Quote:


See, If I write malicious code that even just overly taxes the drive to the point that hardware fails, it would be easy to assume that to be a hardware failure, but not good forensics.




Don't need to write anything - Windows already does that by itself...

More seriously though, it would be a hardware failure - software cause I admit, but still a hardware failure, and our customers would likely see degradation in performance* and ask us to fix it before the drive actually failed - however, the only arguments that I can reasonably give to counter that particular scenario are:

a) We don't get "repeat failures". Either your putative code never made it to the new drive OR it never existed... We very often are able to recover data from failing drives and clone 'em before they actually fail completely. If the customer gets here soon enough we usually save everything - the new drives will be clones of the failed ones 'cos that saves enormous amounts of time, and therefore money, and gets our customers systems into a known state. We always perform malware scans to make as sure as we possibly can that no systems go back out the door with malware still installed.

b) Please give me an example of such code "in the wild", I'm not aware of any but then I don't know everything either. That said, these days the vast majority (perhaps all) of malicious code is looking to extract data, not break things.

c) Why would such code be HDD brand specific? We see less Seagate's and WD's fail than anything else. Amongst the big names, our current contender for highest failure rates is Fujitsu, followed by Toshiba. That's not to say they're bad, they just happen to fail a little more often.

Anything is possible, but not everything is probable.

*actually, thinking about it - most of them wouldn't - we see some dreadfully poor performing systems that some fairly simple clean-ups make enormous differences to.