erase.

How about, drop in water, put in freezer? then 30 minutes in oven on 350* ! 🙂

I have a couple boxes of old drives - not worth ebaying or selling and sorry that I did a couple times.

http://www.bing.com/search?q=recoverfiles+afterformat

And it seems lots of people use the term LLF maybe out of habit or just don't know or result of terminology losing any and all of its former meaning.

http://www.bing.com/search?q=lowlevel+format+sata+harddrive

Formatting the drive ("Erase" in Disk Utility) will remove all data and it won't come back. The only reason to write zeros to the drive would be to make forensic recovery impossible, or nearly so. For privacy's sake, you should format the drive yourself before you take in for repair, rather than relying on someone else to do it. Obviously you'll back up all your data first.

Were I you I would reformat the drive prior to sending it in for repair. They will not likely do that for you. Here's what your do:

Drive Preparation

1. Boot from your OS X Installer Disc. After the installer loads select your language and click on the Continue button. When the menu bar appears select Disk Utility from the Utilities menu.

2. After ** loads select your hard drive (this is the entry with the mfgr.'s ID and size) from the left side list. Note the SMART status of the drive in **'s status area. If it does not say "Verified" then the drive is failing or has failed and will need replacing. SMART info will not be reported on external drives. Otherwise, click on the Partition tab in the ** main window.

3. Under the Volume Scheme heading set the number of partitions from the drop down menu to one. Set the format type to Mac OS Extended (Journaled.) Click on the Options button, set the partition scheme to GUID (for Intel Macs) or APM (for PPC Macs) then click on the OK button. Click on the Partition button and wait until the process has completed.

4. Select the volume you just created (this is the sub-entry under the drive entry) from the left side list. Click on the Erase tab in the ** main window.

5. Set the format type to Mac OS Extended (Journaled.) Click on the Options button, check the button for Zero Data and click on OK to return to the Erase window.

6. Click on the Erase button. The format process can take up to several hours depending upon the drive size.

There will be no trace of anything left on the drive. You can at this point quit ** and do a fresh installation of OS X.

I thought it was quite useful.

But, this thread has gone from the goal of just cleaning the drive so nothing bad comes back to one of industrial/military data loss prevention. However, it is way beyond what the OP was looking for.

Kappy wrote:
What's outdated?

For example, the comments that it is "rather easy" to recover data after writing zeros to a drive or that the more passes the more secure the erase is. Those things are true only for old, low density hard drives that use relatively crude mechanical head positioning systems.

In contemporary drives, a single pass secure erase will make it impossible to recover data using all but the most sophisticated forensic techniques. The three pass DoE erase is as good as it gets to thwart even those techniques; more passes will not do anything to resist them any better. If the three pass erase isn't secure enough, the only viable alternative is to destroy the drive.

Since I make no assumptions about the OP's or anyone else's security requirements I have no idea how relevant this might be but I see no harm in mentioning it.

I never made such comments. They were made by The Hatter. I provided correct and relevant information for the OP's question.

Why would the OP need to destroy the drive before sending the computer to Apple for repair is beyond my understanding. A much less extreme solution is simply to remove the drive first.

Here's my problem. If you found the information in The Hatter's reply incorrect, then your post should have been a reply to his, not to the OP. That way the discussion remains in context. When you post to the OP, then your reply is directed to everyone who posted suggesting we're all a bunch of idiots.

Kappy wrote:
I never made such comments.

I never said you did!

They were made by The Hatter.

Actually, the outdated comments came from several people, especially about the increased security of the multi-pass erases available in Disk Utility.

Why would the OP need to destroy the drive before sending the computer to Apple for repair is beyond my understanding. A much less extreme solution is simply to remove the drive first.

I mentioned destroying the drive only because if a DoE 3 pass erase won't meet the OP's security needs (which I make no assumptions about), the 7 & 35 pass erases won't be either, & destroying the drive would be the only thing that would. However, since the Mac in question is only a month old & presumably under warranty, AFAIK removing the drive would not be an option if a warranty repair is desired.

Here's my problem. If you found the information in The Hatter's reply incorrect, then your post should have been a reply to his, not to the OP. That way the discussion remains in context. When you post to the OP, then your reply is directed to everyone who posted suggesting we're all a bunch of idiots.

When I reply to the OP, my reply is directed to the OP. Also, there is a difference between incorrect & outdated info, but neither is the sole prerogative of idiots. Any suggestion that it is does not come from me. Regardless, the context is the info, not who offered it or their mental abilities (which I make no assumptions about). Confine the discussion to that context & there should be no problem.