0

I am currently wondering how to detect malware on an HDD, so trying to break apart the questions into smaller chunks.

For this question I am wondering how to completely clear an external hard drive (HDD) so it is guaranteed not to have any viruses, malware, or other software/programs running on it. I don't quite understand how you can detect this, like seeing if the bits are in some way, or what.

I am not sure if there is firmware on the HDD, in which case there are other ways a virus might stay on there. Would be interested to clarify if there is firmware on the HDD, which would mean there really is no way to write software code to clean the HDD completely, but not really part of the question.

Other than the firmware aspect, which is more of a tangent, the main question is about the kind of software that can be written to clear the external hard drive completely. I read about Disk formatting which I know very little about, still have to better understand that. But instead of answering "just install antivirus/cleaning software X and press "clean" and you're good", I would like to know the (theoretical) features these softwares have, so that I could better understand what it would take to implement the software from scratch.

An answer might just contain a list like:

  • You need to do disk reformatting, which does X to clear Y types of stuff.
  • You need to run ps ax and these other standard commands.
  • You need to restart your computer.
  • etc.

It doesn't need to be too comprehensive or detailed, I am just looking for an introduction to what needs to be done/implemented to properly clear a disk.

Lance
  • 598
  • 5
  • 16

1 Answers1

2

You don't have to clear the data, if it is not executed. No operating system will just read bytes from the hard drive and execute them if you don't instruct it to. It is enough to clear the boot sector and partition table, create the new partition(s) you want and format them with any file system you want.

You can e.g. fill the drive with zeros to be absolutely sure, but that's not necessary.

The simplest way to achieve all that is to fill the first few sectors with zero.

e.g. dd if=/dev/zero of=/dev/sdX bs=1M count=2

Of course if the firmware of the drive contains malicious code, this is a whole different story.

Josef
  • 5,933
  • 26
  • 34