Simson, I have a disk wiped with Ontrack Data Eraser that exhibits a similar behaviour as to what you described. I prepared it over a year ago using Ontrack for a training class. I am not sure if I know the version number but it could be the program used to wipe the drive you are referencing.
It places a 10 digit number at the beginning of each sector followed by short hand date/time stamp. The date/time stamp is consistent throughout all sectors and reflects the time the wipe was started. The date/time stamp was followed by sequential xFF that I instructed it to use. 0000000000 1 JLY 2004 11:15:44 FF FF FF FF FF FF ...... 0000000001 1 JLY 2004 11:15:44 FF FF FF FF FF FF ...... 0000000002 1 JLY 2004 11:15:44 FF FF FF FF FF FF ...... .... Hope this helps Rob -----Original Message----- From: Simson Garfinkel [mailto:[EMAIL PROTECTED] Sent: Monday, October 31, 2005 2:22 PM To: forensics@securityfocus.com Subject: EEEEEEEEEEE - sanitization? I have found a most interesting drive on the secondary market. Every block of the drive contains the following: 10 digit decimal number with the block number. A timestamp The capital letter "E" filled to the end of the block. It looks to me like this drive was properly sanitized with some tool. Is anybody familiar with such a tool as this? I'm very curious, because I've previously suggested filling drives with E's --- but the idea of writing individual sector numbers and timestamps had not previously occurred to me. Thanks!
