PC hardware can pose rootkit threat

TalkBack 25 of 43:

Next »

« Previous

• Thread View
• Flat View

LLF impossible for 20 years now

I'm glad you got your problem solved, but unless your local person has equipment comparable to e.g. the QA Lab at Seagate, he didn't do a low-level format.

Let's start with a definition of what LLF is. It's the process of defining where on a platter surface useable sectors are located. In order for a sector to be useable, each bit in the string of bits necessary to create space for the 512 byte payload plus header and trailer must be able to be reliably read as written. Drive OEMs do this by performing analog measurments from the heads of the HDA so they can accommodate for variations in (relative, for PRML) signal strength at the sense amps due to temperature, voltage, component ageing and flux density degradation due to naturally occurring radiation and EM fields.

The bit streams that don't meet this criteria are marked as bad sectors. Back when you could do a LLF, this bad sector map was printed on a label on the drive and you were required to enter these sectors in manually so they didn't inadvertantly get marked as good when doing the LLF. These bad sectors are replaced by spare sectors on the drive. That is, one of the spare sectors is given the identity (in the header) of the sector that was marked as bad. LLF was also the only way (as I recall) that you could add sectors to the bad sector table.

A high-level format, on the other hand is the process of initializing the payload portion of a sector, the 512 bytes the OS writes and reads. Unfortunately, to expedite installs, the "quick format" hack was instituted. This only initializes those sectors which the files system needs. The remainder contain garbage which will occasionally get read before being written (can you say null pointer?) and wierd things can happen.

As for your assertion that the Federal Government requires LLF prior to disposal of old drives, you'll have to point me to that Reg. before I'll believe it. The DOD and the spooks like the CIA and NSA only care about the 512 byte payloads in the sectors. They want to ensure that someone with equipment comparable the the Seagate QA Lab can't pick up old data by reading slightly off-track one way or the other. They need to account for hysteresis in the head servo as well as for eccentricity in the bearings of the platters. A LLF won't necessarily help in that regard. I am aware of DOD Regs that specify what steps must be taken to ensure that there's no residual valid data in the payload of a sector, but I don't recall any mention of LLF.

You still want to bet?

Posted by: r_widell   Posted on: 04/08/07 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Why Isn't Server Virtualization Saving Us More? A Few Small Changes May Dramatically Increase Your Efficiency VMware Companies have rapidly adopted server virtualization over the past few ... Download Now
• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Open Standards Technologies Provide the Ingredients for Delivering Security Across the Papa Gino's Enterprise Dell Papa Gino's Holdings Corporation founded by the entrepreneur operates one ... Download Now