SDelete and NTFS corruption

  • Thread starter Thread starter aD
  • Start date Start date
A

aD

Hiya,

I've used Sysinternals' SDelete as a command-line secure file wiping
tool for a good year or two, and use it a few times a week usually
deleting small text files etc. It is used on a Windows 2000 Professional
SP4 PC.
I have two physical hard disks, disk0 with C, D, E and disk1 with F G
and H logical partitions. They both have write-ahead caching *disabled*.
Disk0 is a Hitachi/IBM Deskstar IC35L060AVVA07-0 120GXP.
Disk1 is a similar IC35L120AVV207 180GXP. AFAIK these are too recent to
suffer from "click of death" or similar.

A while back I was SDeleting a ~500MB backup file for 10 passes which if
memory serves seemed to complete without a problem, but left the
original file intact with the filename "ZZZZZZZ.ZZZ" There were no
errors in the event log or similar, Hitachi's drive fitness test (sector
scan etc) returned no problems nor did the disk's SMART status.

At the time I figured that I had done something to cause it so didn't
think much of it.

Today I had run SDelete on a few small (<10K) files each for 10 passes,
probably five or six times as I was testing a .bat file I had just
written. This was all on D:.

Once I was happy it was working, I went to tidy my desktop up a bit and
then was browsing a web site. I downloaded a PDF from the web site and
after AV scanning it, went to open it.

Windows Installer then popped up saying it was installing Acrobat
Reader, which I found strange as it's been installed for years :-)

I then found NTFS corrupt errors on D: when trying to do anything, and
immediately set a chkdsk /f and rebooted.

Chkdsk recovered in excess of 1000 file indices which were corrupted,
reporting errors such as:

The index bitmap $I30 in file 0x904 is incorrect.
The down pointer of current index entry with length 0x18 is invalid.
The multi-sector header signature for VCN 0x0 of index $I30 in file
0x969 is incorrect.

So far I don't seem to have lost any file data (am doing a file compare
to yesterday's backup as I type this).

I've chkdsked all other volumes which reported no errors. SMART reports
no errors and I will run Hitachi's drive fitness test shortly but expect
that it won't report a problem.

Now I personally hold Sysinternals with very high regard, but I have had
corruption on this scale on D: alone a few months back and again it was
just broken indices; disk checks etc. said everything was fine.

I don't want to seem like I'm placing blame on SDelete but I am just
having these little thoughts in the back of my mind which are usually
correct, saying "Don't use it again..." :-(

Has anyone any similar experiences to add, comments or other
investigative advice?

TIA,


aD
 
Back
Top