# can the FBI etc read a disk drive that has been properly overwritten once? **URL:** \ **Category:** Factual Questions\ **Created:** [April 11, 2007, 1:11am UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579 "2007-04-11T01:11:11Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![scm1001](https://avatars.discourse-cdn.com/v4/letter/s/c4cdca/32.png) [@scm1001](https://boards.straightdope.com/u/scm1001)\ **Post date:** [April 11, 2007, 1:11am UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/1 "2007-04-11T01:11:11Z")
It seems to be an urban legend that if one does a simple one pass security wipe of a file then it is possible to reconstruct the file by some advanced technique, and that one should do multiple wipes of a file. Given that one presumes the domains involved are fully magnetised how can that be? WAG - it may be some residual magnetisation beyond the domain boundary or that perhaps the degree of magnetisation achieved depends on the prior state. In either case the noise component must be enormous. ---
**Author:** ![silenus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/silenus/32/166_2.png) [@silenus](https://boards.straightdope.com/u/silenus)\ **Post date:** [April 11, 2007, 1:15am UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/2 "2007-04-11T01:15:39Z")
The Department of Defense considers 7 random overwrites to meet its standard of security. Personally, I use 10. ---
**Author:** ![asterion](https://avatars.discourse-cdn.com/v4/letter/a/4da419/32.png) [@asterion](https://boards.straightdope.com/u/asterion)\ **Post date:** [April 11, 2007, 1:26am UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/3 "2007-04-11T01:26:50Z")
Personally, I use 35. Only for sensitive data, becausing overwriting 100+ gigs 35 times is a very long time indeed. Otherwise, 7-9 is enough for when I’m just letting Eraser wipe “empty” space. ---
**Author:** ![Shagnasty](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@Shagnasty](https://boards.straightdope.com/u/Shagnasty)\ **Post date:** [April 11, 2007, 1:27am UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/4 "2007-04-11T01:27:36Z")
I asked this once and got some good answers. I will try to find it but one explanation is that the writes don’t exactly overlap the next time so advanced techniques can still get all or parts of what was there by shifting the read a tiny amount also. ---
**Author:** ![Shagnasty](https://avatars.discourse-cdn.com/v4/letter/s/9dc877/32.png) [@Shagnasty](https://boards.straightdope.com/u/Shagnasty)\ **Post date:** [April 11, 2007, 1:34am UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/5 "2007-04-11T01:34:26Z")
Here is the thread I mentioned: [http://boards.straightdope.com/sdmb/showthread.php?t=279022&highlight=hard+drive](http://boards.straightdope.com/sdmb/showthread.php?t=279022&highlight=hard+drive) ---
**Author:** ![waterj2](https://avatars.discourse-cdn.com/v4/letter/w/858c86/32.png) [@waterj2](https://boards.straightdope.com/u/waterj2)\ **Post date:** [April 11, 2007, 1:35am UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/6 "2007-04-11T01:35:28Z")
It’s my understanding that since each domain isn’t _precisely_ on top of the domain it overwrote, it’s possible to recover data from the edges of each individual domain with some effort. Better yet, let’s quote from Bruce Schneier’s _Practical Cryptography_: > [@](#): > > The read/write head that tries to overwrite old data is never exactly aligned and will tend to leave some parts of the old data untouched. Overwriting does not completely destroy old data. You can think of it as repainting a wall with a single coat of paint. You can still vaguely see the old coat of paint under it. The magnetic domains can also migrate away from the read/write head either to the side of the track or deeper down into the magnetic material, where they can linger for a long time. Overwritten data is typically not recoverable with the normal read/write head, but an attacker who takes apart a disk drive and uses specialized equipment might be able to retrieve some or all of the old data. He cites [this](http://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html) research paper, which, being from 1996, is probably somewhat dated. ---
**Author:** ![mks57](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@mks57](https://boards.straightdope.com/u/mks57)\ **Post date:** [April 11, 2007, 4:00am UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/7 "2007-04-11T04:00:07Z")
It’s also an imperfect analog process. When you overwrite A with B, A is strongly attenuated, not completely erased. ---
**Author:** ![fifty-six](https://avatars.discourse-cdn.com/v4/letter/f/5daacb/32.png) [@fifty-six](https://boards.straightdope.com/u/fifty-six)\ **Post date:** [April 11, 2007, 6:11am UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/8 "2007-04-11T06:11:49Z")
I have always heard about this. How the data is never really gone. When is this used? Because I doubt it is easy to do. Or if it is easy why was this not recovered. [Big Mistake](http://www.usatoday.com/tech/news/2007-03-20-alaska-data_N.htm?csp=34) There may be more to the story, and maybe reformats are different. But I doubt he wiped it the 7 times necessary to effectively hide all the data. Granted it was Microsoft and Dell called in to fix the issue. You would think at least Microsoft would have the resources to recover the data. Are all those wipes really necessary? BTW I use about 10 overwrites myself. ---
**Author:** ![si\_blakely](https://avatars.discourse-cdn.com/v4/letter/s/d9b06d/32.png) [@si\_blakely](https://boards.straightdope.com/u/si_blakely)\ **Post date:** [April 11, 2007, 7:30am UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/9 "2007-04-11T07:30:27Z")
[QUOTE=fifty-six] When is this used? Because I doubt it is easy to do. Or if it is easy why was this not recovered. [Big Mistake](http://www.usatoday.com/tech/news/2007-03-20-alaska-data_N.htm?csp=34) [/QUOTE] I can’t find a huge amount of detail, but if the data was on a RAID volume (where the data is spread across multiple disks) the problem goes up exponentially, because you are looking at overwritten data on multiple drives in a pattern that may not be obvious (even to the manufacturers). and all the drive toreances are different. Plus, if the drive was reused, the really important bits (directory and file table information) get overwritten hard and fast. Low level Data recovery takes a really long time - if you really, really need to have the data, and you probably need an idea of what and where you are looking. Modern hard drives with 10s and 100s of gigabyes (in the same form factor as last decades 10s and 100s of megabytes) just take too long to scan completely (and the leakage domains are so much smaller). You have to scan the drive (at maybe 50% off center), see if your data stream makes sense, then do it again at 60% to see if you get more sense. You may never get sense. You can’t scan the drive once and see all the historic data. For the alaskans, it wasn’t worth it, if it was possible. For the NSA tracking a terrorist, maybe - but it could still be a waste of time. Si ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [April 11, 2007, 4:18pm UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/10 "2007-04-11T16:18:00Z")
Does the disk need to spin to be read? How about a .30 cal bullet through the platters? ---
**Author:** ![mks57](https://avatars.discourse-cdn.com/v4/letter/m/b9bd4f/32.png) [@mks57](https://boards.straightdope.com/u/mks57)\ **Post date:** [April 11, 2007, 4:37pm UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/11 "2007-04-11T16:37:25Z")
[QUOTE=control-z] Does the disk need to spin to be read? How about a .30 cal bullet through the platters? [/QUOTE] No. There are special microscopes that can sense the magnetic fields on the surface of the platters. ---
**Author:** ![Madd\_Maxx](https://avatars.discourse-cdn.com/v4/letter/m/5f9b8f/32.png) [@Madd\_Maxx](https://boards.straightdope.com/u/Madd_Maxx)\ **Post date:** [April 11, 2007, 5:09pm UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/12 "2007-04-11T17:09:46Z")
Melt it down, it’s the only way to be sure. ---
**Author:** ![rowrrbazzle](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rowrrbazzle/32/414_2.png) [@rowrrbazzle](https://boards.straightdope.com/u/rowrrbazzle)\ **Post date:** [April 11, 2007, 8:39pm UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/13 "2007-04-11T20:39:14Z")
Nuke it from…Never mind. 🙂 ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [April 12, 2007, 12:02am UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/14 "2007-04-12T00:02:59Z")
Nah, if you _really_ want to be sure, you toss it into a black hole. ---
**Author:** ![Tuckerfan](https://avatars.discourse-cdn.com/v4/letter/t/eada6e/32.png) [@Tuckerfan](https://boards.straightdope.com/u/Tuckerfan)\ **Post date:** [April 12, 2007, 12:13am UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/15 "2007-04-12T00:13:29Z")
[QUOTE=Madd Maxx] Melt it down, it’s the only way to be sure. [/QUOTE] Indeed. There’s a DoD spec which _requires_ all drives with classified data on them to be destroyed. Remember, just because we lack the technology to read a massively overwritten disk today, doesn’t mean we won’t figure it out tomorrow. ---
**Author:** ![control-z](https://avatars.discourse-cdn.com/v4/letter/c/eada6e/32.png) [@control-z](https://boards.straightdope.com/u/control-z)\ **Post date:** [April 12, 2007, 2:11pm UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/16 "2007-04-12T14:11:22Z")
[QUOTE=Chronos] Nah, if you _really_ want to be sure, you toss it into a black hole. [/QUOTE] No way, I don’t want my evil self from another dimension reading my hard drive data. ---
**Author:** ![Sage\_Rat](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/sage_rat/32/399_2.png) [@Sage\_Rat](https://boards.straightdope.com/u/Sage_Rat)\ **Post date:** [April 12, 2007, 2:33pm UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/17 "2007-04-12T14:33:19Z")
Just on the side of realism: While it may be “possible” to reconstruct data, doing so would probably take a group of techies several years to do so, and some impressive scanning hardware and software. And in the end, probably the files they were able to repair will have been a random selection. So while it may be true that if you want to be “really certain” that you need to overwrite the whole disk several times, for anyone who isn’t expecting to have a major government steal his hard drive any time soon, you’re fine to just overwrite it once. ---
**Author:** ![Gozu](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/gozu/32/6615_2.png) [@Gozu](https://boards.straightdope.com/u/Gozu)\ **Post date:** [April 12, 2007, 2:33pm UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/18 "2007-04-12T14:33:20Z")
I never actually delete any data, I just erase its location from the NTFS table and leave it mostly recoverable. Which is a good thing. Just a few days ago I opened a doc template from the web and started writing my 3600 paper , saving diligently. I never realized that the document was in my browser’s Temp folder and later on, I was shocked to find it had disappeared, nowhere to be found. Undelete plus saved my butt (it’s freeware so I can pimp it). Thank you magnetic properties! ---
**Author:** ![msmith537](https://avatars.discourse-cdn.com/v4/letter/m/d9b06d/32.png) [@msmith537](https://boards.straightdope.com/u/msmith537)\ **Post date:** [April 12, 2007, 3:36pm UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/19 "2007-04-12T15:36:11Z")
The consulting firm I work for has a group that specializes in computer forensics. If you simply delete the data from your hard drive, we can restore it in a matter of hours. Everyone probably knows that. Even if you format the hard drive multiple times, we can probably still extract viewable data (or outsource it to someone who’s kung fu is stronger). If you use software to overwrite the drive with random 0s and 1s, now it gets a bit more interesting. Maybe the tech guys can restore it with special tools that measure the magnetism. I’m not sure. But I do know that would be relatively expensive. The quality of the data would also be in question. It’s one thing to be able to recover some bits and bytes from the drive. It’s quite another to reconstruct them into an actual Word or Excel document or email PST. It wouldn’t take “years”, as \*\*Sage Rat \*\* said, but it would be time consuming, expensive and you still might not recover anything that can be used in a court of law. ---
**Author:** ![gazpacho](https://avatars.discourse-cdn.com/v4/letter/g/6f9a4e/32.png) [@gazpacho](https://boards.straightdope.com/u/gazpacho)\ **Post date:** [April 12, 2007, 3:59pm UTC](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579/20 "2007-04-12T15:59:25Z")
Forensic analysis of overwritten drives is unlikely to be able to recover all of the data just some of it. The DOD or whomever needs to have all the data gone. Say they have a big data base of all the foreign agents or what not. It can be very damaging to have some of those names to get out even if the whole list is not recoverable. Alaska on the other hand needs the whole database recovering some of it it not all that helpful they still need to do the work to recreate the whole thing. [Next page](https://boards.straightdope.com/t/can-the-fbi-etc-read-a-disk-drive-that-has-been-properly-overwritten-once/399579.md?page=2)