In some occasions, a verification of a drive using a hex/disk editor (for example the Blancco Drive Eraser / Blancco 5 Hex Viewer), after a successful erasure, shows that there are unexpected patterns on the drive. There can be several reasons for that:
- Check the erasure standard that has been used to erase the drive. Some erasure standards include aperiodic random overwriting steps that write random data throughout the whole drive. Some drives can also write non-periodic data during a firmware-based erasure.
- You can check the used erasure standard from the erasure report.
- Check if the erasure process has written a Fingerprint onto the drive. The Fingerprint is a summary of the erasure report that is written in one of the sectors (sector 200 by default) of the drive.
- To check if you had this feature on, you can load the image (used for the erasure) in Blancco Drive Eraser / Blancco 5 Configuration Tool and check if the setting in question is enabled or not.
- By default, the Fingerprint is written on sector 200, and it contains following data separated by spaces and semicolons:
- Blancco software license owner / customer name
- Date & time of wipe finish (yyyy-mm-dd hh:mm)
- Blancco software version
- Hard drive serial number
- Erasure status (Erased, Erased with exceptions or Not Erased)
- Unique report ID
- Digital signature
- For more information about the Fingerprint, see the Drive Eraser User manual page 56.
- Check if the erasure process has written a Bootable Asset Report onto the drive. The Bootable Asset Report is a short asset report visible as a splash screen when the machine is rebooted.
- The Bootable Asset Report information is typically written on sectors 0 and 2-53 or 2-130 of the drive, depending on the size of the report information.
- Sector 0 (MBR) contains the partition table information and Blancco's "tool" to read the Asset Report image file when the computer starts.
- Sectors 2-130 contain the image file for the Bootable Asset Report. This image file data typically looks "random".
- To check if you had this feature on, you can either boot the machine/drive without any CD/USB/PXE (the Bootable Asset Report should be displayed) or load the image (used for the erasure) in Blancco Drive Eraser / Blancco 5 Configuration Tool and check if the setting in question is enabled or not
- For more information about the Bootable Asset Report, see the Drive Eraser User manual page 57.
- The Bootable Asset Report information is typically written on sectors 0 and 2-53 or 2-130 of the drive, depending on the size of the report information.
- In server environments, some RAID controllers write metadata onto the drive after the erasure has complete. This can also cause verification failures (more information in this article).
- Check if the erasure has (or has not) erased the remapped sectors and/or the hidden areas of the drive. If these sectors have not been erased, some tools may find some data there.
- Check the erasure report for more information.
- Check if the erasure has been a full erasure or a partial one. Partial erasures are possible in case the software is configured to automatically preserve Windows recovery partitions or in case the user has erased individual drive partitions only. Check the erasure report for more information, a partial erasure is accompanied with a disclaimer.
- Some 3rd party software used to audit erased drives (or attempt to recover data from them) can write data in it during its validation process, especially if such tools restore the file system (e.g. NTFS) of the drive (via formatting). If such tools are used for erasure validation or recovery, please be aware of the data that can be left.
If you are still unsure about the erasure result, please contact the Technical Support team. Make sure that you include, at least, the erasure report in XML format and detailed information description of the case (issue report is also helpful/necessary in many cases).