4 replies to this topic

[Uneitohr]

Hello

 

Say I insert a usb stick in an infected computer and want to make sure the stick is clean afterwards. Basically I want to use the stick in an infected computer and also use it on other computers without infecting them. All data on it is temporary so it does not matter if partitions/filesystems are wiped. Just need to make the stick is clean of all types of infections.

 

Would removing the filesystem off the drive suffice (like a diskpart clean operation) ?

What about if we are talking about a HDD, would removing the partitions suffice?

 

Thank you

[Wonko the Sane]

Yes/No.

What if the (supposed) virus is a MBR resident one (and it is actually a bootable stick)?

 

Just wipe the first sector (if it is MBR) or the first and last (say) 32 sectors (if it is GPT) by filling it/them with 00's.

 

Wonko

[Agent47]

 

 

Just wipe the first sector (if it is MBR) or the first and last (say) 32 sectors (if it is GPT) by filling it/them with 00's.

 

If i am not mistaken, 'diskpart clean' will write zeros to first and last 1 mb of the disk - at least that's what i have seen when i experimented with diskpart and a hex editor. But of course Wonko knows better when it came to file systems.

[Uneitohr]

If i am not mistaken, 'diskpart clean' will write zeros to first and last 1 mb of the disk - at least that's what i have seen when i experimented with diskpart and a hex editor.

 

I love reading about this stuff. Thank you for this piece of information.

Am I correct in assuming that clean all command does the same but multiple times (secure overwrite)?

 

 

Just wipe the first sector (if it is MBR) or the first and last (say) 32 sectors (if it is GPT) by filling it/them with 00's.

 

Thank you.

[Wonko the Sane]

If i am not mistaken, 'diskpart clean' will write zeros to first and last 1 mb of the disk - at least that's what i have seen when i experimented with diskpart and a hex editor. 

Yep , diskpart clean would do nicely.

 

Still, in the specific case, most probably the faster/safer/whatever is to re-deploy a (partial if it is the case) image of the stick, I mean, it would be easier/faster than:

1) diskpart clean it

2) re-partition/re-format it

3) re-copy to it the tools (if any) that were on it

 

Wonko