[QUOTE=Q.E.D.]
is death for the drive
[/QUOTE]
At least in the spy-plane incident, that was kind of the point.
And quite frankly, drives are cheap, compared to the security of your data. Very cheap. I have no qualms about destroying the drive from an old computer and just buying a new one.
[QUOTE=CynicalGabe]
At least in the spy-plane incident, that was kind of the point.
[/QUOTE]
Well, yes. But, if you intend the drives to be reused, not so much. Which was kind of my point. 
[QUOTE=Rysto]
Recovery of data that’s been overwritten on the disk? Glancing at the website it looks like they just recover data from drives suffering from physical damage or filesystem corruption.
[/QUOTE]
They also do computer forensics. I don’t know they have MFSTM microscopes for looking at the magnetics, but my point is that there are private firms out there that have the capability to recover deleted data.
Even with the FBI, I have to think using exotic techniques to recover deleted data is a relatively rare occurance. For most cases, it’s usually enough to take an image of a persons disk and scan it with forensic software.
For the ultimate paranoid individual, I recommend getting a file shredder/disk wiper that incorporates Peter Gutmann’s algorithm. It uses an impressive 35 wipes (so it takes a while) and some will probably say it’s overkill but it will definitely get the job done with the chance of recovery of nil. Several file shredding programs can do it, both free and shareware.
Details on the algorithm: Peter Gutmann (computer scientist) - Wikipedia
[QUOTE=Q.E.D.]
Because it’s really tough to do without ultra-powerful magnets or exposing the platters (which, unless done in a clean room, is death for the drive). Additionally, even if you’re successful, erasing the data in this manner also erases the servo data, which renders a modern IDE HDD nearly worthless. Only the drive manufaturer can rewrite the servo data and I’m sure they’re not going to do it for free.
[/QUOTE]
I can say from experience that amateur degaussing doesn’t work very well. We have a heavy-duty degaussing machine at work that we use for backup tapes. It was also rated for wiping hard drives, so I tried it out. Pulled drive from laptop, set it on degausser, cranked it up to maximum power and did the requisite time and spins/flips of the drive.
Put drive back into laptop, powered it up and it was like nothing had happened.
Anyhow, we do multiple overwrites of all hard drives before they are disposed of. I had one drive that just died with several hundred gigs of confidential data on it; since it wouldn’t spin up overwriting was not a solution, in that case I opened up the mechanism, removed all the platters, scraped the living hell out of them, broke them and disposed of them in different “secure disposal” bins.
[QUOTE=CaveMike]
I’d like to add sdelete. It is a single Windows executable that can delete both used and free space. You can specify the number of passes and the algorithm is the “Department of Defense clearing and sanitizing standard DOD 5220.22-M”.
[/QUOTE]
That looks like a useful program. But since it is command-line driven, it is important to understand what the parameters are, and I find two of them confusing. Maybe you can help.
I want to wipe out all data in currently unused areas without touching anything else. Sdelete has two params: -z, “cleanse free space” and -c, “zero free space”. What’s the difference? Does -z clean up only unallocated areas?
I’d remove the hard drive, smash it with a big-ass hammer, and install a new one.
[QUOTE=Kalhoun]
I’d remove the hard drive, smash it with a big-ass hammer, and install a new one.
[/QUOTE]
Is that cheaper than a good erase? I don’t think so.
[QUOTE=Musicat]
I want to wipe out all data in currently unused areas without touching anything else. Sdelete has two params: -z, “cleanse free space” and -c, “zero free space”. What’s the difference? Does -z clean up only unallocated areas?
[/QUOTE]
-c will write zeros to the free space. This isn’t so-much a security measure as disk optimization function. It would not be terribly difficult to recover data that has been overwritten with zeros.
-z will do the byte masking and random writes discussed above that make any previously deleted data in the free space practicably unrecoverable after sufficient passes.
http://searchwincomputing.techtarget.com/tip/0,289483,sid68_gci1246592,00.html
The idea that “erased” data wasn’t really erased seemed plausible, but was there any real evidence supporting the hypothesis that to completely erase a drive, you must erase it multiple times?
The idea that “erased” data wasn’t really erased seemed plausible, but admittedly only because I hadn’t solicited any second opinions about the matter. Is there any evidence supporting the hypothesis that to completely erase a drive, you must erase it multiple times?
The source for this primarily stems from a paper presented by Peter Gutmann at the 1996 Usenix conference. In his paper, entitled Secure Deletion of Data from Magnetic and Solid-State Memory, Gutmann claimed that it was possible to use electron microscopy to read the platters of a hard disk drive and ferret out images of data previously written and then overwritten.
Daniel Feenberg of the National Bureau of Economic Research in Cambridge, Mass., found the idea faintly fishy, and took Gutmann’s premises to task in a 2003 essay entitled Can Intelligence Agencies Read Overwritten Data?. To Feenberg, the evidence that Gutmann had assembled in his paper didn’t look very solid.
Feenberg pointed out that while it was possible to use scanning electron microscopy to view images of magnetic signatures on a drive platter, that was a long way from being able to decode such things, i.e., actually assembling usable copies of erased data from them.
In the essay, Feenberg also noted that if the effect Gutmann described was real, it would cut both ways. “In one section of the paper Gutmann suggests overwriting with four passes of random data,” Feenberg wrote. “That is apparently because he anticipates using pseudo-random data that would be known to the investigator. A single write is sufficient if the overwrite is truly random, even given an STM microscope with far greater powers than those in the references. In fact, data written to the disk prior to the data whose recovery is sought will interfere with recovery just as much as data written after – the [electron] microscope can’t tell the order in which magnetic moments are created. It isn’t like ink, where later applications are physically on top of earlier markings.”
Can data be recovered from erased hard disk drives?
What do data recovery experts have to say? I asked Jim Reinert, senior director of software and services for Ontrack Data Recovery whether any of this was possible. His answer was a blunt “No.”
To this end, the objections about this clandestine recovery technique seem to boil down to three things:
[INDENT]1. Nobody has ever shown they can actually do this. (This, to me, is the most important fact: No one has ever actually taken a hard disk drive, recorded data on it, overwritten the data, then attempted to recover it—let alone demonstrated that they can do this reliably.)
2. No reputable data recovery expert believes this is possible or advertises that they can do it. (Do you want to end up in the position of having taken money for a service you can’t provide?)
3. If it isn’t possible to do it commercially, there’s a strong chance no intelligence agency can do it either.[/INDENT]
[QUOTE=1010011010]
-c will write zeros to the free space. This isn’t so-much a security measure as disk optimization function. It would not be terribly difficult to recover data that has been overwritten with zeros.
-z will do the byte masking and random writes discussed above that make any previously deleted data in the free space practicably unrecoverable after sufficient passes.
[/QUOTE]
Regarding the use of the program sdelete, I was unable to get it to run on the subject computer, getting multiple error messages, somthing about a “UNC drive”.
Since Dell wouldn’t send me a recovery disk for any price, I formatted the C: drive and reinstalled a 98SE OS from another OEM disk, using the original serial number. It worked, and that unit is now delivered to the recipient.
PatriotX, that’s really interesting info. It shows how urban legends can be part of the tech world, not just the average Joe. It harks back to the 18.5-minute gap in the Nixon tapes. Supposedly they were overwritten only once, but the best minds of the decade were put to the task and they couldn’t recover anything. (I know, I know, it wasn’t digital, but still…)
FWIW, I’m a computer forensics consultant, and we use this at the office to wipe client data on drives, but I don’t think it’s something that most people are going to have access to.
Anyway, for 99% of the forensics situations, overwriting your data with zeroes or ones is sufficient. At that point, things like EnCase & FTK won’t find a damn thing on the drive, and I’d be willing to wager that the majority of data recovery firms wouldn’t find much either. Most data recovery companies are oriented toward screwy tapes, physically screwy drives, or drives with intact data and bad electronics, not toward recovering intentionally wiped data.
I’m as sure as I can be that the cost of recovering anything useful from an intentionally wiped drive would be astronomical, and not worth the trouble unless you are the CIA or KGB or whoever.
It’s certainly beyond the cost of the majority of court cases, I can assure you. When they balk at the relatively easy and quick tasks that we routinely do, lawyers are going to choke at the cost of that kind of recovery.
In a nutshell, any tool that overwrites every byte with something else will be adequate for any practical purposes.
I’m just going to throw out some observations based on my knowledge of operating systems, disk storage, storage allocations, file access tables, formatting (both high and low-level), servo operation, and a host of related topics from 30 years of computer experience.
[ol][li]We know that “deleting” files in modern, PC-type systems does not remove or alter the data, but only flags the directory entry with a mark that can easily be detected, reversed and all data recovered if tackled before subsequent disk activity.[]Formatting may overwrite all data, or may just rewrite servo-significant data, or may just rewrite pointer data, depending on the system, so it cannot be said that formatting wipes out all significant data without knowing the particulars.[]All modern data allocation systems store contiguous data in a manner which is typically non-contiguous and in a frequently used but infrequently defragmented drive, becomes scattered across many sectors. While figuring out or guessing what the allocation and sequence is for data recovery is theoretically possible without a map if time is unlimited, the map provided by the directory entry pointers is quite essential to speedy recovery.After deletion of a file, the space taken up both by the data and the directory entry pointers is subject to reallocation and therefore obliteration on a random basis, sometimes repeatedly, removing both the map or parts of the map and data or random parts of the data. So continued, typical use of a computer will reduce the chances of data recovery as time progresses.[/ol]Therefore, completely overwriting unused space in both directory pointers and data areas will provide a reasonable assurance of non-recovery. To be even more sure, perhaps approaching 100%, overwrite all areas more than once and with random data rather than all of the same byte value which will tend to disguise significant data.[/li]
There, I’ve said my piece, and I feel better.