Jump to content











Photo
- - - - -

Clean USB after it is inserted to an infected computer


  • Please log in to reply
4 replies to this topic

#1 Alexander Ceed

Alexander Ceed

    Frequent Member

  • Advanced user
  • 183 posts

Posted 04 November 2016 - 10:35 AM

Hello

 

Say I insert a usb stick in an infected computer and want to make sure the stick is clean afterwards. Basically I want to use the stick in an infected computer and also use it on other computers without infecting them. All data on it is temporary so it does not matter if partitions/filesystems are wiped. Just need to make the stick is clean of all types of infections.

 

Would removing the filesystem off the drive suffice (like a diskpart clean operation) ?

What about if we are talking about a HDD, would removing the partitions suffice?

 

Thank you



#2 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 13305 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 04 November 2016 - 11:17 AM

Yes/No.

What if the (supposed) virus is a MBR resident one (and it is actually a bootable stick)?

 

Just wipe the first sector (if it is MBR) or the first and last (say) 32 sectors (if it is GPT) by filling it/them with 00's.

 

:duff:

Wonko



#3 Agent47

Agent47

    Frequent Member

  • Advanced user
  • 164 posts
  •  
    India

Posted 04 November 2016 - 04:11 PM

 

 

Just wipe the first sector (if it is MBR) or the first and last (say) 32 sectors (if it is GPT) by filling it/them with 00's.

 

If i am not mistaken, 'diskpart clean' will write zeros to first and last 1 mb of the disk - at least that's what i have seen when i experimented with diskpart and a hex editor. But of course Wonko knows better when it came to file systems.



#4 Alexander Ceed

Alexander Ceed

    Frequent Member

  • Advanced user
  • 183 posts

Posted 04 November 2016 - 05:11 PM

If i am not mistaken, 'diskpart clean' will write zeros to first and last 1 mb of the disk - at least that's what i have seen when i experimented with diskpart and a hex editor.

 

I love reading about this stuff. Thank you for this piece of information.

Am I correct in assuming that clean all command does the same but multiple times (secure overwrite)?

 

 

Just wipe the first sector (if it is MBR) or the first and last (say) 32 sectors (if it is GPT) by filling it/them with 00's.

 

Thank you.



#5 Wonko the Sane

Wonko the Sane

    The Finder

  • Advanced user
  • 13305 posts
  • Location:The Outside of the Asylum (gate is closed)
  •  
    Italy

Posted 04 November 2016 - 06:04 PM

If i am not mistaken, 'diskpart clean' will write zeros to first and last 1 mb of the disk - at least that's what i have seen when i experimented with diskpart and a hex editor. 

Yep :), diskpart clean would do nicely.

 

Still, in the specific case, most probably the faster/safer/whatever is to re-deploy a (partial if it is the case) image of the stick, I mean, it would be easier/faster than:

1) diskpart clean it

2) re-partition/re-format it

3) re-copy to it the tools (if any) that were on it

 

:duff:

Wonko






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users