Gabriela said:
Someone might correct me if I'm wrong, but AFAIK a low-level format
isn't necessary to remove malware, even if they are rootkits.
It would be fruitless to perform an actual low-level format (unless
your intention is to destroy your HDD). It's normally done once (as
that webopedia definition I pointed you to said) at the factory by the
disk's maker. The process writes out the physical "geometry" of the
hard disk, that is, the actual tracks and sectors. Utilities that
claim to LLF a hard disk are invariably disk wiping programs (a.k.a.
zero-fill progs), that is, they fill the disk with all 0s (or what have
you) overwriting all the high-level data on the disk--but not the
low-level physical geometry data (wouldn't it stink if that happened
every time you ran FORMAT? =) .
My question, simply put, is whether or not the true physical geometry
data (the LLF) that's stored on the disk can somehow be modified by or
infected with malware (or if the HDD's BIOS can be infected/etc.)
rendering the disk "uncleanable" (heh). My guess would be no, but I'm
paranoid about malware infection and I don't know enough about the
low-level operations of hard disks to know if what I'm asking is
possible or laughable or what. I understand that any high-level data
(malware or otherwise) can be dealt with by means of a (normal)
high-level format and partitioning, or by a disk wiping/zero-fill
Other devices? Which ones are in your mind?
Anything that can hold data (especially nonvolatile/persistent data).
A small amount of code could hide in CMOS but it wouldn't be directly executeable.
Could it be removed/"cleaned" by clearing the CMOS? That is, would I
be able to use the "Clear CMOS Data" jumper on a motherboard (if
present) or would I have to remove the battery and let the contents
melt away? =)
Thanks very much for all the help and info.
