Does fully cleaning the drive remove viruses?

If your computer gets infected by a virus or malware, you may wonder if fully wiping the drive is the only way to disinfect it. As tech specialists, we‘ll look at when drive cleaning is necessary and when other options exist.

Defining drive wiping

When we talk about fully cleaning or wiping a drive, we refer to overwriting the entire drive with zeros or random gibberish. This overwriting is sometimes called "sanitizing" or "purging" the drive.

Here are some key points about proper drive wiping:

• It overwrites all sectors, erasing any previous user data or programs.

• The drive is returned to a factory-fresh state, prepared for a new OS installation.

• Even with forensic recovery methods, overwritten data is unrecoverable.

• There are different standards on the number of overwrite passes:

  • DoD 5220.22-M specifies 7 passes.

  • NAVSO P-5239-26 specifies 3 passes.

  • Schneier‘s algorithm uses 7 random passes.

• More passes provide higher security, but take much longer to run. A single pass is sufficient for most use cases.

Why regular formatting falls short

When you normally delete files or format a drive, the underlying data is not actually erased – only the indexes marking it as deleted are modified. The data remains intact on the drive surface until gradually overwritten by new content.

This means regular formatting does NOT fully clean or sanitize the drive. Specialized recovery software can still pull off deleted data.

Sneaky persistence tricks used by malware

Malware authors have gotten crafty at persisting through OS reinstalls and even full drive formatting:

• Boot sector viruses embed themselves in the boot loader code, which is untouched by formatting the drive.

• File infectors target critical system files needed for proper booting and operation.

• Rootkits use admin exploits to hide their presence from scanners and monitoring tools.

• Alternate data streams stash data in hidden streams not visible in standard directory listings.

• Memory-only malware resides strictly in RAM and avoids detection by disk scanners.

Leveraging antivirus software

For most infections, the best recourse is a reputable antivirus program rather than fully wiping the drive. Features we need include:

• Real-time protection to block malicious programs from running in the first place.

• On-demand scanning to perform full system scans looking for infections.

Once nasty stuff is found, the antivirus can either delete the malware outright or quarantine it safely for additional analysis.

However, some additional steps may be required for full remediation:

• Boot into safe mode to remove any malware hooked into the OS startup sequence.

• Update virus definitions and rescan after initial cleanup.

• Change any system passwords that may have been compromised.

• Monitor system closely for signs of residual infection over next few days.

Here‘s a comparison of popular home antivirus suites and their malware detection rates according to independent testing lab AV-Comparatives:

When should you fully wipe the drive?

For typical virus removals, a full drive wipe is overkill and risks losing personal data. However, it may be warranted in certain cases:

• You‘ve been hit with extremely persistent malware that continues surviving normal removal attempts.

• There is evidence the system was compromised by kernel-level rootkits that are difficult to detect and remove.

• You are permanently dumping or selling the computer and want to completely purge sensitive data.

• As part of rotating backups, you wish to purge old data by wiping the retired backup drives.

• Compliance standards require wiping storage media before disposal to prevent data leaks.

Forensic recovery of wiped drives

After a proper drive wiping process, forensic recovery of old data becomes enormously difficult, though not always impossible. Faint traces can potentially be retrieved through:

• Magnetic force microscopy – Uses a specialized microscope to detect magnetic patterns on the drive platters.

• Chip disassembly – Physically dismantles SSD chips to attempt raw NAND data recovery.

• Interrupted wipe – If power loss or crash stopped the wipe prematurely, some recoverable data may remain.

For an ordinary home or business user, a wiped drive can be considered data-dead. But if dealing with highly classified data, physical destruction of the drive may be the only acceptable option.

Safeguarding your data from loss

To avoid needing drive wiping in the first place, here are some key steps we recommend:

• Use modern antivirus and firewall tools. Check they rate highly on independent testing sites.

• Always install software updates promptly to close security holes. Enable auto-updates where available.

• Be wary of downloads and email attachments, especially from unverified sources.

• Practice safe browsing habits, avoiding suspicious sites and ads. Use ad blocking extensions.

• Periodically back up important data offline or to disconnected external media.

• Securely erase and destroy old hard drives and SSDs before disposal – don‘t just toss them in the garbage!

The bottom line

While fully wiping your drive is sometimes necessary for rooting out infections, it should not be the first resort in most cases. With quality security tools and safe computing practices, malware can usually be banished without nuking the drive. But be prepared to break out the heavy artillery if an infection manages to dig itself deep!