Correct. It's a probabilistic issue -- the larger the "required flag string", the lower the chance of it being accidentally encountered (of course, that is a lie as some very long strings could well be encountered: "We hold these truths to be self-evident, that all men are created equal, that they are endowed by their Creator with certain unalienable Rights, that among these are Life, Liberty and the pursuit of Happiness. That to secure these rights, Governments are instituted among Men, deriving their just powers from the consent of the governed" Possibly not as likely to be encountered on a "programmer's" computer. OTOH, an American History student might find this on *his* computer in a "live" file!
Note that you can still "be 100% safe" if you only use this "flag" as a highly compressible string. I.e., if you detect a sector containing
512 specific bytes (as alluded to, above), then "encode" that sector's contents as "VERY_SPECIAL_512_CHARACTER_STRING" -- using essentially the same sort of data reduction technique that a FS-aware scheme would use to indicate "nothing in this sector".Correct. Can't expect the OS to fill them with anything when unlinked. Also can't prevent the OS from reusing them in a temporary file just after you've finished unlinking them (if the OS uses them in a PERMANENT file, then you WANT to preserve it's contents!).
So, you wouldn't want to do this on a system that isn't reasonably quiescent.
[But, the goal is to do this imaging just prior to *deploying* a system so it isn't "active"]Exactly. My approach will be to fill, unlink and then shutdown. This minimizes the window in which the system can decide to reallocate some of those "marked, deleted sectors" for other uses.
It also slyly addresses the possibility of the system "getting very upset" when it runs out of disk space! (I.e., it will be taken down shortly thereafter so won't be expected to provide services in that stressed condition)
The image is created once. So, the costs of creating it aren't as important as the costs in "keeping the image around" (in case it is EVER needed).
The more practical cost is incurred when/if the "deleted flag" is used as a RELIABLE indication that the sector is "not in use" and, as a result, the sector is not restored (written) back to the medium. On a really large drive with low utilization, a fair bit of time can be spent writing "DELETEDDELETEDDELETED..." over and over and over again!
But, this can be offset by limiting the size of the *partition* that is being imaged (and, noting that partitions and disks are not the same thing!). E.g., for the student laptops, I can look at the amount of unused space available when the system is built. And, a rough metric on how quickly that CPU can push bytes at that disk drive. If this looks like the "fill deleted sectors" portion of the operation will be painfully lengthy, I can choose to split the partition into two partitions (e.g., SYSTEM and DATA). And, provide no "restore guarantees" on the non-SYSTEM partition (which, in all probability, will be "empty" when the machine is first built!)
I.e., the policy decision becomes mine instead of determined by an algorithm.